A polished risk matrix isn’t enough if it doesn’t show how your firm’s actual exposure shapes its controls. A practical AML CTF risk assessment methodology starts with the designated services your firm provides, then connects the risks identified to evidence, controls and follow-up.
If you’re unsure which activities to include, or your assessment feels generic and disconnected from day-to-day processes, you’re not alone. With Tranche 2 obligations in effect since 1 July 2026, accounting firms need a clear, maintainable way to assess their exposure and keep records current.
This guide explains how to build a proportionate, firm-wide assessment that reflects your customers, services, delivery channels and jurisdictions. You’ll learn how to identify inherent risks, document controls and residual risk, and turn findings into practical actions for due diligence, monitoring and review. The result is a structured process that supports consistent records and operational readiness without relying on a tick-box exercise.
Key Takeaways
- Use an AML CTF risk assessment methodology to assess your firm’s overall exposure, keeping it distinct from individual client risk profiling.
- Define the scope by checking your designated services and considering relevant clients, delivery methods, transactions and geographic exposure against current AUSTRAC guidance.
- For each material risk, record the control, evidence that it operates, remaining exposure and any follow-up action.
- Revisit the assessment when services, client mix, delivery methods or operating arrangements change, and document the reason for updates.
- Assign clear ownership and connect assessment findings to practical controls and ongoing records. Structured workflows can help maintain consistency while supporting firm judgement.
What an AML CTF risk assessment methodology needs to establish
An AML/CTF risk assessment is a documented, firm-wide view of how the business could be exposed to money laundering, terrorism financing and proliferation financing, and how those risks inform its controls and actions. A useful AML CTF risk assessment methodology makes the reasoning clear: what activities are in scope, where exposure could arise, and what the firm will do about it.
The assessment should reflect your firm’s actual operating arrangements, not simply repeat generic risk statements. For an accounting practice, start by identifying which services may be designated services under the Australian AML/CTF framework. The reforms regulate specified services rather than accounting as a profession, so check current AUSTRAC guidance against what your firm actually does. Relevant activities may include business structuring, facilitating financing, or managing client funds through trust accounts. Don’t assume every service or engagement presents the same exposure.
Consider how risks could arise across the firm’s services, client base, delivery methods, transactions and geographic exposure. Understanding the broader Money laundering process can help explain why criminals may seek to move illicit funds through legitimate business activity. Use that context to assess your own exposure, rather than treating a general overview as a substitute for firm-specific judgement.
What is the difference between business-wide and client-level risk?
A business-wide assessment considers the firm as a whole: its designated services, operating arrangements and relevant exposure. It helps identify patterns or vulnerabilities that may affect multiple engagements, such as how a service is delivered or how funds are handled. Client-level risk profiling, by contrast, considers the circumstances and risks associated with a particular client or engagement. These views inform each other, but they answer different questions. For the client-specific process, see the guide to client risk profiling.
Why should Australian accounting firms document their assessment?
Written reasoning turns an assessment into a working reference. It helps the firm explain why it identified a risk, who is responsible for addressing it, which controls are intended to manage it and what follow-up is needed. It also gives staff a consistent basis for decisions when responsibilities or circumstances change.
For Australian accounting firms providing designated services, Tranche 2 obligations commenced on 1 July 2026. Current AUSTRAC guidance should inform how your firm identifies applicable services and meets its obligations. Keep a record that links identified risks to controls and actions, rather than relying on a completed template alone. A documented assessment supports review and shows how decisions were reached. The next step is to examine whether the controls are operating as intended and whether the remaining exposure needs further action.
How to identify and assess your firm’s AML/CTF risks
A clear assessment follows a repeatable sequence: define the scope, identify where exposure may arise, assess and explain the risks, then assign actions to an owner. This gives your firm a consistent way to move from broad concerns to decisions that inform controls and follow-up. As you apply an AML CTF risk assessment methodology, check current AUSTRAC guidance for the services your firm provides.
