Risk Events: What They Are, How to Write Them and How to Measure Them

The building block of the entity risk assessment, with examples for each risk factor.

Talk to us on WhatsApp See every service

A risk event is a situation through which your entity could be used to move funds of illicit origin or to finance terrorism or proliferation. It can come from inside, such as a weak process, or from outside, such as a client or a new technology. Each event belongs to a risk factor, is measured by its probability and impact, and is mitigated by controls.

How an Event Is Written

Six parts. An event that lacks one of them cannot be measured.

The situation

Who does what, and what it could be used for, in one sentence: «clients who pay in cash amounts that do not match their declared activity».

The factor and its variables

The risk factor it belongs to (clients, products and services, channels, geographic location) and the variables it touches: a type of client, a product, a country.

The perceived risk

Which of the crimes the law of your country names could materialize through it, with the words of that law.

The effect

What would happen to the entity: a sanction, a loss of clients, a damaged reputation, the contagion of a related party.

What measures it

The data that gives its probability: a number or a percentage of clients, of alerts, of operations or of incidents.

The period

The window in which that data is counted, for example the twelve months before the cut-off date.

Examples by Risk Factor

Written by COX as a starting point. Adapt each one to the words of your business.

Clients

Clients who pay in cash amounts that do not match their declared activity.
Legal entities whose ultimate beneficial owner cannot be identified, or that sit behind several layers of companies.
Politically exposed persons, or their relatives and close associates, who were not identified as such when onboarded.
Clients who appear on a sanctions list or in adverse media after being onboarded.

Products and services

Purchase of a property or a high-value vehicle paid by third parties with no apparent link to the buyer.
Incorporation of companies or trusts for clients who do not explain their purpose.
Operations split into smaller amounts so as not to reach the reporting threshold.
Early cancellation of a contract with a refund requested to an account of a third party.

Distribution channels

Non-face-to-face onboarding without checking the identity against the document and the person.
Clients brought by intermediaries that the entity neither knows nor verifies.
Electronic payments received from accounts held by third parties.

Geographic location

Clients, counterparties or payments from countries on the FATF lists.
Operations in border areas or free zones that do not match the profile of the client.
Clients who live in one country and always operate from another without a business reason.

How COX Measures Each Event

Where the data lives in COX, COX counts it. Where it does not, it is measured by hand, with its source.

Counted from the files

PEPs, foreign nationals, legal entities, high-risk clients, countries on the FATF lists, non-face-to-face channels, related parties on a list and clients above their declared amount, counted at the cut-off date.

Alerts, reports and operations

The alerts, the suspicious activity reports filed, the transactions and the operations with FATF-listed jurisdictions of the event's clients, within its period.

Incidents that happened

An event measured by incidents is counted from the materialized events registered in COX, from the date the methodology declares.

By hand, with the reason

When the data lives outside COX, the officer writes the value and where it comes from. Writing over a figure COX counted asks for the reason.

Empty is not zero

A file that lacks the data a rule reads is named, and the figure is not computed. A missing datum is never read as «no».

From the event to the heat map

Probability and impact give the inherent risk; the controls give the residual; the heat map places the event, and the plan takes it if it stays above your level.

Where to Start

A library to choose from

COX brings more than two hundred example events, for financial and non-financial entities, grouped by factor. They are chosen, not copied in bulk, and each one is written again in the terms of your business.

Every variable, at least one event

A type of client, product, channel or place with no event is a blind spot. COX names the variables that have none before the methodology is approved.

What happened teaches

An event that materialized and that the methodology had not foreseen becomes an improvement for the next review.

Frequently Asked Questions

No. A red flag is a sign in one operation or one client that calls for a closer look. A risk event describes a way in which the business as a whole could be used, and is measured across the whole portfolio.

No norm sets a number. Each variable of each factor needs at least one event, and the events have to describe how your business really works. A small business may need a few dozen.

They are a starting point. Choose those that apply, write them in the terms of your business, and link each one to its variables and to the risk it could materialize.

A risk event that actually happened: a client used the entity, a control failed, a sanction arrived. It is recorded with what happened, what was done and the records behind it, and it feeds the next review.

The compliance managers prepare the assessment; COX counts what lives in its files, and the rest is measured by hand with its source. The board sees the result in the report.

Measure Your Risk Events From Your Own Files

Open your account: choose the example events that apply, and COX counts them from the clients you already have.