So as the new IT manager I have been asked about the bank's Risk Assement but also the banks IT Risk Matrix. Digging has shown the bank has not had a RA done for to long so that will have to be done from scratch either by me or we will hire a firm. But the real question of this post, does any one have a sample Risk Matrix or a sample RA with the matrix in it I could look at?

Coming from IT managmenet at a fortune 50 company to a small bank it is shocking how little IT work I do vs how much policy and programs I now write. lol

Thanks we are looking over the info in the links now.

R. Cascarino has an excellent text on building a 3D risk assessment. It's in his 2013 book on internal audits. I believe the specific chapter you need is 9.

I agree on your policy writing sentiment. Though I believe the function of managers should be more supervisory than minutia, it is a shame that previous managers didn't build the policy and structural foundation for the institution. However you are far from alone! Best wishes on getting it write!

I've referred to this document in the past, may be helpful.

http://www.iwar.org.uk/comsec/resources/risk/risk-mgmt.pdf