Firm-wide risk assessment: common gaps and how to close them

Anti-money laundering compliance in a law firm starts with the risk assessment. It determines where the firm is most exposed, how intensively engagements are checked and which measures are appropriate. The expectation is clear: the assessment should be tailored to your own firm, documented in a traceable way and kept up to date. In practice it rarely fails for lack of will, but because of effort, documentation and currency.

The five typical gaps

1. Generic risk factors

Templates are a good start, but not a finished assessment. If risk factors are copied unchanged, the result does not reflect what your client base actually looks like: sectors, countries of origin, types of engagement and delivery channels are weighted differently in every firm.

2. Written once, never updated

A risk assessment is a snapshot. New types of engagement, changes in the law or new insights into risks quickly make it incomplete. A fixed review cycle works best, supplemented by clearly defined triggers for revision.

3. No visible link to the measures

The result of the assessment must have consequences: which engagements trigger simplified and which enhanced due diligence? If this link is not documented in a traceable way, the assessment looks like a box-ticking exercise.

4. Scattered documentation

The assessment in Word, client checks in Excel, evidence in an email inbox. Anyone who has to gather everything during an inspection loses time and risks gaps.

5. No connection to the engagement level

The firm-wide risk assessment and the assessment of an individual engagement often do not interlock. The big picture and the individual case should support each other.

How to approach it

1. Collect risk factors: record your firm’s clients, countries, services and delivery channels.
2. Weight them: derive an overall risk from the factors and justify the weighting.
3. Assign measures: define which due-diligence measures apply at which risk level.
4. Set the update cycle: define rhythm and triggers, and name who is responsible.
5. Document everything in one place: record status, changes and approvals in a traceable way.

Where digital tools help

Structured software guides you through the risk factors, calculates the result transparently, records changes and reminds you of the next review. The documentation is created along the way instead of being an additional task.

The free sKYCo compliance score shows in a few minutes how well your firm is currently positioned.