Inherent and residual risk in AML: why two reviewers disagree

Inherent and residual risk are the two halves of every row in an AML risk assessment. Inherent risk is the money laundering and terrorist financing risk a product, customer group, geography or delivery channel carries before any control; residual risk is what remains after the bank's controls, read from the bank's own matrix of inherent risk against control strength. The FFIEC manual fixes neither the scales nor the matrix, so two careful reviewers working from the same data can reach different ratings, and research on risk matrices says they often do. Botminds' BSA/AML Risk Assessment scores every category under the bank's written methodology and lets any rating be opened to its data, which makes the disagreements visible and the ratings repeatable.

The worked examples use a fictional sample bank as it runs through the solution, Tessaly Community Bank, and two reviewers we invented to show how disagreement arises. Regulatory and research sources are linked where they appear.

What is inherent risk in AML, and what is residual risk?

Inherent risk is the level of risk an activity carries before controls are considered; residual risk is the risk left after them. The OCC's supervision handbook uses the same split under other names. It calls the first "quantity of risk," the "level or volume of risk that the bank faces," and insists that "the quantity of risk and quality of risk management should be assessed independently. The assessment of the quantity of risk should not be affected by the quality of risk management" (OCC, Bank Supervision Process). The combined view, which the OCC calls aggregate risk, is the residual rating a bank's assessment reports.

Treasury uses the same logic at national scale. Its 2026 National Money Laundering Risk Assessment says it "primarily examines the residual risk of a particular sector or service, taking into consideration any remaining inherent risk after accounting for the effect of mitigating measures including regulation, supervision, and enforcement" (Treasury, 2026 NMLRA). A bank does the same thing for its own book, with its controls in place of regulation.

The FFIEC manual gives the inherent side its vocabulary. Its Appendix J, the quantity of risk matrix, describes low, moderate and high for each factor, for example a "stable, known customer base" at the low end against "a large and growing customer base in a wide and diverse geographic area" at the high end (FFIEC Appendix J). It is an examiner's aid that "banks and examiners may use," not a required scale.

How do you calculate residual risk? The matrix, worked on one row

You calculate residual risk in three steps: score inherent risk for each category from its data, rate the strength of the controls that address it from their evidence, and read the residual rating from the bank's matrix where the two meet. The arithmetic is simple; the judgement sits in the first two steps.

Take the sample bank's fintech partner programs row. Eleven sponsored programs, up from six, now serve 214,000 end customers and send $1.9 billion of ACH a month, and program activity produced 4,310 of the bank's 9,840 monitoring alerts. Under the bank's methodology the five categories in the row score a weighted 4.6 of 5, which is High inherent risk. The seven controls that address the row rate Adequate overall, with one, partner data feeds and monitoring, rated Needs improvement. High against Adequate reads Moderate-High in the bank's matrix, up from Moderate last year.

Some banks prefer a score to a lookup: residual equals inherent multiplied by a control factor, such as 0.6 for strong controls and 1.0 for weak ones. Either works if it is written down. The FFIEC manual asks only that, as sound practice, the bank write down the factors and any weighting (FFIEC, BSA/AML Risk Assessment). What does not work is a matrix that lives in one analyst's head.

BSA/AML Risk Assessment: five rows, each read inherent to controls to residual

Why do risk assessments differ between reviewers?

Risk assessments differ between reviewers because the inputs to a rating are judgements, the scales are defined in words, and nothing in the rules makes two banks, or two people in one bank, use the same ones. The FFIEC manual requires no particular risk categories, lets their number and detail vary from bank to bank, and says "any single indicator does not necessarily determine the existence of lower or higher risk." Freedom to fit the method to the bank is the point. The cost is that two reviewers can apply the same method differently.

Research on risk matrices measured that cost long before AML used them. Louis Anthony Cox's 2008 study in the journal Risk Analysis found that typical matrices "can assign identical ratings to quantitatively very different risks" and that their inputs and outputs "require subjective interpretation, and different users may obtain opposite ratings of the same quantitative risks" (Cox, Risk Analysis, 2008). Ball and Watt tested it with people in 2013 and found that "different risk assessors may assign vastly different ratings to the same hazard" and that "even following lengthy reflection and learning scatter remains high" (Ball and Watt, Risk Analysis, 2013).

There has been minimal effort at evaluation of how well any AML intervention does in achieving its goals.

Levi, Reuter and Halliday, Crime, Law and Social Change, 2018

AML has measured its own consistency even less. Banks test controls every year; few test whether their risk ratings would come out the same if someone else scored them. Four sources of drift account for most of the gap: a reviewer who lets the strength of a control lower an inherent rating, which the OCC handbook warns against; a scale defined in words such as "significant" with no number behind it; a category weighted by feel rather than by a written weight; and a narrative sentence carried from last year that anchors this year's rating.

Two reviewers, one product line

The disagreement is easiest to see on one row. Below, two reviewers score the sample bank's five fintech partner categories from the same 24 data points. Both are careful. They agree on two categories and differ on three, and every difference traces to one of the four sources of drift.

The row-level result matters more than any one cell. Reviewer B's ratings average to Moderate-High inherent, which against Adequate controls reads Moderate residual, the same as last year. Reviewer A's read High and Moderate-High. A board told the partner book nearly doubled and the residual rating did not move would be right to ask why, and the answer, controls counted twice, is a design flaw no examiner would accept.

