The ML/TF risk assessment must be reviewed to identify new or changed risks when there is a significant change to any matter in s 26C(3), when AUSTRAC communicates risk information to the entity, when the Rules require (Rules 5-1: an independent evaluation report with adverse findings on the risk assessment, reviewed as soon as practicable after the governing body receives the report), and in any event at least once every 3 years. A change within the entity's control must be reviewed before it occurs; one outside its control, or AUSTRAC information, as soon as practicable afterwards. The review is proportionate to the business, and the assessment must be updated to address issues found: before a controlled change occurs, otherwise as soon as practicable after the review.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.