A risk assessment is only useful if it changes what your firm does next. For Australian accounting firms, understanding how to conduct a money laundering risk assessment means looking beyond a generic score to the work, clients and processes that create exposure. AML/CTF obligations for Tranche 2 entities, including accountants providing designated services, commenced on 1 July 2026. Not every accounting task is captured, so start by clarifying which services are relevant to your firm.
It’s understandable to be unsure where to begin or how to turn assessment findings into consistent action. A practical process connects identified risks with proportionate controls, accountable owners and clear evidence. It also records why decisions were made, so the assessment guides day-to-day operations rather than sitting unused on file.
This guide sets out a repeatable approach: identify inherent risks across relevant customers, services, delivery channels and jurisdictions; assess likelihood and impact; then prioritise risks and determine suitable controls. You’ll also see how to document residual risk, assign follow-up actions and keep the assessment current. The result is a clearer view of your firm’s exposure and a structured basis for managing it.
Key Takeaways
- Separate your firm-wide view of money laundering exposure from the due diligence and risk rating you complete for individual clients.
- To understand how to conduct a money laundering risk assessment, use firm records and staff input to identify where actual services and processes may create exposure.
- Compare inherent risk with the controls already in place, then consider what risk remains without relying on unsupported scoring thresholds.
- Document the evidence and reasoning behind your decisions, and give each follow-up action an owner, due date and completion record.
- Connect assessment findings to everyday procedures, due diligence, monitoring and escalation, using structured workflows to help keep activity consistent.
What a money laundering risk assessment should tell an Australian accounting firm
A useful money laundering risk assessment gives the firm a reasoned view of where its work could be exposed to money laundering or terrorism financing risks, and how existing processes help manage that exposure. It should explain why particular risks matter to your practice, what evidence supports that view and where further attention may be needed. It’s not simply a score or a template completed for its own sake.
Tranche 2 AML/CTF obligations for covered entities, including accountants providing designated services, commenced on 1 July 2026. Not all accounting work is necessarily within scope. Services that may be relevant include helping create or transfer companies and trusts, managing client money or property, or arranging financing. Routine tax returns and standard financial statements may fall outside the scope of designated services. Confirm how current requirements apply to your firm by checking AUSTRAC guidance and the services you actually provide.
What should the assessment cover?
Start with the practice as it operates, not with assumptions about accounting firms generally. Map the relevant services and consider how they are delivered, the types of clients involved and the transaction activity connected with the work. Then look at the people, processes and controls that influence exposure, such as how work is accepted, who handles client funds or property, and how unusual activity is escalated.
This gives you a practical view of where exposure may arise and whether existing arrangements address it. The scope and conclusions should reflect your firm’s own services and circumstances, with regulatory details checked against current AUSTRAC material.
How is firm-wide risk different from client risk?
A firm-wide assessment looks across the practice: its services, client mix, delivery methods and operating processes. Client-level due diligence asks a different question: what is known about this particular client, and what level of risk does that relationship present? The client assessment can inform the broader picture, but it doesn’t replace it. A pattern across several engagements, for instance, may reveal a process or service exposure that isn’t apparent from reviewing one client alone.
Know Your Customer (KYC) procedures relate to identifying and understanding individual clients. For practical guidance on that part of the process, see the CDD and KYC requirements guide. Keeping the two levels distinct helps your firm assess both its overall exposure and the risks associated with each client relationship.
How to conduct a money laundering risk assessment step by step
A practical assessment follows a clear sequence, but the conclusions should come from your firm’s evidence and judgement, not from a generic score. Use this workflow to make the process traceable and useful for follow-up.
- Define the scope. Set out which parts of the practice, services, client relationships and activities the assessment covers. Be clear about any boundaries or exclusions, and check relevant regulatory details against current AUSTRAC guidance.
- Gather evidence. Review service descriptions, client profiles, onboarding processes and available monitoring records. Ask staff who carry out or oversee the work where exceptions, manual workarounds or inconsistent practices arise. Record missing or incomplete information so assumptions remain visible and can be checked.
- Identify exposure. Consider how relevant services, client relationships, delivery channels and transaction patterns could create exposure. For example, compare the documented onboarding process with staff experience. Do actual engagements follow that process, or are there exceptions that may affect the firm’s view?
- Evaluate existing controls. For each identified exposure, note the relevant procedures, checks or systems, then assess whether they operate as intended. A written procedure is useful evidence, but consider whether staff understand and apply it in practice.
- Record conclusions and actions. Explain the evidence behind each finding, why it points to lower or higher exposure, and what remains uncertain. Avoid unexplained ratings. Where information is incomplete or evidence conflicts, state that clearly and identify how the firm will resolve it.
- Schedule a review. Set a review point and identify changes that should prompt an earlier reassessment, such as changes to services, client mix or processes. This helps keep the assessment aligned with the way the practice operates.