How do you rate control effectiveness?

You rate a control on evidence of two things, whether it is designed to address the risk and whether it operates as designed, and you date the evidence. Design asks whether the control would catch what the category produces; operation asks whether it did, in testing, quality reviews, the independent test and exam findings. A well-designed control that the last test found failing is not Adequate.

FinCEN's April 2026 proposal, not yet final, draws the same line for the whole program: it distinguishes "deficiencies stemming from program design ('establishment')" from "program implementation ('maintenance')" (FinCEN fact sheet, April 2026). A control rating that names which of the two failed gives the action plan its target. The sample bank rates its 41 controls on a four-point scale, Strong, Adequate, Needs improvement and Weak, close to the OCC's own scale for quality of risk management: "strong, satisfactory, insufficient, or weak." Its rule, a bank setting, is that no control is rated without evidence dated within 18 months.

Score a sample twice: measuring agreement between reviewers

The way to know whether ratings are repeatable is to score a sample twice, independently, and count the agreement. Choose 15 to 20 categories across all rows, give the same data to two people who have not seen each other's work, and compare. Exact agreement is the plain measure; Cohen's kappa adjusts it for agreement that would happen by chance (Cohen, 1960).

The number is less useful than the list it produces. Every disagreement is a category whose rule is not tight enough. In the example, three of the four disagreements fall where one reviewer moved a control into the inherent column, so the fix is a sentence in the methodology, not more training on judgement. Run the test again after the fix, and keep both results: a measured improvement in consistency is evidence an internal auditor and an examiner can read.

Write the rule, not the rating: how to close the gaps

Disagreements close when each level of the scale is defined by data the bank actually holds, so the rating follows from the numbers rather than from the reviewer. "High: more than 50,000 end customers or more than $500 million of monthly ACH through programs where the partner performs identity verification" can be scored the same way by anyone. "High: significant program activity" cannot.

Four rules close most of the gap. Define every level by a threshold on a named data point. Score inherent risk with controls hidden, as the OCC handbook asks. Write down every weight: the sample bank's methodology version 4 gives products and services, customers and entities, and fintech partner programs 25% each, delivery channels 15% and geographies 10%. And make every change to the method a new, approved version, so that a rating can always name the rule that produced it. The wider question of which BSA risk assessment categories to score comes first: a perfectly consistent rating of an incomplete inventory is still wrong.

One row opened: five categories, each with its own inherent, control and residual rating

Where agents make scoring repeatable, and where they cannot

Agents make the scoring step repeatable because they apply the written rule the same way every time: given the same data and the same methodology version, the risk scorer in BSA/AML Risk Assessment gives the same level and names the data points behind it in one sentence. A category where the agent's confidence falls below the bank's setting, 0.80 at the sample bank, goes to a person instead of into the draft. That removes the drift that comes from fatigue, anchoring on last year and different readings of the same word.

Agents cannot make a vague rule precise. If the methodology says "significant," the agent has to interpret it too, and its confidence will show the problem rather than hide it. And agents never settle the judgement calls: an override of a residual rating needs a named person and a reason code, a change to the weights needs the chief risk officer's approval, and the BSA officer submits. The limits of AML risk assessment software are set out in full in a separate guide; how often the ratings should be refreshed is covered in how often a bank must update its BSA/AML risk assessment. See every rating opened to its data in BSA/AML Risk Assessment.

Questions people ask

What is the difference between inherent risk and residual risk?

Inherent risk is the risk an activity carries before controls; residual risk is what is left after them. A product with heavy international wire volume can be High inherent risk and still Moderate residual risk if its controls are strong. Both belong on every row of a BSA/AML risk assessment, with control strength between them.

What is an inherent and residual risk matrix?

It is a grid that reads a residual rating from an inherent rating and a control strength rating, such as High inherent with Adequate controls giving Moderate-High residual. No regulator prescribes one. The FFIEC manual's Appendix J describes low, moderate and high inherent risk factors, and each bank designs and documents its own matrix.

Can strong controls make residual risk lower than Low?

No. Residual risk can fall to the bottom of the bank's scale but not below it, and a bank may keep a floor above Low for High inherent risk even with Strong controls, as in the matrix on this page. Controls reduce risk; they do not remove the product's exposure.

Should residual risk ever be higher than inherent risk?

Only if the scale treats weak controls as adding risk, which some banks do: a Moderate inherent category with Weak controls can read Moderate-High. The more common design keeps residual at or below inherent and shows weak controls through action plans. Either is acceptable if it is written down and applied the same way everywhere.

How often should reviewer agreement be tested?

No rule requires it. A practical rhythm is once when the methodology is adopted, again after any change to the scales or weights, and on a sample each year as part of the review of the assessment. The independent test can include it, since the FFIEC manual says independent testing should review the risk assessment.

What is aggregate risk in a BSA exam?

Aggregate risk is the OCC's term for the summary conclusion that combines the quantity of risk with the quality of risk management, characterized as low, moderate or high. It is the supervisory counterpart of the residual rating in a bank's own assessment, and examiners also judge its direction: decreasing, stable or increasing.