Start with your designated services and how the firm delivers them. Then consider relevant client types, transaction characteristics, delivery methods and geographic exposure. These are useful prompts, not a substitute for checking the requirements and guidance that apply to your specific services. AUSTRAC’s guidance on identifying and assessing AML/CTF risks can help you frame this work.
Which risk factors should an accounting firm consider?
Look at how each relevant service works in practice, not just its name. For example, consider whether an engagement involves arranging a transaction, facilitating financing or handling client funds, and how instructions and funds move through your processes. Then ask which client types use the service, what transaction features may affect exposure, and whether geographic connections are relevant. Record why each factor matters to your firm, including where information is incomplete. Use these prompts to guide enquiry, then confirm scope against current AUSTRAC material.
How should a firm rate and prioritise identified risks?
First describe the inherent risk, meaning the exposure before considering controls. Apply the same documented criteria across the areas assessed so ratings can be understood and compared. Your firm might choose qualitative categories such as lower, moderate and higher, but these are examples of an internal approach, not a prescribed AUSTRAC scale. Don’t present a rating as objective unless the reasoning and evidence support it.
Next, explain the basis for each material rating. Note the information considered, relevant evidence, assumptions or uncertainty, and the person responsible for follow-up. If your method assesses controls separately, describe residual risk as the exposure that remains after those controls are considered. Avoid implying that a control removes risk entirely.
- Scope: List the designated services and operating arrangements assessed.
- Exposure: Record the relevant clients, transactions, delivery methods and geographic connections.
- Assessment: Apply consistent criteria and explain the rationale for each significant finding.
- Action: Assign an owner and record the next step, including any information still needed.
A structured workflow can help keep assessment records consistent while leaving risk judgements with your firm. Explore Trancher’s AML risk assessment workflows as one option for organising evidence and follow-up.
How to connect AML/CTF controls with residual risk and evidence
An assessment becomes useful when each material risk leads to a clear view of what the firm does about it and what exposure may remain. A policy or workflow may describe a control, but it doesn’t by itself show that the control was carried out. Your AML CTF risk assessment methodology should distinguish the design of a control from evidence of its operation.
Map each risk to the relevant policy, workflow, check or escalation arrangement. For each control, clarify who performs it, when it applies and what record its operation creates. For example, if a firm identifies exposure connected with handling client funds, it could document the relevant approval process, who is responsible for applying it and a dated approval record from an engagement. This example is illustrative; assess your firm’s actual services and arrangements.
How can firms assess whether controls address identified risks?
Check whether the control is relevant to the risk and whether staff can follow it in practice. A written procedure is evidence of design; a completed check, recorded approval or documented escalation may help show operation. Neither proves that all exposure is removed. Consider what remains, including exceptions, gaps or limits in the evidence, and record a responsible owner, planned action and review date for follow-up.
What evidence should support assessment decisions?
Keep records that let someone understand how the firm reached and acted on its conclusions. Depending on your process, these may include dated assessment versions, the rationale and information considered, references to relevant controls, evidence that controls operated, and assigned actions. Versioning matters because it shows when assumptions, services, decisions or planned responses changed, rather than leaving a reader to infer the history.
A simple risk-to-control record can bring those connections together:
| Identified risk | Existing control | Supporting evidence | Remaining exposure | Next action |
|---|---|---|---|---|
| Illustrative exposure related to handling client funds | Documented approval workflow | Dated approval record for a relevant matter | Exceptions or gaps may remain; assess and explain them | Assign an owner to address any identified gap and set a review date |
Use the table as a working record, not a substitute for judgement. If evidence is missing, note that openly and decide what follow-up is appropriate. For more detail, consult the audit-ready records guide for record-keeping practices and the AML program checklist as a separate implementation aid. These resources can support consistent documentation; your firm remains responsible for assessing its own risks and controls.
