Types of Risk Assessment: Inputs, Outputs and Mitigation

1. Why This Topic Matters

The risk assessment is the foundation of every anti-financial crime (AFC) program. The Financial Action Task Force (FATF) Recommendation 1 requires countries and financial institutions to identify, assess and understand their money laundering and terrorist financing risks and to apply a risk-based approach (RBA) so that resources are directed where the risk is highest. Regulators across the world (FinCEN, the FCA, MAS, the EU AML Directives, the Wolfsberg Group guidance) all expect an institution to be able to demonstrate that its controls are proportionate to its risk profile. If you cannot show how you measured your risk, you cannot justify why you monitor some customers more closely than others, why you decline certain products or why you devote more compliance staff to one business line than another.

For the CAMS exam this topic sits inside the AFC Program Governance and Risk Management domain and is heavily tested because it links together almost every other area: customer due diligence (CDD), enhanced due diligence (EDD), transaction monitoring, sanctions screening, training, independent testing and board oversight. Expect scenario questions that ask you to identify the correct type of assessment, the correct input, the appropriate output or the most suitable mitigation for a given weakness.

2. What a Risk Assessment Is

An AML/CFT risk assessment is a structured, documented process in which an institution identifies the financial crime threats it faces, evaluates its exposure to those threats (inherent risk), assesses the quality of the controls in place and arrives at the remaining exposure (residual risk). The result is compared with the institution's risk appetite approved by the board. Where residual risk exceeds appetite, mitigation is required.

Key formula to memorise: Inherent Risk – Control Effectiveness = Residual Risk. Inherent risk is the risk before controls are considered; residual risk is the risk after controls are applied. Exam questions frequently test whether you understand this distinction.

3. Types of Risk Assessment

a) National Risk Assessment (NRA) – conducted by a country (often led by the Ministry of Finance, central bank or FIU) to identify ML/TF threats and vulnerabilities at the jurisdictional level. FATF Recommendation 1 and the FATF Methodology require it. Institutions must use the NRA as an input to their own assessments. The EU also produces a Supranational Risk Assessment (SNRA).

b) Enterprise-Wide Risk Assessment (EWRA) – the institution-level assessment covering all business lines, legal entities and geographies. It aggregates risk across the whole organisation and is the document most regulators ask for first. It is normally approved by senior management or the board and refreshed at least annually or when there is a material change (new product, acquisition, new market, regulatory change, significant audit finding).

c) Business Line / Legal Entity Risk Assessment – a sub-assessment for a particular division (e.g. private banking, correspondent banking, trade finance, retail) or subsidiary. These roll up into the EWRA.

d) Customer Risk Assessment (Customer Risk Rating or CRA) – an assessment of each individual customer at onboarding and periodically thereafter. Factors include customer type (individual, corporate, trust, PEP, non-resident), ownership structure, occupation or industry, source of funds and wealth, expected activity, geography and products used. The output is a rating (typically low, medium, high) that drives the level of due diligence (CDD, EDD) and the frequency of periodic review.

e) Product and Service Risk Assessment – evaluates how easily a product can be abused for ML/TF. Higher-risk examples: private banking, correspondent banking, trade finance, cash-intensive services, prepaid cards, virtual assets, international wire transfers, anonymous or bearer instruments. Lower-risk examples: salary-linked current accounts, small consumer loans, pensions.

f) Geographic / Jurisdictional Risk Assessment – considers where the institution operates, where its customers are located and where transactions flow. Inputs include FATF high-risk and monitored jurisdictions lists, sanctions programs (OFAC, UN, EU, HMT), the Basel AML Index, Transparency International's Corruption Perceptions Index, tax haven lists, and jurisdictions with weak AML regimes or high levels of drug trafficking, terrorism or corruption.

g) Delivery Channel Risk Assessment – non-face-to-face onboarding, intermediaries, agents, introducers, correspondent relationships and online or mobile channels can increase risk because they reduce transparency of who the customer really is.

h) Sanctions Risk Assessment – a distinct assessment of exposure to sanctions violations, considering customer base, geography, products, payment flows and screening controls. Often performed alongside the AML assessment but with its own methodology because sanctions compliance is strict liability in many jurisdictions.

i) Thematic or Specialised Risk Assessments – focused assessments on bribery and corruption (ABC), fraud, tax evasion, human trafficking, proliferation financing (now required by FATF Recommendation 1), terrorist financing and third-party or vendor risk.

j) New Product / Change Risk Assessment – performed before launching a new product, entering a new market or completing a merger or acquisition so that controls are designed before exposure begins.

4. Inputs: What Feeds the Risk Assessment

A credible assessment draws on both quantitative and qualitative, internal and external data.

