Could someone share the categories that they use in determining the risk ratings for each area to be audited that then feeds into development of the annual aduit plan? For example, strength of internal controls, etc. Thank you.

We use:

Overall Operational Risk
Overall Credit Risk
Overall Market Risk
Liquidity (Funding)
Legal and Compliance
Reputational
Strategic Risk

We then factor in:
Financial Statement Impact
Operational Impact