Compliance Review Rating System

Good Afternoon,

Currently our institution is in the process of revamping our monitoring reports that complete after conducting a regulatory review. In the past what we have done is choose a compliance rating based on the number of errors found in the review. However, as part of the revamping process, we would like to do more of a risk based rating system, where certain errors hold more weight than others depending on the risk to the Bank.

I am just curious what other institutions do, hoping to get idea for our new structure. All help is greatly appreciated.

We utilize a risk based approach. We also use the same rating methodology for internal audits as for compliance audits.