Firms should ensure that their business-wide risk assessment is tailored to their business profile and takes into account the factors and risks specific to the firm’s business, whether the firm draws up its own business-wide risk assessment or contracts an external party to draw up its business-wide risk assessment. Similarly, where a firm is part of a group that draws up a group-wide risk assessment, the firm should consider whether the group-wide risk assessment is sufficiently granular and specific to reflect the firm’s business and the risks to which it is exposed as a result of the group’s links to countries and geographical areas, and complement the group-wide risk assessment if necessary. If the group is headquartered in a country associated with a high level of corruption, the firm should reflect this in its risk assessment even if the group-wide risk assessment stays silent on this point.