Inherent Risk

Assessors first rate a risk as if no controls existed, using the likelihood and impact of the raw activity. Cash handling, cross-border payments, unusual customer types or an ageing IT system carry high inherent risk because of what they are. The rating guides where to put effort: higher inherent risk calls for stronger controls and more testing. Next the effect of existing controls is judged, and what remains is residual risk. Comparing the two shows how much the controls are doing. In practice teams argue about what “no controls” means, since some basic habits are always in place, so many firms set a standard assumption in their method. In anti-money laundering work the term describes exposure from customers, products, countries and channels. Comparing it with the residual rating shows how much work the controls are doing, and a thin gap prompts questions about whether a control is needed.

Trade finance is under review at a bank. With no controls, the chance of being used to move illicit funds is high and the possible penalty severe, so inherent risk is rated high. Document checks and sanctions screening bring the residual rating to medium. The bank tests those controls more often than those for retail savings, which has lower inherent risk.