A business-wide risk assessment reduces to one weighted number, and that number is built to hide the category that needs attention.
Residual risk is inherent risk reduced by the effectiveness of the controls that address it: residual = inherent x (1 - control effectiveness), scored category by category and then weighted by exposure. On an illustrative business-wide assessment scored 1 to 4, an inherent risk of 3.05 (high) falls to a residual risk of 2.00 (medium) after controls. The overall score hides one category, delivery channels, that is still high at 2.56.
Worked in full in The EU AML Handbook by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
The AMLR, like Article 8 of AMLD4 before it, requires every obliged entity to maintain a documented business-wide risk assessment that takes into account risk factors relating to its customers, products and services, geographies, delivery channels and transactions. It does not prescribe a scoring formula, so the arithmetic below is one common, transparent method, not a regulatory standard. Each category gets an inherent score from 1 (low) to 4 (very high), a control effectiveness rating expressed as the share of inherent risk the controls are judged to remove, and a weight reflecting how much of the business it represents. All scores are illustrative.
| Risk category | Weight | Inherent score | Control effectiveness |
|---|---|---|---|
| Customers | 30% | 3.4 | 40% |
| Products and services | 25% | 3.0 | 35% |
| Geographies | 20% | 2.6 | 30% |
| Delivery channels | 15% | 3.2 | 20% |
| Transactions | 10% | 2.8 | 45% |
Rating bands, also illustrative: below 1.75 low, 1.75 to below 2.50 medium, 2.50 to below 3.25 high, 3.25 and above very high.
Residual score, category i = inherenti x (1 - control effectivenessi)
Overall inherent = sum of weighti x inherenti = 3.05
Overall residual = sum of weighti x residuali = 2.00
Delivery channels: 3.2 x (1 - 20%) = 2.56, high. Customers: 3.4 x (1 - 40%) = 2.04, medium.
In Excel, with weights in B2:B6, inherent scores in C2:C6 and control effectiveness in D2:D6: =C2*(1-D2) in E2 copied down, then =SUMPRODUCT(B2:B6,E2:E6) for the overall residual.
| Risk category | Inherent | Residual | Band | Weighted residual |
|---|---|---|---|---|
| Customers | 3.4 | 2.04 | Medium | 0.612 |
| Products and services | 3.0 | 1.95 | Medium | 0.488 |
| Geographies | 2.6 | 1.82 | Medium | 0.364 |
| Delivery channels | 3.2 | 2.56 | High | 0.384 |
| Transactions | 2.8 | 1.54 | Low | 0.154 |
| Overall | 3.05 | 2.00 | Medium | 2.002 |
Controls remove 34.4 per cent of inherent risk across the business, moving it from high to medium. That is the headline the board sees. The finding that matters is underneath it: delivery channels, mostly non-face-to-face onboarding in this case, carry the second-highest inherent score and the weakest controls, and remain high after mitigation.
A residual score is only as good as the control effectiveness rating behind it. A 40 per cent rating should be traceable to testing, such as quality assurance sampling or assurance reviews, not to the existence of a policy.
Improving the controls on the weak category changes its band but barely moves the overall score, because the category carries only 15 per cent of the weight.
| Control effectiveness | Delivery channels residual | Band | Overall residual |
|---|---|---|---|
| 10% | 2.88 | High | 2.05 |
| 20% | 2.56 | High | 2.00 |
| 30% | 2.24 | Medium | 1.95 |
| 40% | 1.92 | Medium | 1.91 |
Delivery channels drop to medium once controls remove 21.9 per cent of the inherent risk, and would need 45.3 per cent to reach low. The overall score moves only from 2.05 to 1.91 across the whole range. And if every control in the business were rated 15 points weaker, the overall residual would rise to 2.46: still medium. A single weighted number is stable by construction, which is exactly why it cannot be the only output.
Each inherent score should be built from data, not chosen. The customer score of 3.4 is the exposure-weighted average of the customer base by risk rating: 45 per cent of exposure in customers rated high (scored 4), 50 per cent medium (3) and 5 per cent low (2), giving 1.80 + 1.50 + 0.10 = 3.4. If a remediation exercise moved ten points of exposure from high to medium, the customer score would fall to 3.3 and its residual from 2.04 to 1.98, and the overall residual to 1.98. Building the score this way makes the assessment move when the business moves, which is what a supervisor will test.
The frequent error is to let the weighted average stand as the conclusion. A business that reports medium residual risk while one category sits at high has not assessed its risk; it has averaged it away. Equal weighting does not help: a simple average of the five residual scores gives 1.98, also medium. Report the overall score and the maximum category score side by side, here 2.00 and 2.56, and tie the action plan to the categories above the risk appetite. A second error runs the other way: rating controls as effective because they are documented, which pushes every residual score down at once and makes the whole assessment unfalsifiable.
Score inherent risk by category, apply a tested control effectiveness rating, weight by exposure, and report both the weighted total and the worst category. Here that is 3.05 inherent, 2.00 residual, and a delivery-channel score of 2.56 that needs action whatever the total says. The book's working documents for building an AMLR programme are in the free workbook for this book; for the same scoring logic at customer level, see how to calculate a customer AML risk score.
Inherent risk is the exposure before controls, from customers, products, geographies, channels and transactions. Residual risk is what remains after controls. In the illustrative assessment, inherent risk scores 3.05 on a 1 to 4 scale, high, and controls removing 34.4 per cent bring residual risk to 2.00, medium.
Express it as the share of inherent risk the controls demonstrably remove, evidenced by testing rather than documentation. In the illustrative case, delivery-channel controls rated at 20 per cent leave a residual of 2.56, high; the category needs 21.9 per cent to reach medium and 45.3 per cent to reach low.
Because one weak category carries only its weight in the total. Here every control could be rated 15 points weaker and the overall residual would still be medium at 2.46. Report the maximum category score, 2.56 in the example, beside the weighted total.
This article is one calculation from The EU AML Handbook. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: regulation, compliance and banking → · All 453 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.