An ABC risk assessment is a structured process used to identify, evaluate, and prioritise corruption risks within an organisation. It typically includes reviewing policies and procedures, conducting stakeholder interviews, assessing jurisdictional and sector risk, and producing a clear risk profile with recommended mitigation actions.

An anti-bribery and corruption (ABC) risk assessment helps organisations understand where and how bribery and corruption risks may arise across their operations, business relationships, and supply chains. By systematically identifying these risks, companies can evaluate their exposure and put in place proportionate mitigation controls to reduce the likelihood of misconduct.

While an anti-bribery and corruption (ABC) risk assessment is not always a statutory requirement, regulators strongly expect organisations to carry out regular, risk-based assessments as part of their compliance obligations. Conducting an ABC risk assessment helps businesses align with anti-bribery laws such as the UK Bribery Act and the US Foreign Corrupt Practices Act (FCPA), demonstrating that  potential bribery and corruption risks have been identified and proportionate controls put in place.

Even when not legally mandated, a structured ABC risk assessment is considered best practice for maintaining an effective anti-bribery programme. It supports compliance monitoring, informs policies and training, and provides evidence to regulators, auditors, and stakeholders that the organisation is proactively managing bribery risks.

It is also increasingly required by investors, helping to boost confidence and support access to capital.

Organisations should conduct anti-bribery and corruption (ABC) risk assessments on a regular basis to ensure their compliance programmes remain effective and aligned with evolving risks. Best practice recommends reviewing risk assessments every 2–3 years. However, they should be updated promptly in response to significant organisational changes, such as mergers and acquisitions, entering new markets, or shifts in regulatory expectations and changes to industry-specific risks.

Regular ABC risk assessments help companies identify bribery and corruption risks, adjust mitigation controls, and maintain a proactive approach to compliance. By embedding periodic reviews into governance processes, organisations can demonstrate to regulators, auditors, and stakeholders that they are actively managing bribery risks and maintaining a robust anti-bribery programme.

The length of an anti-bribery and corruption (ABC) risk assessment depends on the size and complexity of the organisation, the scope of operations, and the level of stakeholder engagement required. Larger or multinational organisations may require more time, with smaller or more focused assessments typically taking less.

An ABC risk assessment requires support and engagement from across the business to ensure it is accurate and comprehensive. Organisations are expected to provide time from key stakeholders for interviews and workshops, access to relevant documentation and internal records, and data on business operations, third parties and compliance activities. Participation in risk workshops is also important to help evaluate and prioritise risks.

An ABC risk assessment provides a set of clear, practical outputs that can be used both internally and with external stakeholders. These include a detailed report mapping bribery and corruption risks across the organisation, a risk register and heatmap categorising risks by impact and likelihood, benchmarking of existing policies and controls against GoodCorporation’s frameworks and tailored recommendations to strengthen anti-corruption procedures.