The auditor finds that the customer risk assessment (CRA) is completed at initial onboarding and is repealed for each customer every other year. The auditor’s observations should Include that the CRA should:

The auditor finds that the customer risk assessment (CRA) is completed at initial onboarding and is repealed for each customer every other year. The auditor’s observations should Include that the CRA should:
A . be updated more often given the risk of the entity.
B . include an assessment of jurisdiction where the customer currently resides as this may have changed.
C . allow for sales oy third patties other than advisors since most of the customers are local residents.
D . include a qualitative overlay that 95% of the products offered are subject to regulatory exemptions.

Answer: B

Explanation:

Dynamic Nature of Customer Risk Assessment (CRA):

A comprehensive CRA should incorporate jurisdictional risks, as customer location changes could introduce new risks, such as exposure to high-risk or non-compliant jurisdictions.

FATF Recommendations on Risk-Based Approach:

Periodic updates to the CRA, including changes in customer location, align with FATF’s risk-based approach and Recommendation 10.

Audit Observation Implications:

Omission of jurisdictional assessments could result in undetected risks, undermining the integrity of the AML program.