## Introduction

After completing the initial Compliance Centre setup, the Firm risk assessment helps you identify and understand your firm’s vulnerabilities to money laundering and terrorism financing (ML/TF). Completing it is a crucial step in identifying and mitigating the ML/TF risks relevant to your business, and in establishing (and maintaining) an effective AML/CTF compliance program within the Compliance Centre.

## Summary

This guide provides a comprehensive walkthrough on how to complete and review the Firm risk assessment within the AML/CTF Compliance Centre. It covers the end-to-end process from initiating the assessment to reviewing the generated report/policy, ensuring your firm’s ML/TF risk profile is accurately documented.

## Understanding Where the Risk Assessment Content Comes From

The Firm Risk Assessment module is built using content derived directly from the official AUSTRAC starter kit. This helps ensure the included risk descriptions, vulnerabilities, questions, and suggested actionable steps align with regulatory guidance.

The starter-kit material has been digitalised into an interactive format within the Compliance Centre so firms across different sectors can complete the assessment directly in the platform.

In addition to informational content, the tool incorporates the specific **questions and steps** that a firm needs to complete. Following these steps is essential to produce a finalised and valid risk assessment document.

## When to Use This

Use this guide when you are setting up the Compliance Centre for the first time, conducting your firm’s initial risk assessment, or updating your assessment to reflect changes in your business operations, client base, service delivery methods, or countries.

Only users assigned as the **Compliance Officer** can access and complete the Firm risk assessment.

## What You’ll Complete (Assessment Sections)

As you move through the guided workflow (a multi-part questionnaire), you’ll be prompted to complete each section of the assessment. These sections appear in the left-hand menu/progress tracker:

* **Sector information** (including confirming **designated services**)
* **Client types** (for example, individuals/sole traders or bodies corporate)
* **Delivery channels** (for example, in person or email)
* **Designated service risk factors**
* **Client risk factors**
* **Delivery channel risk factors**
* **Country** (geographic risk)

You must complete each section to finish and generate the final report.

## Step-by-Step Instructions

### 1) Start the assessment and confirm your sector/designated services


1. **Access the Assessment:** From the **Compliance Centre** dashboard, navigate to the **Firm risk assessment** tab.
2. Click **Start risk assessment** to begin a new assessment, or select **Upload your own** if you’re uploading an existing document.
3. **Sector information / designated services**:
   * You will be taken to the **Sector information** screen.
   * Use the progress indicator on the left to track completion.
   * Review the list of **designated services**. Depending on your sector (for example, Conveyancing), the relevant service may be pre-selected.
   * In the **Select designated service** section, select all designated services your firm provides, then click **Next**.

 ![](https://infotrack-australia.brainfish.ai/api/attachments.redirect?id=ae8070c5-f719-4822-a60d-cef8c471b1c7 " =1217x374")

### 2) Select client types


1. **Select Client Types**: Choose all the client types your firm deals with.
   * You will see a list of different client structures. Each client type includes a brief description to help you classify them correctly.
   * This screen may be labelled **Who are your clients?**
   * Select all client types that your firm has engaged with over the past year (as a rule of thumb, review your client history to ensure accuracy).

### 3) Select delivery channels


1. **Select Delivery Channels**: Indicate how your firm interacts with clients.
   * On the **Delivery channels** screen, you will be asked: **“Which of the following ways do your clients interact with you?”**
   * Review the available channels (for example: **In person**, **Email**, **Telephone**, **Video conferencing programs**, and **Online platforms**).
   * Use the on-screen descriptions to confirm what each option covers (for example, **Telephone** can include calls and text messages).
   * Select **all** delivery channels your firm uses, then click **Next**.

### 4) Review and respond to risk factors


1. **Review Designated Service Risks**:
   * For each risk factor, you will see a **title**, a **description**, and an **inherent risk rating** (for example: Medium or High).
   * Select **Yes** if your firm accepts the risk, or **No** if your firm does not accept the risk.
   * If you select **No**, you must enter details on how you will avoid or mitigate this risk in the provided text box.
   * Click **Next** once completed.
2. **Review Client Risk Factors**: Evaluate the listed client risks and select **Yes** or **No** for each.
   * If you select **No**, you must enter details on how you will avoid or mitigate this risk in the provided text box.
   * Click **Next** once completed.
3. **Review Delivery Channel Risks**: Assess risks related to how services are delivered.
   * Select **Yes** or **No** and provide necessary details for any **No** answers.
   * Click **Next** once completed.

