Your Annual Review Is Only as Strong as Your Risk Assessment

The annual review fails in a predictable way. Not because firms skip it, but because they treat it as a filing exercise rather than a risk management tool.

A strong annual review should reveal how a firm thinks about risk: what it prioritized, why it focused there, what testing uncovered, and what changed as a result. The risk assessment provides the logic behind those decisions.

Risk-Based Means More Than Risk-Aware

Regulators expect annual reviews to be risk-based. But identifying risks is not the same as using risk to drive the program.

A meaningful risk assessment determines where testing should focus, where resources should go, and when oversight needs to change. It creates a clear line from risk to action and documents the reasoning behind those decisions.

That is what makes the annual review more than a record of work completed. It becomes evidence of how the compliance program operates.

Build the Risk Picture First

Before prioritizing risk, understand how the firm actually operates.

Map legal entities, business lines, regulatory obligations, ownership, and key risk areas. Depending on the firm, that may include disclosures, valuation, fees and expenses, AML/KYC, electronic communications, Marketing Rule compliance, Reg BI, custody, digital assets, AI, and third-party oversight.

Then assess inherent risk, control strength, and residual risk. Connect priorities to specific controls and owners. The inventory tells you where risk exists and the assessment tells you where attention belongs.

Focus Where Risk Is Changing

Risk assessments are most valuable when they surface areas where regulation, business practices, or exposure are evolving.

For many firms, several areas deserve closer attention:

• Marketing Rule compliance. Review and recordkeeping should work consistently across websites, social media, pitch decks, and other channels. The bigger risk is often not a single advertisement, but an inconsistent governance process.
• Custody and safeguarding. Policies need to reflect actual practices around fee deductions, account access, money movement, and authorization. Problems emerge when documented procedures and day-to-day operations drift apart.
• Reg BI and fiduciary oversight. Firms should be able to demonstrate how conflicts, recommendations, and supervision support client obligations, particularly where advisory and broker-dealer frameworks intersect.
• Digital assets and personal trading. Employee activity involving digital assets, tokenized products, or prediction markets should be addressed explicitly through policies, disclosures, preclearance, and supervision.
• AI governance. Firms need visibility into where AI is used, who owns it, and what controls govern its outputs. Clear oversight and audit trails are becoming part of a defensible compliance framework.

Make the Review Continuous

Risk does not operate on an annual schedule. New products launch, regulations change, and business practices evolve. A risk assessment completed in January may no longer reflect the firm’s compliance program in June.

Stronger programs treat the assessment as a living framework and when risk changes, testing priorities change with it. When testing surfaces an issue, the assessment should reflect how the firm responded.

By year-end, the annual review should not simply capture what happened. It should show the full story of how the compliance program adapted along the way.

Make the Reasoning Defensible

A defensible review should make the decision-making visible:

• What did we prioritize, and why?
• What did testing uncover?
• What changed because of it?

The goal is to demonstrate a program that identifies risk, responds deliberately, and improves over time.

Strong risk assessments give compliance leaders something more meaningful than a record of what the firm did. Leveraging risk assessments prior to annual reviews gives you a defensible explanation of deficiencies identified and how you’re addressing those gaps long before a regulator asks.