The Risk Assessment of Your Entity, From the Methodology to the Board Minutes

The client risk matrix measures each client. This measures the business as a whole, the way your supervisor asks for it, and keeps every step as evidence.

Talk to us on WhatsApp See every service

COX keeps the risk assessment of your entity: the methodology your board approves with its minutes, the assessment computed at a cut-off date from your own portfolio, the heat map, the report to the board and the strengthening plan with its follow-up. Around it, the compliance committee minutes, the materialized events and the pre-launch analysis, all inside the platform that holds your due diligence.

How It Works

From an approved methodology to a plan that the board follows up

A methodology your board approves

Factors, segments, variables and risk events, the probability and impact scales, the controls and their weights. You can start from a reference that COX offers, with example events for financial and non-financial entities, and adapt it to your business. It is approved with the minutes attached, and then it is frozen.

An assessment that COX computes

At a cut-off date, COX computes for each event the probability, the impact, the inherent risk, the rating of its controls and the residual risk, and consolidates them by variable, segment, factor and entity. Nobody types a result.

The heat map, read from the calculation

Each event sits in the cell of its inherent risk and of the control level its residual was computed with. Events without controls go apart, and those that could not be computed are named, never dropped.

Counted from your portfolio

PEPs, foreign nationals, legal entities, high-risk clients, countries on the FATF lists, clients onboarded through a non-face-to-face channel, legal entities with a related party on a list, and clients above their declared amount: COX counts them from the files. A file that lacks the data a rule reads is named, not counted as zero.

Your controls, tested

Each compliance and effectiveness test of a control, by the compliance unit, internal or external audit or the supervisor, with its cases and its report. Registered, it does not change, and it follows the control across versions of the methodology.

A plan the board approves and follows

The report to the board carries the strengthening plan: one action for each event that requires additional actions, with its deadline and owner. The board approves it with its minutes; then each action is followed up, closed with evidence or extended with the board's documented authorization.

The Methodology, Step by Step

The same method from the first event to the board: each figure comes from the one before it, and you can follow it back.

Identify

The factors (clients, products and services, distribution channels, geographic location), their segments and variables, and the risk events through which the risk could materialize. Every variable needs at least one event.

Probability

Each event is measured with what the methodology sets: number of clients, alerts or incidents in a period. Where the data lives in COX, COX counts it; where it does not, it is measured by hand with its source.

Impact

Measured on each associated risk (reputational, legal or compliance, operational, contagion) and combined the way your methodology says: average, weighted, maximum or with a dominant risk.

Inherent risk

Probability and impact give the inherent risk of each event, by average or by a probability-by-impact matrix that you fill in cell by cell.

Controls

Each control is rated by whether it is documented, preventive or detective, how often it runs, and the compliance and effectiveness its tests measured. Several controls on one event combine by average or by weight.

Residual risk and plan

The inherent risk and the control rating give the residual, consolidated by variable, segment, factor and entity. A figure with decimals rises to the next level, the conservative reading, and the events above the level you set go to the plan.

Why Not in a Spreadsheet

The entity risk assessment usually lives in a spreadsheet and a folder of minutes. In COX it lives next to the files it measures.

Swipe the table sideways to see every column.

What changes	In a spreadsheet	In COX
Portfolio figures	Copied by hand from another system	Counted from the files at the cut-off date
Formulas	Anyone can change a cell without a trace	The approved methodology is frozen; a change is a new version the board approves
A missing figure	An empty cell adds up as zero	Empty stays empty, and what is missing is named
Tests of the controls	In another file, if they exist	Tied to the control, and they enter its rating
The plan	An email or a list	Actions with owner, deadline and reminders, closed with evidence
What the supervisor sees	The latest version of the file	Sealed records anyone can verify, and who did what and when
Same data, same result	Depends on who fills in the file	COX computes it: the same data always gives the same result

COX does not replace the judgement of your methodology: it keeps it, applies it and proves what was applied.

Around the Assessment

What the supervisor asks to see next to the assessment, kept in the same place

The compliance committee and its minutes

Members with their role, and those with a conflict of interest taking part with voice only. Each session records attendance copied from the members, the deliberation, every decision with its owner, the records it saw and the signed minutes. Registered, the minutes do not change; a correction is a new session that cites it.

Risk events that materialized

What happened, when it was detected, whether the methodology had foreseen it, the risks it touched and the files, alerts or reports behind it. An event the methodology did not consider becomes an improvement for the next review.

The analysis before a launch

A documented risk analysis before a new product, service, channel, business model or technology: its scope, the events of the methodology it touches, the controls and the conclusion, and the committee session that saw it.

Follow-up and review of the methodology

Each review says what was checked and with whom, and gives every improvement its treatment: corrected at once, sent to the next plan, or no change with the reason. A review that found nothing is also a result.

The versions of your prevention manual

Each version of the manual, with its approval and its document, and one in force at a time. COX keeps the versions; it does not write your manual.

Sealed records and Excel matrices

The report to the board, the approved methodology, the plan, the reviews, the events, the minutes and the pre-launch analyses are printed with a SHA-256 seal that anyone can verify. A draft is not printed. The matrices are exported to Excel.

What the Supervisor Finds

Approved means frozen

An approved methodology, a registered minute, a concluded assessment and an approved plan do not change. Changing the methodology is a new version; the old one stays as it was approved.

Empty is not zero

A figure that could not be measured reads empty, and everything that depends on it too. The page never shows a zero that nobody measured.

Nothing is deleted

Not even a draft. A record opened by mistake is cancelled with its reason, and the reason stays.

Frequently Asked Questions

No. The matrix rates each client when it is onboarded. The entity risk assessment rates the business as a whole: through which clients, products, channels and places someone could use it, how likely and how serious that would be. The law asks for both, and neither replaces the other.

No. COX offers a reference to start from, with example scales, methods, weights and events that you adapt to your business, and it keeps your manual's versions. The methodology and the manual are your entity's, approved by its board.

No. A supervisor's questionnaire is its own form, and it changes from one round to the next. What COX keeps is what the answers draw on: the approved methodology and the assessment with the figures of your portfolio at a cut-off date.

COX carries the rule of each of the seven countries it serves, transcribed with its source, and names the risks with the words of that law. The methodology starts from the rule of your country; where a country has no rule transcribed, it works the same as good practice, and says so.

The compliance managers prepare and register it; the analysts do not see it. The board approves the methodology and the plan, and the committee sees the assessment and the analyses before a launch.

Assess Your Entity Where Your Due Diligence Lives

Open your account: the methodology starts from the rule of your country, and the assessment counts from the files you already have.