(a) Assessment and understanding of risks

15. Sound risk management [See in particular BCP 15 in Core principles for effective banking supervision, September 2012 as well as Principle 6 in Corporate governance principles for banks, July 2015.] requires the identification and analysis of ML/FT risks present within the bank and the design and effective implementation of policies and procedures that are commensurate with the identified risks. In conducting a comprehensive risk assessment to evaluate ML/FT risks, a bank should consider all the relevant inherent and residual risk factors at the country, [Where appropriate, AML/CFT risk assessments at a supranational level should be taken into account.] sectoral, bank and business relationship level, among others, in order to determine its risk profile and the appropriate level of mitigation to be applied. The policies and procedures for CDD, customer acceptance, customer identification and monitoring of the business relationship and operations (product and service offered) will then have to take into account the risk assessment and the bank's resulting risk profile. A bank should have appropriate mechanisms to document and provide risk assessment information to competent authorities such as supervisors.