Four Questions Examiners Ask of Every BSA/AML Risk Assessment

When an examiner opens your BSA/AML risk assessment, what are they actually testing? We put that question to two people who sit on opposite sides of the work: Andrea Valentin, CFE, CAMS, CFCS, Chief Risk Officer at Maxwell State Bank, and Cody J. Smith, CPAML, Managing Director of CSMB International, who builds and reviews assessments for client institutions.

Their answers came down to four questions. They apply to the BSA officer who owns the assessment and equally to the advisory firm, independent tester or consultant who builds one for a client.

1. Is it logical?

Andrea put this first without hesitation. If management cannot explain how a rating was reached, the rating is not helping the institution. An examiner will ask someone to walk through it. A score nobody in the room can defend invites the examiner to dig until they find out why.

2. Is it aligned to what the bank actually does?

Community banks do not need huge, complicated assessments, Andrea said. They need ones that reflect their actual risks and drive meaningful results: the audit schedule, exam preparation, and how often the assessment itself is revisited. A template built for a different institution produces ratings for a different institution.

3. Is the data clean?

This was the requirement Andrea added to the usual list, and the one she says draws the most questions. A complicated assessment with one math error is garbage in, governance out. If an IT report says one thing and the BSA assessment says another, reconcile the difference and arrive at one enterprise view before an examiner points it out.

Cody made the same point from the methodology side. The core method is not complicated: probability and impact give inherent risk, controls give residual risk, and the categories consolidate into one profile. What is hard is cross-sectional analysis of clean data across customers, products, services, channels and geography. That takes real computing power, not a bigger spreadsheet.

4. Does it drive resource allocation?

Cody’s addition, and arguably the reason risk assessments exist at all. Once you know where the greatest risk is, that is where the most resources go. Lower-risk areas still get coverage, just not the same depth. Without that differentiation, every area gets tested at 100 percent, and the cost becomes unbearable.

Where assessments break

Cody sees two failure modes most often in the assessments he reviews.

The first is false precision: assessments so granular they capture risk events that carry no meaning. He once saw a company’s name listed as a risk event.

The second is the missing roll-up. Teams work hard to rate customers, products and geography separately, then never consolidate those ratings into a single institutional risk profile. The ratings sit side by side, and nobody can say what the bank’s overall risk is or what to do about it.

Both failures produce the same outcome. The document exists, and it does not tell anyone what to do next. For how monitoring results should feed back into the assessment, read Risk Assessment vs. Transaction Monitoring, and for a recent enforcement example, The Feedback Loop in Reverse.

What this means for advisors

For AML advisory firms and independent testers, these four questions are the quality bar your client’s examiner will hold your work to. They also point to where a firm’s time is best spent. The value a client pays for is the judgment: the logic behind each rating, the reconciliation of conflicting data, the recommendations that move resources. The assembly of data underneath that judgment is the part least worth billing partner hours for, and the part most likely to introduce the errors examiners find.

Andrea’s closing advice applies to anyone who builds these: the assessment should take fewer people and more thinking. And when examiners ask questions you did not anticipate, she suggested treating that as a signal to dig, not a reason to panic. If you can back up what you believe about your risk with data, the assessment is defensible.

How RiskRator fits

RiskRator produces the data foundation for a bank-wide risk assessment from the institution’s own transaction data, consistently and reproducibly, so the people reviewing it can spend their time on the four questions above. RiskRator works with advisory firms that build and review assessments for community and regional banks. If that describes your practice, we would like to talk.

Watch the full webinar replay · Talk with RiskRator about partnering

Frequently asked questions

What do examiners look for in a BSA/AML risk assessment?

Whether the ratings are logical and explainable by management, whether they align with the institution’s actual activities, whether the underlying data is accurate and reconciled, and whether the assessment drives how compliance resources are allocated.

Do community banks need a complex risk assessment?

No. They need one that reflects their actual risk profile and drives decisions such as the audit schedule and reassessment frequency. Complexity without clarity is a common examination problem.

What are the most common risk assessment weaknesses?

Over-granular risk events that carry no meaning, category ratings that are never consolidated into an overall profile, and data that does not reconcile with other institutional reports.

How should advisory firms use these questions?

As the quality standard for assessments they build or review for clients, since the client’s examiner will apply the same tests.