Risk Assessment Internal Audit

We are being examined by the OCC. They have asked me to give them an Internal Audit Risk Assessment. I have looked at the model form in bankers tools, but don't know how to go about determining the risks. Can someone assist?

This is what I did and the OCC approved it without question:

1. Listed all the audits performed at the institution.
2. Took all those classified as high risk areas by the OCC and labeled them as high risk. (BSA, etc.)
3. Looked at past audits of each area to determine where short-comings seemed obvious.
4. Looked at relative risk in each of the areas audited in comparison to past performance.
5. Designated the areas as high, moderate or low risk based upon the combination of both internal weakness in the area and the possible penalties, reputational risk, etc. for poor performance.
6. Formatted the calendar based upon the assessment. (High risk, at least annual; moderate risk, at least every second year; low risk, at least every third year.) Note: frequency can also take into consideration the size of the bank and the number of staff performing the audits.

Thank you so much. That helps a lot.

I am still having a hard time with this. It seems there wasn't anything audited last year, so there is nothing to compare to. I just don't know how to get started. I know this sounds like I am dense, but I have had no training in internal audit. I will be going to audit school in May and hopefully it will give me a start in the right direction. Unfortunately the OCC is at the bank now and want this risk assessment by Friday. I would appreciate any other help you could give me. I have been looking for information on the internet, but have not fould much in this area.

Maybe this will give you a head start. If you go to
Auditnet there is a lot of useful programs. Best of luck.

IAA Establishing an Internal Audit Shop

PM me your e-mail address and I will send you a form I used to submit a risk assessment to the audit committee. (I have not had an examiner review of this risk assessment yet, but it may give you a starting point.)

Quote:

---

I am still having a hard time with this. It seems there wasn't anything audited last year, so there is nothing to compare to. I just don't know how to get started. I know this sounds like I am dense, but I have had no training in internal audit. I will be going to audit school in May and hopefully it will give me a start in the right direction. Unfortunately the OCC is at the bank now and want this risk assessment by Friday. I would appreciate any other help you could give me. I have been looking for information on the internet, but have not fould much in this area.

---

If you are going to the ICBA audit school, there is a great sample risk assessment in their program to start with. I used it to build my audit program last year and the FDIC thought it was very good. I could send it to you, if you would like. Of course, you would have to adapt it to your bank's needs.