Keep three ideas separate
Inherent risk is the risk before the business applies its controls. A control is a measure that addresses a risk.
Residual risk is the risk that remains after the business applies its controls. A control on paper does not establish that the control works.
Source: AUSTRAC: Focus on your inherent risks.
- Inherent risk
Risk before the business applies controls.
- Controls
Measures intended to address the risk. Examine evidence that they work.
- Residual risk
Risk remaining after the business applies its controls.
Risk before controls and risk after controls
A control on paper does not prove risk reduction. AUSTRAC presents the separate residual risk assessment as optional.
Separate evidence questions. An answer to one does not settle the others.
What AUSTRAC expects
AUSTRAC expects a business risk assessment to identify and assess inherent risks. Its guidance says a business may then choose to assess residual risks.
Do not describe that optional residual assessment as a separate universal legal requirement. The underlying duties to assess risk and maintain appropriate policies still apply.
Sources: AUSTRAC: Focus on your inherent risks; Federal Register of Legislation: Sections 26C and 26F.
A control that does not work as planned
A fictional practice identifies a risk that an unauthorised person could send payment instructions. It introduces a call to an approved contact before staff act.
A file review finds that staff sometimes omit the call. The practice cannot assume the control always reduces the risk.
It records the failure, its effect on the risk assessment and the required correction. This example does not set a universal verification procedure.
Use evidence for the remaining risk
Keep the original risk, control and evidence of operation in separate fields. Record any assumptions about how much the control reduces the risk.
Do not subtract labels such as high and medium as if they were measured quantities. Explain the basis for the residual rating.