### 5) Configure countries (country-specific risk)


1. **Configure Countries**: Review the countries your practice deals with. Australia is selected by default.
   * This is typically the last data-entry step before the final report is generated.
   * Click **+ Add country** to include other countries.
   * The system assigns a country risk rating (for example **Low**, **Medium**, or **High**) based on international indices.
   * To remove a country, click the **x** icon next to its name.
   * If you include high-risk countries or do not accept the risk for a specific country, outline your mitigation strategy in the text box.

### 6) Finalise and review the generated report/policy


1. **Finalise**: After completing all sections, click **Finish** to save your assessment and generate the output.

*Your assessment is saved in the platform. You can return to the **Firm risk assessment** tab at any time to review it or run through the workflow again to update it (for example, if your services, client types, delivery methods, or country exposure changes).*


1. **Review the generated report/policy**: After you click **Finish**, the system generates a final report (sometimes referred to as a risk policy) summarising your firm’s risk profile.

This report details your key vulnerabilities and inherent risk factors, including your designated services and the key risk factors identified.

## Reviewing, Saving, Auditing, and Updating the Final Report

### Review your designated services and vulnerabilities (overview)

When you open the **Firm risk assessment** area, the page will display your firm’s **designated services** and the **vulnerabilities** associated with each service (for example, vulnerabilities relevant to conveyancing or emerging technologies).

This overview helps you understand where your main compliance vulnerabilities sit before you update the assessment.

### Save a copy

You can use your browser’s print function (often Ctrl+P or Cmd+P) to save the report as a PDF for your records.

### View the audit trail

To see a history of changes made to the assessment:


1. Click the **three-dot menu** at the top right.
2. Select **Audit trail**.

This generates a PDF log showing dates, times, and the names of users who initiated, updated, or completed the assessment.

 ![](https://infotrack-australia.brainfish.ai/api/attachments.redirect?id=7ed976ce-e64c-4bd9-97cd-0c6d97637693 " =1735x274")

### Update the assessment later

If your business operations change or you need to conduct a periodic review:


1. Click the **three-dot menu**.
2. Select from **Update risk assessment**, **Upload new risk assessment** or **Restart risk assessment**.

**Update risk assessment =** this will display the saved answers from when the assessment was last created. Click **Next** to be taken to the section that needs updating, make the change, and then click **Finish** once all the changes have been made.

**Upload new risk assessment =** this allows you to upload your own risk assessment and replace any existing uploaded or created assessment.

**Restart risk assessment** = this restarts the guided process from the beginning so you can make changes and generate an updated report.

## Common Questions

**Who can complete the Firm Risk Assessment?** Only users designated as the **Compliance Officer** can access and complete the assessment.

**What is a designated service?** A designated service is a specific activity your business performs that is covered by AML/CTF legislation (for example, acting on behalf of a person in a real estate transaction).

**What if my service isn’t listed?** The services listed are based on your industry sector. If you believe a service is missing, contact support for clarification.

**What does it mean to “accept” a risk?** Accepting a risk means you acknowledge it exists within your operations and will manage it as part of your AML/CTF program. It does not mean you are ignoring it.

**Is it bad to have high-risk factors?** No. The goal of the assessment is awareness. Identifying a high risk allows you to be vigilant and apply the appropriate controls. Many businesses will have high-risk factors as part of their normal operations.

**What happens if I select “No” for a risk factor?** If you select **No**, the system requires you to input a reason or mitigation strategy explaining how your firm avoids that specific risk.

**Where do the risk descriptions and questions come from?** The content in the Firm Risk Assessment module is derived from the official AUSTRAC starter kit and has been digitalised for completion within the Compliance Centre.

**What does “Online platforms” include?** This includes your website, payment platforms, or any other third-party applications you use to engage with or provide services to clients.

**Are some delivery channels riskier than others?** Yes. Non-face-to-face channels (like email, video conferencing, or online platforms) can sometimes present a higher risk of fraud or identity-related issues compared to in-person interactions. The assessment takes this into account.

**How are the country risk ratings determined?** Country risk ratings are based on established anti-money laundering indices and assessments from regulatory bodies such as the Basel Institute on Governance and AUSTRAC.

**What if I only do business in Australia?** Leave **Australia** as the only country listed and proceed by clicking **Finish**.

**Can I change the sector or designated service?** The designated service is typically set during the initial Compliance Centre setup. In this assessment, it is displayed for confirmation.

