We're looking at starting a risk management department. It would probably include audit, BSA, compliance, information security for starters. Can anyone recommend a good resource to guide in getting this department running?

My advice would be to learn as much as you can and read all you can, dive in and work it out. Not sure of a good site that will give you the information you are looking for as most are tailored to the institution and very subjective. It took 3 attempts at the program and still will not know how well the process works until the end of the 1 q when I conduct our first presentation.

I know at least a couple of the Big 4 websites have free(!) resources relating to risk mangement.

Here's Deloitte's "risk intelligence" page.

Crowe Horwath assisted us by writing the Risk Management Policy and Procedures. Couldn't have set it all up properly without their guidance.

Starting a Risk Management Program? Go to this site www.ficsas.com You can download a free Risk Management Policy.