{"id":8445,"date":"2026-06-05T16:51:00","date_gmt":"2026-06-05T16:51:00","guid":{"rendered":"https:\/\/goldleafbvi.com\/?p=8445"},"modified":"2026-06-05T16:54:45","modified_gmt":"2026-06-05T16:54:45","slug":"the-ira-that-stopped-me","status":"publish","type":"post","link":"https:\/\/goldleafbvi.com\/es\/the-ira-that-stopped-me\/","title":{"rendered":"El IRA que me detuvo a mitad de la revisi\u00f3n"},"content":{"rendered":"

[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.27.5″ locked=”off” global_colors_info=”{}”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.27.6″ _module_preset=”default” link_text_color=”#b5932f” ul_font_size=”16px” ol_font_size=”16px” custom_css_free_form=”.press-release {||max-width: auto;||margin: auto;||font-family: Arial, Helvetica, sans-serif;||line-height: 1.6;||}||||.press-release h1 {||font-size: 28px;||margin-bottom: 20px;||}||||.press-release h2 {||margin-top: 40px;||color: #b5932f;||font-size: 18px;||letter-spacing: 0.5px;||}||||.press-release blockquote {||border-left: 4px solid #b5932f;||padding-left: 15px;||font-style: italic;||margin: 20px 0;||}||||.press-release hr {||margin: 40px 0;||}” global_colors_info=”{}”]<\/p>\n

I Have Reviewed a Lot of IRAs as Regulatory Counsel. Last Week, I Found One I Would Use as a Teaching Example.<\/strong><\/h2>\n

 <\/p>\n

What it contained, why it held up, and the standard it reveals.<\/em><\/p>\n

I had been thinking about writing on this topic for some time, and the timing turned out to be appropriate. I was in the middle of reviewing a client’s institutional risk assessment (IRA) as part of a broader regulatory and compliance engagement, when I realised the document in front of me was, in many ways, a case study in what a defensible IRA looks like. So rather than write in the abstract, let me walk you through what stood out and why it matters.<\/p>\n

 <\/p>\n

It started with a clear methodology<\/strong><\/h3>\n

The first thing that struck me, was how openly the client had laid out their methodology. There was no guessing at what they were measuring or how. The document set out the risks being measured, the formula used to measure them, the criteria used to assess impact and probability, what makes something low, medium, or high, the mitigators being applied, and the firm’s risk appetite for each risk factor with a rationale for why the appetite was set where it was.<\/p>\n

That last point deserves emphasis. The client did not simply declare a risk appetite. They explained it. For customer risk, for example, they had set a high appetite. The rationale was that the firm could comfortably handle a large volume of politically exposed persons (PEPs) and virtual asset business because they had built the enhanced due diligence (EDD) measures and supporting infrastructure to manage that exposure. The appetite was not a wish. It was a reasoned position grounded in the firm’s actual capabilities.<\/p>\n

This is what gives an IRA its first layer of defensibility. If a regulator asks why a particular risk has been rated where it has, the answer is already on the page.<\/p>\n

 <\/p>\n

Frequency of review, but more importantly, the triggers<\/strong><\/h3>\n

The second element that impressed me was how the client had handled review frequency. Many IRAs default to a line about annual review and leave it there. This one did not.<\/p>\n

It set out the standard review cycle, yes, but it also defined the triggers that would prompt a review outside of cycle. Those triggers included material deficiencies arising from audit findings, and crucially, the document defined what “material” meant, so there was no room for interpretive drift. Other triggers included a change in the volume of suspicious activity reports (SARs) filed, the introduction of new products or services, and entry into new jurisdictions or markets.<\/p>\n

This matters because risk does not wait for the calendar. A regulator looking at an IRA wants to see that the firm has a live awareness of when its risk profile has shifted enough to warrant reassessment. Naming the triggers and defining them demonstrates that awareness.<\/p>\n

 <\/p>\n

Ownership and escalation<\/strong><\/h3>\n

The third element was straightforward but often overlooked: the IRA clearly identified who was responsible for updating it and what matters required escalation. Accountability was named. Escalation pathways were named. There was no ambiguity about who held the pen and who needed to be informed when things changed.<\/p>\n

 <\/p>\n

What gave me pause, and what resolved it<\/strong><\/h3>\n

Here is where my review took an interesting turn. When I worked through the actual quantitative tool, I noticed a fair amount of residual high risk. My instinct, putting on my critical reviewer’s hat, was to challenge this. Surely residual high risk should be the exception, not a recurring feature?<\/p>\n

But then I returned to the methodology. The client had been explicit about what residual high risks would be accepted and what factors needed to be present for that acceptance to be valid. When I traced those factors through the tool, they had been addressed and demonstrated. The rationale was that the residual high risk had been assessed, the controls remained proportionate and sufficient, and the exposure sat within the firm’s stated risk appetite.<\/p>\n

That is not the same as ignoring risk. That is accepting it with eyes open, on documented terms, with controls calibrated to match.<\/p>\n

I am not suggesting this could never be challenged by a regulator. It could be. But there is a meaningful difference, in my experience advising clients on these matters, between an assessment that invites challenge with nothing to fall back on and one that anticipates challenge and answers it on the page. The methodology and the tool, working together, defended the client’s position. And, importantly, what was in the IRA was reflected in their policies and procedures. The story was consistent across the documents.<\/p>\n

 <\/p>\n

What makes it defensible<\/strong><\/h3>\n

When I step back from the review, the defensibility of this IRA did not come from any single feature. It came from the interlocking presence of several:<\/p>\n