When to Review and Update AML/CTF Risk Assessments
A firm-wide assessment should keep pace with the business it describes. A material change can make an earlier assumption incomplete, even if the assessment was carefully documented at the time. Use change prompts to decide when to revisit the assessment, and check current AUSTRAC guidance for any applicable review requirements. Don’t treat a review schedule as a legal requirement unless current guidance confirms it.
What changes should prompt a reassessment?
Consider whether a change affects the firm’s designated services, the way work is delivered, the clients the firm serves or how it operates. For example, adding a service, changing how client funds are handled, or beginning to serve a different mix of clients may alter the firm’s exposure. Internal findings can also prompt a review: repeated process exceptions, control gaps or staff feedback may indicate that an assumption needs another look.
Useful review prompts include:
- Has the firm added, changed or stopped providing a designated service?
- Have client types, transaction patterns or geographic connections shifted in a way that could affect exposure?
- Have delivery channels, systems, staffing or operating arrangements changed?
- Have incidents, exceptions or monitoring findings challenged assumptions in the assessment?
These prompts help identify when a review may be worthwhile; they aren’t a complete statutory list. Confirm applicable requirements and any mandatory triggers against current AUSTRAC guidance.
How can a firm make review manageable and auditable?
Assign an accountable owner to coordinate reviews and record the date, scope, information considered and decisions made. Keep earlier versions so the firm can follow how its understanding developed. If a rating or control action changes, briefly explain what prompted the change and who is responsible for any resulting work.
Then carry significant findings through to the relevant parts of the compliance process. A changed risk view may call for revised controls, staff guidance or training, clearer ownership, or further documented follow-up. Record the decision and its rationale, including when the review concludes that existing arrangements remain appropriate.
Keep firm-wide assessment review distinct from client-level activity monitoring and the handling of suspicious matter reporting. Those processes may surface information that prompts a reassessment, but they have different purposes. For ongoing client and activity checks, consult the separate guide to ongoing risk monitoring. Use this assessment review to reconsider the firm’s overall exposure.
A structured workflow can help organise review prompts, versions and follow-up without replacing your firm’s judgement. Explore structured AML/CTF assessment workflows to support a more consistent review process.
Turn the AML/CTF assessment into a workable firm-wide process
An assessment creates value when its findings lead to clear responsibilities and practical follow-up. A useful AML CTF risk assessment methodology connects each material risk to a control, an accountable owner and evidence that the action was completed. Keep decisions proportionate to your firm’s activities, and check applicable requirements against current AUSTRAC guidance.
What should a firm do after completing its risk assessment?
Start by prioritising findings that need a response. Assign an owner, agree on the next step and record how completion will be evidenced. If a risk points to a gap in client due diligence, for instance, identify the workflow or guidance that needs attention and who will update it. Then consider whether the finding should also inform client monitoring, staff training or governance processes.
Keep the assessment connected to those processes rather than treating it as a standalone document. Record decisions, outstanding actions and any reason an action is not being taken. A separate AML program checklist can help you work through broader implementation tasks, while the assessment remains the basis for understanding and responding to your firm’s exposure.
How can structured workflows support ongoing readiness?
Consistent records can be difficult to maintain when assessment findings, designated services and follow-up sit in separate files or systems. Trancher provides structured risk assessment workflows, designated service tracking and record-keeping support for Australian accounting firms. These workflows can help organise information and evidence; they don’t make the firm’s judgements or determine whether a control is suitable.
Use any platform as an operational aid, not a replacement for professional responsibility or legal advice. Your firm remains responsible for applying its judgement, confirming which services are relevant and checking its approach against current requirements. Trancher also provides dedicated onboarding and local Australian support to help firms work with its platform.
To keep the process practical, consider whether your workflow makes it straightforward to see:
- which designated services and risks are recorded;
- who owns each control or follow-up action;
- what evidence has been added and what remains outstanding; and
- when a decision or assessment record was updated.
