I am looking for some guidelines are how to
prepare/complete a risk assessment for
audit and compliance purposes. I would appreciate any suggestions or references.

Thank you.

wwmike:

What type of risk assessment? And what departments or functions should be covered? If you can elaborate, perhaps I can guide you.

------------------
Dana Turner
Security Education Systems
danaturner@bankersonline.com
830-535-6500

[This message has been edited by Dana Turner (edited 02-06-2001).]

The Institute of Internal Auditors; Statement on Internal Auditing Standards No. 9 discusses risk assessments.

Try www.theiia.org

[This message has been edited by De Vonne (edited 02-07-2001).]

The ABA Bank Compliance magazine had an article about risk management in its January/February 2001 issue. The article is good. Their number is (800)BANKERS.

I use 9 categories and assign point values to each audit area and auditable unit that I have determined to be worthy of auditing. The categories I use are Human Resource Risk, Reputation Risk, Regulatory/Legal Risk, Regulatory Requirements, Audit/Exam findings and timing, regulatory changes and and any changes in products/services. I addup the scores from each category to come up with a total Risk score.

This risk assessment seems to work well within my organization, generating higher scores for the more risky areas/regulations and lower scores for the less "human" dependant ones.

[This message has been edited by JoAnne (edited 02-07-2001).]

Thanks to everyone for all of the good suggestions! I'm glad I asked.

Just keep on posting if there are more.

Thanks again.

I use a risk assessment model based on 13 factors for each audit area. I rate each of the 13 areas 1,2, or 3 with 3 being highest risk then add them up and divde by 13 to get a total rating. I then reassess the risk areas each time I audit the area. My categories are:

--Financial Exposure (asset accountability)
--Average Transaction Value
--Liquidity of Assets
--Annual Operating Expense
--Contribution to Revenue
--Last Audit Opinion
--Stability of Data Processing Operations
--Complexity of Operation
--Compliance with Applicable Regulations
--Management Team
--Staffing (turnover/effectiveness)
--Potential Adverse Publicity
--Inherent Business Risk

This system works well and can be tailored to fit your size financial institution. Good luck!