Does anyone know of a good guide for making a risk assessment of IT? For all the other areas (credit, mgt, liquidity, assets...) I use the Community Bank Supervision Comptroller's Handbook... However, it doesn't cover IT...

Try www.fdic.gov and look under Technology Regulations and Publications for Financial Institutions.