An enterprise risk assessment (ERA) is the foundation of a bank's compliance program for anti-money laundering (AML) and Office of Foreign Assets Control (OFAC) regulations. A risk assessment should be seen as an organic component of a healthy and well-functioning financial institution.

Often viewed as an onerous regulatory requirement, a risk assessment is in fact a valuable tool that provides senior management and boards of directors with data that support strategic growth in a controlled environment designed to optimize risk.

When compliance is viewed instead as a checklist function rather than an organic part of an institution's operation, there is likely to be inadequate training, monitoring, budget, staffing and observance of best practices – a recipe for disaster.

An institution's risk assessment is used by bank examiners to plan their examination and establish its scope. It allows examiners to determine the adequacy of the bank's risk management capabilities and points out areas of potential weakness. A well-executed risk assessment affords management the opportunity to address gaps and weaknesses proactively – avoiding potential enforcement penalties.

Having a solid risk assessment and compliance program also sends a strong message to regulators that the institution is dedicated to good governance and compliance. It assures that all reasonable measures to prevent infractions have been taken.

Beyond showing compliance, a risk assessment is an excellent way to capture in detail the bank's "risk profile." It not only satisfies regulatory requirements, but it identifies valuable information that can be used by the bank to strategically align risk with the institution's risk appetite.

A well-executed risk assessment allows an institution to maximize acceptable risk and thereby maximize potential profit, building shareholder value.