Internal inputs:
• Customer data: number of customers by risk rating, type, PEP status, high-risk industries, non-resident proportion, ownership complexity.
• Transaction data: volumes and values by product, cash activity, cross-border wires, transactions with high-risk jurisdictions, correspondent flows.
• Suspicious activity report (SAR/STR) statistics: number filed, trends, types of typologies observed.
• Alert volumes and false positive rates from monitoring and screening systems.
• Results of internal audit, compliance testing and quality assurance.
• Regulatory examination findings, enforcement actions and remediation status.
• Law enforcement requests (subpoenas, production orders, 314(a)-type requests).
• Known control gaps, system limitations, staffing levels and training completion.
• Customer complaints, whistleblower reports and exit decisions.
• Prior risk assessments and progress against prior action plans.

External inputs:
• National and supranational risk assessments.
• FATF Recommendations, Mutual Evaluation Reports, typology reports and the lists of high-risk and monitored jurisdictions.
• Regulatory guidance and risk alerts (FinCEN advisories, FCA Dear CEO letters, Wolfsberg FAQs, Egmont Group publications).
• Sanctions lists and sanctions regulators' guidance.
• Corruption and country risk indices (TI CPI, Basel AML Index, World Bank governance indicators).
• Industry typologies, peer enforcement cases and adverse media.
• Macro trends such as new payment technologies, virtual assets, geopolitical events.

Examiners expect inputs to be current, relevant, documented and verifiable. A common exam trap is an answer that relies solely on management opinion or on outdated data; the better answer always combines data with expert judgement.

5. How the Methodology Works

Step 1 – Identify risk categories: customers, products and services, geography, delivery channels, and often transactions and other factors such as employees or third parties.

Step 2 – Assess inherent risk: for each category, measure likelihood and impact using agreed scales (e.g. 1 to 5) and weightings. Quantitative metrics (e.g. percentage of customers that are PEPs) are combined with qualitative judgement.

Step 3 – Evaluate control effectiveness: review the design and operating effectiveness of policies, procedures, CDD/EDD, screening, monitoring, reporting, training, governance and independent testing. Controls are usually rated as strong, satisfactory, needs improvement or weak.

Step 4 – Determine residual risk: apply control effectiveness to inherent risk to obtain the residual rating.

Step 5 – Compare with risk appetite: determine whether the residual risk is acceptable. Where it is not, the gap must be mitigated.

Step 6 – Document, approve and communicate: record the methodology, assumptions, data sources and conclusions; obtain senior management or board approval; share with relevant stakeholders.

Step 7 – Monitor and refresh: update on a defined cycle and on trigger events.

6. Outputs: What the Risk Assessment Produces

• Risk ratings and heat maps showing inherent risk, control strength and residual risk by category, business line and entity.
• Identified gaps and vulnerabilities where controls are weak or absent.
• Action plans / remediation plans with owners, deadlines and tracking.
• Resource allocation decisions – where to deploy staff, technology and budget.
• Policy and procedure updates – for example tightening onboarding rules for a high-risk segment.
• Customer due diligence parameters – which customers require EDD, frequency of periodic reviews, which relationships to exit.
• Transaction monitoring and screening calibration – scenario thresholds, rule selection, list selection.
• Training needs – targeted training for business lines exposed to the highest risk.
• Reporting to the board and senior management – the assessment is a key management information document and supports the board's oversight responsibility.
• Input to independent testing – audit uses the risk assessment to plan its risk-based audit coverage.
• Evidence for regulators that the institution understands and manages its risk.

An essential point: the risk assessment must be actioned. A beautifully written document that is filed and ignored is a regulatory finding waiting to happen. Regulators look for a demonstrable link between the assessment and the controls.

7. Mitigation: Responding to Risk

Classic risk responses are avoid, reduce (mitigate), transfer and accept. In AML/CFT, transfer is rarely available (you cannot insure away regulatory liability), so the focus is on avoid, reduce and accept.

Preventive controls: customer acceptance policies, prohibited customer and product lists, CDD and EDD, beneficial ownership identification, sanctions and PEP screening at onboarding, source of funds and wealth verification, senior management approval for high-risk relationships, training and clear policies.

Detective controls: transaction monitoring, ongoing screening, periodic reviews, trigger event reviews, adverse media monitoring, management information and key risk indicators, independent testing and compliance monitoring.

Corrective controls: SAR/STR filing, account restrictions, exiting relationships, remediation projects, disciplinary action, lookback reviews, system fixes.

Risk-specific mitigants:
• High-risk customers: EDD, senior approval, more frequent reviews, lower monitoring thresholds.
• High-risk products: transaction limits, additional documentation (e.g. trade finance document checks), restricted eligibility.
• High-risk geographies: enhanced screening, country limits, prohibition of certain corridors, correspondent due diligence.
• High-risk channels: enhanced identity verification, use of trusted intermediaries only with reliance agreements, controls over agents.

Risk acceptance: where residual risk is within appetite the institution may formally accept it, but acceptance should be documented and approved at the appropriate level.

