The risk-based approach in one picture
A risk-based approach means your controls match the risks your business actually carries. It is not a generic checklist applied the same way to everyone. The illustration shows the whole chain on one page: the risk factors you look at, how they combine into a rating, and how the rating decides what you do.
At a glance
- Four groups of factors drive the rating: customer, geography, products and services, and delivery channels.
- The same rating logic is used for the business as a whole and for each customer.
- Higher risk means more checks, more senior approval and closer monitoring. Lower risk means lighter, but never none.
- The rating is not fixed. It changes when the facts change.
From risk factors, to a rating, to the controls that rating calls for, and back to review when the facts change.
The detail, step by step
Identify the risks your business faces
Start with a business-wide risk assessment. Look at who your customers are, where they and their money come from, what you sell and how you reach them.
- Customer: type, ownership, occupation or industry, public roles.
- Geography: where the customer, owners and counterparties are based.
- Products and services: how easily they can move or hide value.
- Delivery channels: face to face, remote, through introducers.
Rate each factor and the controls that respond
For each risk, consider how likely it is and how serious the effect would be, then how well your current controls reduce it. What is left after the controls is your residual risk, and that is what you need to manage.
Rate each customer with the same factors
At onboarding, apply the same four groups of factors to the individual customer. Write down why the customer is rated as they are, so another person can reach the same answer from the file.
Match the controls to the rating
The rating decides how much you do, not whether you do it.
- Lower risk: lighter due diligence where the rules allow it, standard monitoring and a longer review cycle.
- Medium risk: standard due diligence, regular monitoring and scheduled reviews.
- Higher risk: enhanced due diligence, senior approval, closer monitoring and more frequent reviews.
Review when risk changes
Re-rate the customer when something changes, such as a new owner, a new product, adverse media, unusual activity or a move to a higher-risk location. Review the business-wide assessment on a schedule and when your business changes.
Approve and record
Senior management approves the business-wide assessment, and the approval is dated. Customer ratings, the reasons behind them and the extra approvals for higher-risk customers are kept on file.
Mistakes to avoid
- Using one generic checklist for every customer.
- Giving a rating without writing down the reason.
- Rating almost every customer the same.
- Treating the assessment as a one-off document that is never updated.
- Rating customers as higher risk but applying no extra control.
- Using a scoring model that nobody in the team can explain.
Evidence to keep
- The approved, dated business-wide risk assessment.
- A rating and written rationale on each customer file.
- A list of higher-risk customers with the approvals given.
- A log of reviews and the events that triggered them.
Where Adventant can help
General information only, not legal or compliance advice. The examples and figures are invented for illustration. Your obligations depend on your activities and your regulator, so check the current rules that apply to you or speak to Adventant about your situation.