Risk Assessment Considerations

3/17/2011

By Daniel C. Dibella, CPA

As the 2010 financial statement and tax season winds down, banks should begin their 2011 risk assessment process if not already started. Risk assessments should be designed to identify and measure the risks impacting a bank, and to identify the risk areas for which management, internal control and audit efforts will be prioritized. Following are some key matters to consider in the risk assessment process:

Operations

• Are there new products or services lines?
• Are there significant changes in the volume of existing products or services?
• What is the complexity of each area of operations?
• Have there been significant changes in operating policies and procedures?
• How significant is each area of operations to the bank as a whole?
• Are there new branches or facilities?
• How centralized/decentralized are operations?

Personnel

• Are there significant changes in management and employee staffing levels?
• Has there been significant management and employee turnover?
• What is the quality and experience of management and employees?
• Are there significant changes in organizational structure?
• Are there any functions outsourced to third party vendors?

Systems

• Are there changes in software and processing systems?
• Which software and systems are provided internally and which are provided by third party service providers?

Standards and Regulations

• Are there new laws or regulations applicable to the bank?
• Are there new accounting standards applicable to the bank?
• Are there any matters noted in regulatory examinations that warrant attention?
• Are there any matters noted in communications from external auditors and consultants that warrant attention?

Risk Type and Functional Area

• Are risks considered by type (e.g. legal, compliance, reputation, fraud, operations, accounting & reporting, etc.)?
• Are risks considered across functional areas (e.g. lending, treasury, deposits, trust & fiduciary, information systems, back-room operations, accounting & reporting, etc.)

The items listed above are some of the key items that should be considered when performing a risk assessment, but are by no means an all-inclusive list of everything that can, or should, be considered. The nature and extent of risk assessments should be unique to each bank’s circumstances, but the risk assessments should ultimately guide each bank’s management, internal control and audit efforts.