That visibility can make the assessment easier to maintain as the firm’s services and operating arrangements evolve. Explore Trancher’s AML/CTF workflow platform and discuss your firm’s assessment, designated service tracking and record-keeping needs with the team.
Make your assessment part of everyday compliance
A useful AML CTF risk assessment methodology does more than record exposure. It connects firm-wide risks to controls, evidence and clear follow-up, then makes it easier to revisit decisions as services or operating arrangements change. Keep the assessment distinct from client-level profiling, but connect its findings to relevant due diligence, monitoring and staff guidance.
For Australian accounting firms, structured workflows can help organise assessment records and designated service tracking without replacing professional judgement. Trancher supports this work with AML risk assessment and compliance workflows, audit-ready documentation and record keeping, plus dedicated onboarding and local Australian support.
Explore Trancher’s AML compliance platform to see how its workflows could support your firm’s process and discuss your needs. With clear ownership and consistent records, your firm can keep its approach practical, accountable and ready to evolve.
Frequently Asked Questions
What is an AML/CTF risk assessment methodology?
An AML/CTF risk assessment methodology is the consistent process a firm uses to identify, assess and document its exposure to money laundering and terrorism financing risks. It should explain what activities are in scope, how risks are evaluated, what evidence supports the assessment and how findings lead to controls or follow-up. A useful method reflects the firm’s actual services and operations rather than relying on generic statements or unexplained ratings.
How do you conduct an AML/CTF risk assessment for an accounting firm?
Begin by checking which services may be designated services for your firm, using current AUSTRAC guidance. Map how those services are delivered, then consider relevant clients, transactions, channels and geographic exposure. Document the risks and the reasoning behind your assessments, identify existing controls, and record remaining exposure where your method supports that distinction. Assign an owner and action for any gaps, then keep the assessment under review as the firm changes.
What risks should an Australian accounting firm include in its AML/CTF assessment?
Assess relevant exposure across customers, services, delivery channels and jurisdictions, including proliferation financing risk. For an accounting firm, begin with its designated services and consider how client types, transaction features, funds handling and operating arrangements may affect exposure. These areas help structure the assessment, but they don’t determine which services apply to your firm. Check current AUSTRAC guidance and document why each risk factor is relevant to your business.
Is a client risk assessment the same as a business-wide AML/CTF risk assessment?
No. A business-wide assessment considers the firm’s overall exposure across its designated services, operations and relevant risk factors. A client risk assessment focuses on the circumstances of a particular client or engagement. The two processes should inform each other: firm-wide findings can shape client due diligence, while client-level experience may reveal patterns worth reconsidering in the firm-wide view. Keep their purpose and records distinct so neither assessment is mistaken for the other.
How often should an AML/CTF risk assessment be reviewed?
Review the assessment when material changes could affect the firm’s exposure, such as a change to designated services, client mix, delivery methods or operating arrangements. Internal findings, control gaps or new information may also prompt a reassessment. Don’t assume a particular review interval is a legal requirement without checking current AUSTRAC guidance. Set a process for recording review dates, decisions and reasons for updates, and confirm any specific applicable requirements with AUSTRAC.
Can AML/CTF risk assessment software replace professional judgement?
No. Software can provide structured workflows for recording risks, linking controls, tracking designated services and maintaining evidence, but your firm must still assess its own activities and make informed decisions. Treat the platform as an organisational aid, not as a substitute for professional responsibility or legal advice. Check that its workflows suit your firm’s services and that staff can explain the reasoning behind assessments, ratings and any actions selected.
What evidence should a firm keep for its AML/CTF risk assessment?
Keep a dated copy of the assessment, its scope, the reasoning and information considered, and references to relevant controls. Record who owns follow-up actions, their status and evidence of completion. If your method assesses inherent and residual risk separately, retain the basis for both. Preserve earlier versions and explain material changes to assumptions, ratings or actions. Current AUSTRAC guidance should inform what records your firm needs to maintain for its applicable obligations.