What is a Risk-Based Approach?
The short answer
A risk-based approach allocates controls and review effort according to the assessed likelihood and impact of relevant risks.
Risk-Based Approach: why it matters
An onboarding or review decision can contain several different questions. Keeping this concept distinct helps the team assign the right evidence and decision owner, rather than rely on a single completed status.
How to assess it in practice
Explain the risk factors and evidence behind a decision rather than applying the same review depth to every relationship. Start by defining the question the team needs to answer. Identify the relevant record or evidence, check its scope and date, and retain the reasoning behind the result. If evidence conflicts, keep that conflict visible for review.
Worked example
Illustrative workflow: a team reviewing a business adds a separate check for risk-based approach. The reviewer’s task is to explain the risk factors and evidence behind a decision rather than applying the same review depth to every relationship. The outcome is recorded together with the supporting evidence; an unresolved question stays open rather than being converted into a positive result.
Two suppliers operate in the same country but have different services and ownership transparency. Assign review depth using the relationship facts, not geography alone.
Distinctions that matter
Risk-Based Approach belongs to the due diligence methods topic family. Read Customer Due Diligence (CDD) alongside it to understand the adjacent question. Each page has its own intended scope; shared context does not make the concepts equivalent.
Evidence and review output
Review these
- Customer and relationship context
- Risk factors and evidence gaps
- Review depth and approval basis
The review should produce
A documented assessment explaining the review approach, evidence considered and conditions attached to any acceptance decision.
Across this family
The depth of review should follow the specific risk question and applicable framework. Document why additional or reduced checks are appropriate, which evidence can answer the question and what uncertainty remains. Escalation should resolve a defined issue rather than merely add another approval signature.
A note from practice
A risk-based approach makes the link between risk factors and control intensity explicit. Separate inherent exposure, the controls applied and the remaining uncertainty so a numerical score has an interpretable rationale.
Limits and common mistakes
The practical boundary is important: Explain the risk factors and evidence behind a decision rather than applying the same review depth to every relationship. Do not substitute a related label for this check or assume that missing information is a negative finding. Source-specific and jurisdiction-specific rules require their own review.
Frequently asked questions
Which evidence should I review?
How is Risk-Based Approach different from Customer Risk Assessment?
What should the result of the review contain?
Continue learning
Related topics
- Due diligence methodsCustomer Due Diligence (CDD)Customer Due Diligence is the work of establishing a customer’s identity, understanding the relationship and assessing its risks. For a corporate customer, the file often combines company identity, ownership, representatives and an explanation of the intended activity. The aim is an evidence-supported decision that can be reviewed later, rather than a collection of unchecked documents.
- Due diligence methodsEnhanced Due Diligence (EDD)Enhanced due diligence applies deeper investigation to relationships whose risks or applicable requirements call for additional evidence.
- Due diligence methodsSimplified Due Diligence (SDD)Simplified due diligence adjusts the intensity of checks where the applicable framework permits a lower-risk approach.
See the registry record behind every answer.
Primary, government-sourced data on 600M+ companies in 200+ countries, with full source attribution.