In a recent audit, we were advised to expand our risk assessment. We were believed to be accurate, but I guess we just need a little more information. It was recommended that we include:

1. Information pertaining to lending activities
2. Information pertaining to monetary sales

Does anyone have any suggestions on where to start with these topics? We have been doing statistical analysis on several topics (we were advised to do so) for a couple of years now. We just aren't sure how to proceed with these. We are probably thinking too much into it. Thanks.

What risks are you looking at? All risks (credit, compliance) or specific risks, AML risk, etc?

All risks-- customer base, geography, products, services, operations (wires, cash, international transactions), BSA, OFAC. Just an overall risk assessment of the bank.

I'm not quite sure what you are looking for, but credit risk generally includes key controls, which can include new loan documentation, policy and regulatory exception tracking and resolution, strength of underwriting/due diligence processes, delinquency monitoring, levels of non-accruals and criticized/classified loans, and other issues determined to be key risk indicators for credit.

Re monetary sales - not sure what is meant by this - sales of monetary instruments? That should be included in a deposit/branch risk assessment as a type of product. controls related to BSA and other regulatory issues would be included.

Thanks Kathleen. We were told that statistical analysis should be performed for our risk assessment in a past audit, which we have done, and we were trying to determine what statistical analysis could be done with these items. It may be one of those areas in which we don't necessarily have an statistical analysis, but just an overview of our risk in those areas. Thanks for your input.

Is the statistical analysis looking at volume (# and $) of transactions, volume (# and $) of exceptions in order to assign an inherent risk level? You could do that in these 2 situations looking at the items I mentioned.

That's a great idea. I've been tracking the volume of loans to deposit ratio, but I hadn't thought about monitoring the exceptions. Thank you.

It would give you an indicator of error rates and strength of controls. If the exceptions are not cleared/resolved, it is just a list and not a control and does not help credit risk.

Another risk indicator for loans that you can track are ratings as % of portfolio (pass including different levels of pass, OAEM, substandard, etc.) and trends. Do the same with non-accruals as % of portfolio, delinquencies, etc. and the trends (increasing or decreasing)

These are all risk indicators for loans.