Keep a clear trail from evidence to conclusion to action. A finding might note that a process relies on manual handling, cite staff input and available records, explain how that affects the firm’s assessment, and specify what further evidence or control review is needed. This makes the reasoning easier to understand and revisit than a score without context.
If you’re considering how to conduct a money laundering risk assessment consistently, the AML risk assessment tool and methodology offers further framework and template guidance. Structured workflows can also help organise evidence and follow-up actions while leaving assessment decisions with the firm. Learn how Trancher supports AML risk assessment and documentation as part of its broader compliance workflows.
How to assess controls and determine remaining risk
Assess exposure twice: first before considering safeguards, then after examining how relevant controls work in practice. Inherent risk is the exposure considered before relevant controls are applied. Residual risk is what remains after those controls are taken into account.
A written policy or a low rating alone doesn’t show that risk is effectively managed. Check whether a control suits the exposure and whether staff apply it consistently. Look for evidence, such as completed records, workflow documentation or staff explanations. If evidence is incomplete or inconsistent, record that uncertainty rather than treating the control as proven.
Compare inherent and residual risk transparently
The example below is illustrative only. It doesn’t assign a score or set a threshold. Its purpose is to show how an accounting firm can separate the underlying exposure from the effect of its safeguards.
| Illustrative exposure | Inherent risk | Existing control and evidence | Residual risk and uncertainty |
|---|---|---|---|
| Staff handle client funds as part of a relevant service | Consider the exposure created by the service and how the funds are handled before taking controls into account. | A documented process sets out who handles funds and how activity is recorded. Check whether records and staff accounts show it’s followed in practice. | Describe the exposure that remains after considering the evidence. If records are incomplete or practices vary, state that the control’s effectiveness is uncertain and identify what needs checking. |
Use the same logic for each material finding: describe the exposure, identify the safeguards, note the evidence, then explain your view of remaining risk. This makes the rationale clear without suggesting that a single score can capture every relevant detail. It also helps direct attention to controls that may need strengthening or better evidence.
Connect controls to ongoing monitoring
Risk can change as a firm’s services, clients or operating processes change. New activity or a change in how work is delivered may affect the assumptions behind an earlier assessment. Consider whether new information should prompt a review of the relevant exposure and controls.
Ongoing monitoring can help surface changes, but it doesn’t replace periodic review or documented judgement. Record what has changed, whether the current controls remain suitable and what follow-up is needed. For more on connecting monitoring with client activity, read the ongoing risk monitoring guide.
How to document findings, assign actions and review the assessment
A clear record lets someone who wasn’t involved in the assessment understand what the firm considered, what evidence informed its decisions and what needs to happen next. It also makes the assessment easier to revisit as the practice changes. Keep the record grounded in your actual services and operations, rather than relying on generic wording that could apply to any firm.
What makes an assessment record useful?
Bring the reasoning and supporting evidence together. For each assessment, record:
- Scope: which services, activities and parts of the practice were considered, including any boundaries.
- Sources: the records, procedures and staff input reviewed, with relevant dates or references where useful.
- Findings and controls: the identified exposure, safeguards considered and evidence of how those safeguards operate.
- Rationale and decisions: why the firm reached its conclusions, including assumptions, limitations, uncertainties and unresolved questions.
- Actions: an accountable owner, intended outcome, due date and evidence that the action has been completed.
Be specific enough that the rationale can be followed later. For instance, if staff describe a workaround that isn’t reflected in a written process, note both sources and explain how the difference affects the assessment. Don’t present an assumption as confirmed evidence. For further record-keeping guidance, see the audit-ready compliance records guide.
When should the assessment be revisited?
Set review triggers that reflect meaningful changes, rather than relying only on a calendar reminder. Revisit relevant findings when the firm changes its services, client patterns or processes, or when new external information may affect the firm’s understanding of its exposure. Confirm any formal review requirements against current AUSTRAC guidance. Don’t assume a fixed interval without checking what applies.
Assign someone to monitor open actions and raise overdue or unresolved issues through the firm’s agreed process. When an action is completed, retain evidence of the outcome and consider whether it changes the assessment of the relevant control or remaining risk. That creates a practical loop: findings lead to action, and action is checked against evidence.
Understanding how to conduct a money laundering risk assessment includes making its decisions traceable and keeping them current. Structured workflows can help organise assessment records and follow-up without replacing your firm’s judgement. Explore Trancher’s AML documentation and record-keeping support.
How to embed the money laundering risk assessment in daily compliance work
An assessment becomes useful when its findings shape the work your team performs each day. Translate identified risks into clear staff procedures, client due diligence steps, monitoring activity and escalation pathways. For example, if a finding points to inconsistent client verification, make the expected checks and the process for recording exceptions clear to the staff responsible for onboarding.
Keep each workflow connected to the assessment. Staff should be able to see what action to take, where to record it and who to contact if something doesn’t fit the usual process. This makes it easier to apply controls consistently and trace activity back to the risk it is intended to address.
