If your firm’s whole firm risk assessment (WFRA) was approved six months ago, how confident are you that it still reflects the business today? Most firms invest significant time producing a risk assessment. However, keeping it aligned with an evolving business can be challenging, particularly when reviews are largely driven by an annual timetable.
Findings from fscom’s 2026 Fincrime Compliance Report highlight why this matters. Across the 104 anti-money laundering, counter-terrorist financing and anti-financial crime (AML/CTF/AFC) audits, the WFRAaccounted for 64 of the 484 findings. It was the review area with the highest number of findings, overtaking compliance monitoring.
The issue is rarely the absence of a WFRA. The problem is that firms treat it as an annual deliverable. They complete it, approve it, file it and then leave it alone. But risk rarely changes according to the annual review calendar. Risk changes when a firm launches a new product, enters a new jurisdiction, adopts a new distribution model, partners with a third party, or starts attracting a different customer demographic. The business evolves continuously. The WFRA often does not.
This matters because the WFRA should sit at the centre of a firm’s financial crime framework. It informs how risks are understood and where controls are focused. If it is out of date, every control built on it is set up for yesterday’s risks.
What are the most common WFRA weaknesses?
Of the 64 WFRA findings identified in our 2026 audits, 12 were rated high impact and 52 low impact. Four recurring themes emerged.
1. Risk assessments that do not reflect business changes
The most common issue, accounting for 20 findings, was WFRA’s that were maintained as static documents rather than reviewed as risks evolved. In 15 of these cases, assessments were updated on a fixed annual cycle or only following an incident.
A review that only takes place after an incident has occurred is inherently retrospective. By the time the assessment is updated, the firm’s risk profile may already have changed. New products, entry into different jurisdictions, changes to distribution models or emerging financial crime threats can all affect a firm’s risk profile.
Without a clear process for identifying and responding to these changes, the WFRA may no longer provide an accurate basis for managing financial crime risk.
2. Inconsistent risk scoring methodologies
We identified 16 findings relating to scoring methodologies that lacked clear or consistently applied criteria for assessing inherent risk, control effectiveness or residual risk. In some cases, firms gave the same impact and probability scores to risks that were materially different, making it difficult to distinguish between areas requiring different levels of attention.
An effective scoring methodology should be transparent, consistently applied and supported by evidence. This enables firms to explain how risk ratings have been determined and demonstrate that resources and controls are proportionate to the risks identified.
3. Gaps in proliferation financing risk assessments
Eight findings related to proliferation financing (PF) risks that were either omitted from the WFRA or not assessed in sufficient detail. Our previous reports showed the same weakness.
This persists despite a specific requirement in the UK, Regulation 18A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017) requiring relevant firms to identify and assess PF risk.
4. Insufficient evidence of board oversight
Seven findings related to WFRAs, or changes to them, where firms could not show that the board had formally reviewed and approved them. Without that evidence, it is hard to demonstrate that senior management owns the firm’s risk profile rather than simply receiving it.
Maintaining clear records of board or senior management review, decisions and actions provides valuable evidence of how financial crime risks are understood and overseen.
Why keeping the WFRA current matters
The WFRA does not sit in isolation. It should inform wider financial controls, including customer risk assessments (CRAs), transaction monitoring, compliance monitoring plans and the allocation of compliance resources. When the WFRA does not accurately reflect the firm’s risk profile, this can affect the effectiveness of the controls and monitoring arrangements informed by it.
Our 2026 findings demonstrate this knock-on effect. CRA findings included frameworks that were not aligned with the firm’s WFRA. In another, the risk from relying on simplified due diligence was not reflected in the WFRA at all.
In the UK, Regulations 18 and 18A of the MLRs 2017 require firms to take appropriate steps to identify and assess the money laundering, terrorist financing and PF risks their business faces. Joint Money Laundering Steering Group (JMLSG) guidance is clear that firms should keep this assessment under review.
While an annual review provides an important opportunity to reassess risk exposure, firms should also consider whether material changes to their business or external risk environment require an earlier review.
In our experience, firms with more effective risk assessment frameworks treat the WFRA as an ongoing risk management tool. They establish clear review triggers, apply consistent scoring methodologies and maintain evidence of appropriate senior management oversight.
This helps ensure that risk assessments remain relevant and support informed decision-making as the business evolves.
WFRA readiness check: how does your firm measure up?
Consider the following questions when assessing the effectiveness of your WFRA:
- If you launched a new product or entered a new market in the last 12 months, did you review the WFRA as part of that change?
- Do you have a documented list of events that trigger a review outside the annual cycle?
- Could someone outside the compliance team understand why each risk received its score?
- Does your scoring clearly separate higher risks from lower ones?
- Do you assess PF risk as a distinct category, with reference to your products, customers and geographic exposure?
- Can you evidence board approval, including the date and any challenge raised?
- Where residual risk exceeds your risk appetite, do you have a remediation plan with a named owner and target date?
Where gaps are identified, firms should consider whether their current assessment processes provide an accurate and sufficiently detailed view of their financial crime exposure.
Five priorities for strengthening your WFRA
Our findings highlight five practical areas firms should consider when reviewing their approach.
- Establish clear review triggers
Document a process for reviewing the WFRA outside the annual cycle. Material changes should trigger it, such as new products, new jurisdictions or a significant rise in a particular risk indicator. - Strengthen risk scoring methodologies
Establish clear criteria for assessing inherent risk, control effectiveness and residual risk. Include the evidence used to assign each rating. - Ensure proliferation financing risks are adequately assessed
Treat PF as a distinct risk category, with appropriate reference to products, services, customer base and geographic exposure. - Demonstrate effective governance and oversight
Maintain evidence of appropriate board approval of the WFRA and any material update to it, including the date and any challenge raised. - Link risk assessments to action
Where residual risk exceeds the firm’s stated risk appetite, document a remediation plan with a named risk owner and a target date.
These improvements do not necessarily require new technology or significant changes to existing frameworks. In many cases, the priority is strengthening processes and evidence: knowing when to look again, being able to explain the result and showing that someone senior has challenged it.
Keeping your WFRA relevant
The key takeaway? A risk assessment is only as current as the last time the firm genuinely examined its risks.
An effective WFRA is more than a regulatory requirement. It provides a foundation for understanding financial crime exposure, prioritising resources and demonstrating effective oversight.
How fscom can help
fscom Compliance Maturity Specialists™ support regulated firms in assessing and strengthening their whole-firm risk assessments, ensuring they reflect the risks faced by the business as it operates today.
Through AML/CTF/AFC audits, WFRA reviews, and wider financial crime framework reviews, we help firms identify areas for improvement, strengthen governance and develop proportionate, risk-based controls.
Explore the findings in our 2026 fincrime compliance report, or get in touch with our team to discuss how we can support your firm.
