Presently, the bank I work for has no risk assessment. I am really having a hard time figuring out where to begin. I've looked at the BOL tools and I know that I can utilize some of them. I'm just trying to figure out how to develop a basic matrix to rate risk with. Does anyone have any suggestions?

Dottie: Look at your community/trade area. How stable is it as far as people coming and going? Are you in a HIDTA or a high risk money laundering area? Is there a college or university in your town that brings in a lot of international students. How's the crime rate in your area and what type crimes are they?

As I understand it, the risk assessment is not supposed to be one size fits all but is supposed to be you thinking of the risks you have and then determining how serious they are and what you can do about it.

Hope this helps you get started.

Thank you for your help. I already know that we are on the HIDTA list. We have several colleges and universities. I'm just looking at a blank sheet of paper when I try to create a matrix.

You can start with all of the factors that would have a risk associated with them:

Location (low risk area, high risk area)
Number of branches (smaller number = lower risk)
Types of customers (domestic, foreign, types of businesses)
Types of deposit products (create a list)
Types of loan products (create a list)
Types of services (create a list)

I'm sure there are a few more risk factors, but my mind is on brain freeze at the moment.

Then across the top, create a risk ranking from 1 - 3 or 1-5, or pick any other scale you are comfortable working with. The lower the number, the lower the risk.

Then for each item on the list, put an "x" in the column where you estimate that risk to be. For instance, savings accounts would be a lower risk, checking accounts would score a higher risk. Domestic wires would be a lower risk, foreign wires would score higher.

Add all of your scores together to come up with a total.

I'm not a math wiz at this part, but I believe you can develop a range of the total score that would be low risk, medium risk, high risk, etc. based on where, numerically, your bottom third scores would be, etc.

I just created a BSA risk assessment very similar to what Bonnie M has suggested. I just had a BSA exam and the FDIC liked it on a "macro" level. They suggested, however, that a more "micro" level assessment should also be done to identify high risk accounts within each product. For example, within your "free checking" customers, how many are not really geographically close to your branch, how many conduct large cash transactions, how many perform international wire transfers, etc. So, I still have some work to do.

If you choose to accept this assignment you might be able to do it by cross referencing your high risk list of customers with your product risk assessment, by using codes. You could code your list of high risk customers for those not in your immediate area, those who bring high cash deposits, generate international wires, etc.

Then a sort by code would give you the high risk customers by product usage.

Kaybee - so you could have an AB negative risk? Oh wait, that's blood type. The two are so easily confused these days.

Theoretically you could if someone is in a high risk industry but has not other high risk product usage or behavior! So they can be in your lowest risk high risk group. I just love this. But, you know, I might just test this. It's not a bad idea for ranking within the high risk customers. But a lot of work.

Quote:

---

They suggested, however, that a more "micro" level assessment should also be done to identify high risk accounts within each product. For example, within your "free checking" customers, how many are not really geographically close to your branch, how many conduct large cash transactions, how many perform international wire transfers, etc.

---

Brad, I think you have been treated with an examiner's individual opinion about how your processs could be "perfected." The function of risk assessment is generally considered to be the development of a formal rationale for how you allocate limited monitoring resources. Arithmetic perfection is not the goal and it's a waste of your time.

I'm surprised that Bonnie doesn't know how many angels can dance on the head of a pin, but you certainly will if you apply this to your entire customer base.

Kaybee's suggestion that it could be used to delimit customers arbitrarily classified as "high risk" is reasonable; it's the premise behind the recent MSB guidance.

I have come up with a basic risk assessment matrix. I don't suppose anyone would be able to look at it and tell me if I'm on the right track. I feel kind of shy about posting it.

Dottie, I would be happy to look at it and offer my thoughts. I will PM you with my e-mail and fax.

I hear you Ken. I think that's exactly the case. My examiner was a BSA specialist and he had a few suggestions to help "strengthen" the program - not that there were violations - just some more suggestions to make it better.

My bank just went through a FRB Examination and went through the Risk Rating Process. First - WOW... so not fun, but as we all know - required.... so this is what we did:

We have Product/Service Risk Assessment:
This went into Policiy overview, Strategic, Reputation, Credit, Transactional, Compliance, and AML Risks.

Then we have another form, which is an additional Risk Assessment that goes over all the areas of our bank, Risk Factors, Mitigating Controls, residual risk and control testing factors.

This was done in a group effort - with all of our management involved.

Brad B. We had the FRB squad here recently as well....I would love to hear what guidance they gave you, if any, to do the risk assessment. Care to talk about it?

I used the OCC's Community Bank Supervision Handbook to prepare my initial "macro" risk assessment although I used a 5-point scale rather than a 3-point scale. They didn't really offer much advice about how to do the "micro" level risk assessment by product. If I do prepare one, it probably won't be soon.

Hi, I would be glad to take a look at your assessment.I just finished mine and will send you a copy....my e-mail is [Email]cgeorge@membersfirstnh.org[/Email]. Regards, Cathy George

Cathy, would you be willing to share your assessment with me? I am new to doing this, and I am looking for something that will work for us.

Thanks!