Choose a process the team can maintain
Compare your current method with what the firm needs to manage ownership, evidence, follow-up and reporting. Check whether information is entered more than once, actions are hard to track or decisions are difficult to trace to their supporting records. A process that looks comprehensive on paper may be hard to maintain if it creates unnecessary administration or relies on knowledge held by one person. The compliance officer toolkit offers related operational resources.
Structured software may help bring assessment records, due diligence activity, monitoring and follow-up into more consistent workflows. It can support the organisation of evidence and assigned actions, but it shouldn’t make the firm’s risk decisions automatically. The team remains responsible for reviewing information, applying its judgement and seeking appropriate professional advice where needed.
Turn assessment findings into a managed workflow
Trancher supports Australian accounting firms with structured workflows for risk assessment, client due diligence, ongoing monitoring and record keeping. These workflows are designed to reduce administrative effort and support consistent processes. Dedicated Australian onboarding and support can help firms work through implementation, while the firm retains accountability for its assessment and decisions.
As you put the assessment into practice, check that your systems help the team follow the agreed process, retain evidence and identify actions requiring attention. If you’re reviewing how structured workflows could support that work, start a conversation with Trancher.
Make your risk assessment part of everyday practice
A strong assessment gives your firm more than a snapshot of exposure. It connects the services you provide with evidence-based decisions, proportionate controls and follow-up actions that have clear owners. Knowing how to conduct a money laundering risk assessment also means keeping the record aligned with how your practice actually works, then revisiting it when relevant circumstances change.
Put the findings to work in staff procedures, client due diligence, monitoring and escalation. Structured workflows can help organise these activities and maintain consistent records, while your firm remains responsible for its judgement and decisions.
Trancher supports Australian accounting firms with workflows for risk assessment, client due diligence, monitoring and reporting, alongside audit-ready documentation and dedicated Australian onboarding and support. To bring these processes together, start a conversation with Trancher about structured AML workflows.
With a clear process and reliable records, AML/CTF work can become a manageable part of how your firm operates. Take the next step at a pace that suits your practice.
Frequently Asked Questions
What is a money laundering risk assessment?
A money laundering risk assessment is a reasoned view of where a firm may be exposed to money laundering or terrorism financing risks, and how it manages that exposure. For an accounting firm, it considers the practice’s relevant services, client types, delivery methods and processes. It’s a firm-wide assessment, not a substitute for checking an individual client’s identity, completing due diligence or assessing that client’s specific risk.
How do you conduct a money laundering risk assessment?
To understand how to conduct a money laundering risk assessment, start by defining which services and activities are in scope. Gather firm records and staff input, identify relevant exposures, then examine how existing controls work in practice. Record the evidence, reasoning, uncertainties and decisions behind each finding. Assign follow-up actions to accountable owners, capture due dates and completion evidence, and schedule reviews in line with relevant changes and current AUSTRAC guidance.
What factors should an accounting firm include in its AML risk assessment?
Consider the firm’s relevant services, client types and relationships, delivery channels, transaction activity and jurisdictions, where applicable. Include the people, procedures and systems that influence exposure, such as onboarding steps, how work is carried out and how concerns are escalated. Ground the assessment in your firm’s actual operating practices. Not every accounting firm has the same exposure, and not every accounting service is necessarily within scope, so check current AUSTRAC guidance.
What is the difference between inherent risk and residual risk?
Inherent risk is the exposure considered before relevant controls are taken into account. Residual risk is the exposure that remains after the firm considers those controls. For example, a service involving client funds may present an exposure before safeguards are considered. The firm would then assess relevant procedures and evidence to determine what risk remains. A written policy alone doesn’t establish that a control is effective. Consider whether it’s applied consistently.
How often should a money laundering risk assessment be reviewed?
There isn’t a review interval to assume without checking what applies to your firm. Confirm any formal requirements against current AUSTRAC guidance, and set review triggers that reflect meaningful change. Revisit the assessment if services, client patterns or internal processes change, or if relevant external information affects your understanding of exposure. Assign responsibility for monitoring actions and raising unresolved issues so that changes are considered and recorded promptly.
Is a spreadsheet enough to conduct an AML risk assessment?
A spreadsheet may be sufficient for organising an assessment if it helps your firm clearly record scope, evidence, reasoning, controls, actions and review updates. The key test is whether the method remains accurate, traceable and workable as the firm’s needs change. If records are duplicated, ownership is unclear or decisions are difficult to follow, structured software may help organise evidence and maintain consistency. A platform supports the process, but doesn’t replace the firm’s judgement.
How does a firm document its money laundering risk assessment?
Record the assessment’s scope, information sources, identified risks, relevant control evidence and the rationale for decisions. Note assumptions, information gaps and unresolved questions rather than presenting them as confirmed facts. For each follow-up action, capture an accountable owner, intended outcome, due date and evidence of completion. Keep supporting material with the record so someone who wasn’t involved can understand how the firm reached its conclusions and what happened next.