What's Risk Got To Do With It?

Throughout my years of work in compliance, there is really nothing I enjoy more, and nothing more challenging, than constructing a new risk assessment. Part art and part science, risk assessments challenge us to look at a business through a static lens and then give it a grade that provides a quantifiable measure of the effectiveness of its efforts to curb risks. And, although the process allows for some flexibility in approach, I have rarely met anyone involved that feels like they have gotten it exactly right.

While having a risk assessment may not be a strict legal requirement in every case, there is an expectation by regulators and bank partners, alike, that Bank Secrecy Act (BSA), Anti-Money Laundering (AML), and The Office of Foreign Assets Control (OFAC) compliance programs and controls be "risk-based," and that riskbased decisions should be formalized and documented. In this sense, the term risk-based implies a recognition 1) that risk will never be