The Entity Risk Assessment (‘ERA’) is a useful tool for managing the global money laundering, terrorist and proliferation financing risks of an entity. Boards and Compliance Managers should be maximising the ERA to effectively manage their anti-money laundering and countering the financing of terrorism and proliferation programmes.

 

The ERA and your business model

The ERA differs from the Client Risk Assessment as it is focused on the risks posed by the entire client data base as opposed to the risks posed by a single client.  The aim of the ERA is to assess how well the entity is handling or can handle all of the risks which it faces as result of the business which it is undertaking or intends to undertake. The ERA is therefore closely linked to the entity’s business model.

 

The ERA Data

The raw data of the ERA will provide information on the severity of the inherent risks in the entity’s business model. To be more effective the data should be holistic – that is not just limited to the number of high risk, medium risk, and low risk, customers the entity possesses. The data should be also informative of the nature of the risks the entity is exposed to.

 

Analysis

After mining the ERA data, the next step is to analyse the internal control environment to determine how well the internal control environment is equipped to mitigate the inherent risks.

 

Decisions

The analysis of the ERA data and the internal control environment should lead to an assessment of how well the entity is handling or will handle the risks in its business model. This assessment will in turn lead to  certain determinations.

List of determinations – (non-exhaustive list)

• Whether there are gaps/weaknesses in the AML/CFT & CPF policy and procedures.
• Whether the risk appetite of the entity aligns with the business model.

 

This article was authored by Michelle A. Knight. Michelle is the Managing Director, Legal and Regulatory Consultant, Knight Corporate Street Inc., and can be reached at michelle@knightcorporatestreet.com.