I'm in a small bank..

Is there anyway I can fin a Privacy Risk Assessment to use as a model for my bank?

My first question would be why are you wanting a privacy risk assessment?

It was recommended by Audit.. Should it just be part of the overall compliance risk assessment?

Never had one never will. Not necessary.

Yes

Sometimes there is a reference to "privacy" when what is meant is Information Security. There is a requirement to do an Information Security Risk assessment and that may have been what was meant rather than privacy in the sense of GLB privacy disclosures.

I could see where it might be part of your information security risk assessment. Is audit just recommending it or are they saying you must have one?