Avoid wholesale de-risking: FATF and many regulators warn against exiting entire categories of customers (e.g. all money service businesses or all charities) without a case-by-case assessment. The exam favours answers that manage risk rather than indiscriminately terminate it.

8. Governance Around the Risk Assessment

• The board or senior management approves the risk appetite and the EWRA and receives reports on results.
• The compliance / AML officer owns the methodology and coordinates the process; the business (first line) provides data and owns its risks; compliance (second line) challenges and oversees; internal audit (third line) independently tests both the assessment and the controls.
• The assessment should be refreshed at least annually and whenever there is a material change in the business, the regulatory environment or the threat landscape.
• Documentation must allow a regulator to follow the logic from data to conclusion to action.

9. Exam Tips: Answering Questions on Types of Risk Assessment: Inputs, Outputs and Mitigation

Tip 1 – Know inherent versus residual cold. If a question asks about risk before considering controls, the answer is inherent. If it mentions the effect of controls, it is residual. Questions may describe a scenario and ask what the compliance officer should do next; the logical sequence is identify risks, assess inherent risk, evaluate controls, determine residual risk, compare to appetite, mitigate.

Tip 2 – Identify the type of assessment from the clues. A question about a country-level exercise points to the NRA; a question about the whole institution points to the EWRA; a question about a single customer points to customer risk rating; a question about launching a new service points to a new product risk assessment.

Tip 3 – Match inputs to the four classic categories. Most CAMS questions organise risk around customers, products/services, geography and delivery channels. When asked what should be considered in an assessment, choose answers covering these categories; be suspicious of answers that focus only on one (e.g. only geography).

Tip 4 – Prefer data plus judgement over opinion alone. If one option relies on gut feeling of the business head and another relies on SAR statistics, audit results and the NRA combined with expert review, the second is correct.

Tip 5 – The output must drive action. Where a question asks what should happen after the assessment is completed, correct answers involve updating policies, reallocating resources, adjusting monitoring, reporting to the board or remediating gaps. An answer that simply files the report is wrong.

Tip 6 – Escalation and board involvement. Significant residual risk above appetite should be escalated to senior management or the board; the compliance officer does not silently accept it or hide it. Equally, the board approves risk appetite; the compliance officer does not set it alone.

Tip 7 – Mitigation should be proportionate and targeted. The exam rewards the risk-based approach. The best answer is usually EDD, enhanced monitoring, limits or senior approval rather than refusing all customers of a type. Reserve exit as the answer when the scenario clearly shows unacceptable risk that cannot be mitigated, or when the customer refuses to provide required information.

Tip 8 – Watch for frequency and trigger wording. Correct answers describe the assessment as periodic (at least annual) and event-driven, not a one-time project. A new product, acquisition, new jurisdiction, regulatory change or major audit finding are triggers for an update.

Tip 9 – Independence matters. Internal audit should test the risk assessment but should not own or write it; the first line should not grade its own controls without second-line challenge. Questions about who performs what often test the three lines of defence.

Tip 10 – Eliminate absolute answers. Options containing words like always, never, all customers, or eliminates all risk are usually incorrect because risk can be reduced, not eliminated, and the RBA requires differentiation.

Tip 11 – Read for the best answer, not just a correct one. CAMS questions often have two plausible options. Choose the one that is most comprehensive, most aligned with FATF guidance and most consistent with the risk-based approach. If one answer addresses the root cause (e.g. weak control design) and another treats a symptom (e.g. investigating one alert), choose the root cause.

Tip 12 – Remember sanctions and proliferation financing. Newer exam content reflects FATF's requirement to assess proliferation financing risk and the expectation of a separate or integrated sanctions risk assessment. Do not assume ML/TF only.

10. Quick Revision Summary

• Purpose: understand risk so controls and resources are proportionate (FATF Rec. 1, RBA).
• Types: NRA/SNRA, EWRA, business line/entity, customer, product/service, geographic, delivery channel, sanctions, thematic (ABC, fraud, tax, PF, TF), new product/change.
• Inputs: internal data (customers, transactions, SARs, alerts, audit, exams, law enforcement requests, training) and external data (NRA, FATF, sanctions lists, indices, advisories, typologies).
• Method: identify categories, score inherent risk, evaluate controls, derive residual risk, compare with appetite, document, approve, refresh.
• Outputs: ratings and heat maps, gaps, action plans, resource allocation, policy and CDD updates, monitoring calibration, training, board reporting, audit planning, regulatory evidence.
• Mitigation: avoid, reduce, accept; preventive, detective and corrective controls; targeted and proportionate; avoid wholesale de-risking; document acceptance.
• Governance: board approves appetite and EWRA; compliance owns methodology; first line owns risk; audit tests independently; refresh annually and on trigger events.

Master these relationships and you will be able to reason through any scenario question on this topic, even when the exact wording is unfamiliar.