Are you talking about an enterprise risk assessment? The is (or was) a tool on BOL's site for that - taken from the OCC guidance of several years ago. We have used the OCC guidance for our ERM for several year and supplement it with a "Top 10" list also.