US OFAC Sanctions Compliance Framework RA.II: Use a documented methodology to identify, analyse and address risks, updated from testing and audit findings

Risk assessment II: the organisation has a methodology to identify, analyse and address the particular risks it identifies, updating the assessment for the conduct and root causes of apparent violations or systemic deficiencies found, for example through testing or audit.