Is there anyone that would be willing to share the risk assessment they use to build their annual audit plan? I'm starting from scratch and really struggling.

Send me a pm with your e-mail address and I will share what I have.

I can share one as well, send me a pm.

I have no formal audit training and I am also searching for somewhere to start regarding an audit risk assessment. Would you be willing to share?

I have one that I am willing to share also, pm me if you would like it.

I need some guidance too! I have been trying to put something together and just feel like I am way off base. I am sending a pm.

I have one too...

I am looking to build on the current risk assessment done at our bank. I feel like the one completed in the past is not sufficient. Could anyone issue some guidance or provide an sample risk assessment they use?

You might want to define the scope that you are referring too.

I am referring to the risk assessment used to build the audit plan and audit schedule

No, I meant the scope of the audits you are referring too. Are you referring to the entire bank's audit plan or just compliance. There are some huge differences.

^^^ So true! I don't even use the same format for the operational risk assessments and the compliance risk assessment.

At least you say you are "building" so that means you already have the process in place. Try googling "internal audit risk assessment" if you are looking for help with that side. Almost every big accounting firm has a paper published on the topic as well as books from the IIA and tons of webinar slides. Comparing what you have to some of these "How to improve your RA" writings may get you started on the right track.

Are you thinking you don't have enough risk coverage (kinds of risk) or your risk rating scale is inadequate? Just curious.....and hoping to help more.

And welcome!!!

I do a separate risk assessment for each individual audit area.

We have 72 separate audit areas that the audit committee considers then when reviewing the annual schedule. The audit schedule then plots the 115 audits for the 72 audit areas over the course of a year (or 2 or 3 years depending on the risk that I determine in each area's risk assessment).

This process began in 2002, and took a year for me to complete. Each time I perform an audit, I, along with my audit committee, then also review the risk assessment for that functional audited area to determine if my scope for that specific area lined up in term's of the area's risk.

Now certain areas (BSA, IT, vendor management, ACH, to mention a few) are also required to complete their risk assessments, which I review and also build into my scope.

QCL - that seems like a lot of work involved in preparing the risk assessment and the audit plan. I understand that a lot would depend on the products and services your bank would offer and other compliance considerations. how much time do you spend annually in this process?

I am new to BOL and would be interested in learning a bit more about how you frame your audit universe. I would like to enhance our risk assessment and audit plan. Would you mind sharing your risk assessment with me.

We do Enterprise Risk Management first, followed by a normal risk assessment (any manual or google search should come up with something sufficient, although I'd do a little research because there are different methods that provide different value). The plan gets developed based on the risk assessment for a few years out. We keep compliance and operational risk MOSTLY separate, although it's important to consider regulated issues from an operational risk standpoint as well.

I think this is all pretty standard for community banks in the Midwest from what I have heard/learned.

We base all risk assessments on the same ideas at our bank... identify the risk, impact, likelihood of occurrence, current control risk, and arrive at an overall risk. I personally do everything in risk assessment form. For example, to plan an audit of loans, I identify the steps of a transaction, identify possible errors in each step, and put them in an RA to help steer my audit. I know it sounds time consuming, but because it's what I always do, it's quick. And I think it's valuable. Once it's done once, you just update based on environmental factors...

I am now required to do a separate risk assessment for each individual audit area. Never having done a risk assessment, I am wondering if anyone would like to share their risk assessments for the following areas: BSA, Compliance, Wire Transfers.

Thank you in advance.

I am starting a risk assessment for my company (mortgage lender) and would appreciate it if anyone could share a sample or template of what they are using. As noted above, its hard to get started! Thanks in advance to anyone who might share.

I would be interested in any samples that would be share also. I am working on a bank wide risk assessment which is to drive my audit schedule.

Please PM me if you have any recommendations or samples.