I know it is up to how far an institution wants to take these things but I really feel like it's a waste of time to be overly concerned with areas of lower risk. We have just started doing risk assessments after our regulator mandated we do them for BSA and CIS. Obviously these are high risk areas that need to be kept under control, but is it worth the use of resources to do these on every policy. I don't think so... I need a good argument.