Risk Assessment Updates

I know that any time our risk profile changes, I need to update my risk assessment. In my past life, I presented those changes to the Board as they occurred. These were not often, and not burdensome. I am now at an institution where changes happen frequently.

Should this go to the Board as the updates occur? Or would an annual presentation be sufficient? I'm looking to see what others are doing. And if it should be presented to the Board as they occur, can anyone point me to the requirement? I have not been able to find anything definitive on board notification - only that my assessment should be accurate.

Thank you!

Are the risks changing to the point that policy changes need to be made? What is causing your risks to change frequently.? Can you provide an example?

New Products and Services. For example - We just introduced Zelle. Prior to that we began offering a new payment system for loan payments that allows internal and external accounts to be used. Those are just a couple.

When the board approved the new products and services, would not the updated BSA risk assessment and any required updates to the board approved BSA/AML policy just be part of that approval? You do not do a BSA Risk Assessment after the fact.

Yes, I follow you. However, I have been newly appointed to this position and this is a program that has been here long before me. The practice has always been to present the assessment once a year - and yes that may be after the fact. Since the program has seemingly worked without a hitch before me, I'm looking to find specific guidance addressing timing to support this change. And of course confirmation for me that I'm not the only one that thinks this (thanks for the sanity check) should occur when the new product or service is approved. Thank you for your help!

Do you do any regular BSA reporting to the board or a committee? I do a quarterly BSA report to Audit Committee and I would highlight any risk changes in that if outside of the regular annual update to the risk assessment, then make sure to update the full assessment at the normal time.

Great idea! Thanks!

Whenever we are looking at a New Product Initiative (NPI), part of that review is a Risk Assessment. That assessment is shared across a broad group - all LOBs, potentially impacted or not, Risk, BSA, Audit, Exec Management, you name it, every corner of the bank is notified (i can't vouch if they are paying attention).

formal, or annual, risk assessments continue as always, the results of those is what it reported to the board.

Thank you so much!