Risk management is certainly one of our major concerns when we prepare our RAs but I realized just recently that we talk about risk management and the ways to mitigate the risks using Appendix J. What puzzles me most is that we don't actually identify the known risks based on our experience and the experience of other FIs. Where can I access a comprehensive list of the risks that we are supposed to be managing. Even examiners haven't asked us to identify the actual risks by category or type of activity. We haven't put the horse in front of the cart yet.

Great forum - it will be good to monitor and participate!

No one has such a comprehensive list yet, and no one has those few metrics that we all can use to supplement our combination of facts, intuition and judgment. One project that looks promising is the Key Risk Indicators project (http://www.kriex.org/Default.aspx?BrowserCheckPassed=1 ) underway, managed jointly by the Risk Management Association and RiskBusiness International. Its latest newsletter (June 2007) says that its Compliance Working Group is just starting up. At $18,500 for the first year, the existing operational risk library subscription is rather expensive, but the project itself seems promising.

This article describes some of the dilemmas: http://www.kriex.org/InterestingReading/The%20trouble%20with%20KRIs.pdf

The OCC's Community Bank Supervision handbook from July 2003 lists nine different types of risk. There is also an appendix from March 2005 that goes into more detail about each type of risk and examples of high-moderate-low practices. I started there but I'm not getting the warm fuzzies that this handbook has all the answers.

Interest rate
Credit
Liquidity
Price
Foreign Exchange
Transaction
Compliance
Strategic
Reputation

http://www.occ.treas.gov/handbook/SS.htm

Many of the specific risks are in the OCC's topic specific handbooks. Others are arrived at by going through your own "what could go wrong, what has gone wrong" process.