**How do I finish the assessment?** After completing all sections (including the Country selection), click **Finish** to save your assessment and generate the report/policy.

**How often should I update the risk assessment?** Review and update your risk assessment whenever there are significant changes to your business (for example, new services, new client types, new delivery channels, or new countries) and on a regular periodic basis (for example, annually).

**Can I reset the Firm risk assessment?** To reset the Firm risk assessment, open the completed report, click the three dots (top right), and select **Restart** **risk assessment**. This will remove the completed assessment and the Compliance Officer will need to complete it again.

**What does the “Last updated” date mean?** This date, shown at the top of the report, indicates the last time the assessment was completed and a new report was generated.

## Troubleshooting Tips

**Cannot access the assessment / can’t see the “Start” button** You may not have Compliance Officer permissions. Contact your system administrator to get the correct access level.

**“Next” button is disabled or not working** Ensure you have made a selection for all required fields on the current screen.

* On the **Sector information / designated services** screen, you must select at least one designated service.
* For risk factor screens, ensure you have entered text if you selected **No**.

**Cannot find a specific country** When adding a country, type the name in the search box to filter the list. If it does not appear, check the spelling. If it’s still missing, contact support.

**Uncertain about a client’s structure** If you are unsure how to classify a client, refer to their formation documents or seek legal advice. The descriptions provided in the assessment can also offer guidance.

**My specific software isn’t listed** The categories are broad. For example, if you use a specific video call software like Zoom or Microsoft Teams, select **Video conferencing programs**.

**The risk rating seems incorrect for my business** The inherent risk ratings are based on general industry and regulatory guidance. The key compliance activity is documenting how your firm manages the risk (including any controls and processes you have in place).

**Audit trail is not opening** Ensure your browser allows pop-ups and that you have a PDF viewer installed. The audit trail opens as a PDF in a new tab or window.

**Unsure about a risk factor** Each risk factor includes a description to help you decide. If you’re still unsure, consult internal stakeholders and/or legal or compliance experts. The assessment is about identifying and managing risk, not eliminating it entirely.

Completing the Firm Risk Assessment

How to add your AUSTRAC enrolment number

Setting up the AML/CTF Compliance Centre

Navigating the Transactions tab

Governing Body access in the Compliance Centre

Senior Manager or Client-Facing staff access in the Compliance Centre

Understanding the Transactions list

User roles and Viewing permissions

Navigating the Compliance Centre

Uploading your own Firm risk assessment

Uploading an external Policy document

Generate a Policy and Process document

Managing policy and process documents

Policy and Process overview

Due Diligence requirements for Compliance Officers

Performing the Bankruptcy Register search

Performing the Criminal History check

Onboarding a Compliance Officer

Onboarding Governing Body, Senior Manager and Client-facing roles

Managing Staff Onboarding

How to Review Profile Matches from a Screening Check

Understanding Screening Check Statuses

Conducting PEPs, Sanctions, and Adverse Media Checks

Tracking completed Training Modules

How to check Training Status and access your Training Completion Certificate

How to access and complete Training modules

Managing Staff Training

AUSTRAC Reports

Viewing and filtering existing Reliance Agreements

Creating a New Reliance Agreement

Managing Reliance Agreements in the Compliance Centre

Frequently Asked Questions

Getting Started with the Compliance Centre

 Configuring Verification and Compliance Checks for individuals

Sending Onboarding Requests and Accessing the AML Summary for individuals

Completing the individual Risk Assessment and Finalising Onboarding

How to Onboard an Individual

Performing a Verification of Funds Check

How to Escalate a Client to a Compliance Officer

Enhanced Due Diligence and Escalations

How to Finalise Trust Onboardings

How to Complete the AML Risk Assessment for Trusts

How to Onboard a Trust

How to Complete the AML Risk Assessment for Companies

How to Finalise Company Onboardings

How to Onboard a Company

Conducting an Initial Risk Review for Escalations

Resolving or Investigating Escalations Further

Reviewing Escalations as a Compliance Officer

AML Customer Due Diligence

Editing staff details to resolve Staff Onboarding validation errors

Duplicate Users - Practice Management Software Integration

Old Users Appearing in Staff Onboarding

Troubleshooting

Guide

Help Center - Live

Completing the Firm Risk Assessment

Share

Uploading your own Firm risk assessment

Share

Completing the Firm Risk Assessment

Share

Uploading your own Firm risk assessment

Share