Every bank examination begins with the same question: does this institution understand its own risk? Risk assessments for banks map where an institution has exposure, what controls are in place, and how much risk remains.
Conducted inconsistently across departments, a bank’s risk assessments can create gaps that examiners notice quickly. Other examples include:
- A BSA/AML assessment completed annually but never updated for new products.
- A cybersecurity assessment not revised since a core system replacement.
- A credit risk assessment that lists controls but doesn’t evaluate whether they function.
These scenarios appear in Matters Requiring Attention across examinations of all institution sizes. What follows covers the types of risk assessments banks and credit unions must conduct, the FFIEC three-component framework that structures most of them, and what examiners look for when they review the documentation.
What Is a Risk Assessment in Banking?
In a banking regulatory context, a risk assessment is a structured, documented evaluation of the risks an institution faces in a specific area. Assessment is an input that defines what the organization’s risk program needs to address.
Federal banking agencies (the OCC, FDIC, and Federal Reserve) operate under a risk-based supervisory model. Examiners use risk assessments to determine where to focus examination resources. Institutions that document their risk profile credibly tend to receive a narrower, more focused examination scope.
The FFIEC sets examination standards for most U.S. banking risk assessment types through its interagency examination manuals. The core methodology is consistent:
- Identify inherent risk
- Evaluate controls
- Determine residual risk
The FFIEC Three-Component Risk Assessment Framework
Compliance teams commonly apply the same three-component risk assessment framework for banks used across other risk types because it reflects how examiners evaluate risk.
Component 1 — Inherent Risk
Inherent risk is the level of risk present before any controls are applied. For BSA/AML, the FFIEC manual identifies four primary categories:
- Products and services
- Customers and entities
- Geographic locations
- Transaction channels
An institution offering international wire transfers, serving money service businesses, and operating in high-risk geographies carries high inherent BSA/AML risk. Examiners evaluate whether the inherent risk assessment is comprehensive and current.
Component 2 — Risk Management Controls
Controls are the policies, procedures, systems, monitoring programs, and training in place to manage inherent risk. The controls assessment asks: given the inherent risk profile, are the controls appropriate and operating as intended?
A common examination finding is the gap between documented controls and functioning controls. An institution may list a transaction monitoring system as a control but have never validated its alert thresholds against the actual customer risk profile. That gap is precisely what this component is designed to surface.
Component 3 — Residual Risk
Residual risk is the level of risk remaining after controls are applied. Board and audit committee reporting typically focuses on residual risk because it reflects the institution’s actual position after management systems are accounted for.
Strong controls applied to high inherent risk can produce an acceptable residual risk profile. The practical implication: risk assessment findings should drive compliance program priorities and resource allocation.
Types of Risk Assessments Banks Must Conduct
Financial institutions typically conduct eight to ten distinct risk assessments, each tied to a specific regulatory requirement. The scope and frequency of each should reflect the institution’s size, complexity, and risk profile.
BSA/AML risk assessment
Required by the FFIEC BSA/AML examination manual and FinCEN customer due diligence rules. Covers products, services, customer types (including high-risk designations such as money service businesses and politically exposed persons), geographic footprint, and transaction channels.
The 2026 proposed AML/CFT program rule from FinCEN, OCC, and FDIC would formalize this requirement in program rules. Typically reviewed at least annually and updated for material business changes.
Credit risk assessment
Evaluates loan portfolio quality, underwriting standards, concentration levels, and borrower creditworthiness. OCC, FDIC, and Federal Reserve credit examination guidance sets supervisory expectations. Connects directly to allowance for credit losses under the Current Expected Credit Loss (CECL) standard.
Operational risk assessment
Covers losses from failed internal processes, systems, people, or external events. Typically encompasses business continuity, internal control failures, technology outages, and fraud. Informs business continuity plans and internal audit priorities.
Compliance risk assessment
Evaluates exposure to violations of applicable laws and regulations, including ECOA, TILA, RESPA, CRA, and HMDA. The OCC Comptroller’s Handbook on compliance management sets out what examiners expect:
- Systematic identification of compliance requirements
- Exposure assessment
- Control evaluation
- Remediation tracking
Cybersecurity and IT risk assessment
Evaluates threats against technology systems, data, and operational continuity under the FFIEC IT Examination Handbook. The current standards reference the FFIEC’s updated cybersecurity guidance and the NIST Cybersecurity Framework.
Interest rate risk assessment
Evaluates earnings and economic value sensitivity to changes in interest rates. The ALCO typically governs this assessment, supported by scenario analysis and stress testing across rate shock scenarios.
OCC and FDIC guidance requires board-approved policies and independent model validation for institutions with significant interest rate exposure.
Liquidity risk assessment
Evaluates the institution’s ability to meet obligations under normal and stressed conditions. Larger institutions subject to Basel III must address the Liquidity Coverage Ratio. FDIC and OCC supervisory guidance requires contingency funding plans and documented analysis of funding sources, concentrations, and stress scenarios.
Model risk assessment
The OCC, Federal Reserve, and FDIC issued interagency updated model risk management guidance in April 2026 (OCC Bulletin 2026-13) clarifying that governance should be tailored to institution size, complexity, and model risk profile.
Requires a model inventory, validation against each model’s intended use, ongoing performance monitoring, and gap identification in the development and validation process.
Third-party and vendor risk assessment
Evaluates risks from vendors, service providers, and others with access to institution systems or performing functions on its behalf. The 2023 Interagency Guidance on Third-Party Relationships establishes the current framework, covering three phases: pre-contract due diligence, ongoing monitoring, and termination planning.
Fair lending risk assessment
Evaluates compliance with ECOA, the Fair Housing Act, and related laws. In 2026, the OCC shifted from requiring fair lending risk assessments during every supervisory cycle to a risk-based approach calibrated to the institution’s actual fair lending profile.
How to Conduct Risk Assessments: Step by Step
Regardless of risk type, effective bank risk assessments follow a consistent methodology aligned with agency guidance.
- Identify the risk type, applicable regulatory requirements, and the organizational units and activities covered.
- Catalog the products, services, customer types, geographies, and channels relevant to the assessment using internal data, transaction analysis, and business unit input.
- Document policies, procedures, systems, and monitoring programs. Assess whether each control is designed appropriately and operating as intended.
- Combine inherent risk with control effectiveness to produce a residual risk rating.
- Include scope, methodology, data sources, assumptions, findings by risk category, and overall risk rating.
- Report risk assessment results to senior management and, for material risk areas, to the board or audit committee.
- Annual review is the minimum standard under most agency guidance; updates should be triggered by material business changes.
- Findings should drive monitoring priorities, internal audit scheduling, staffing decisions, and budget allocations.
Frequently Asked Questions
How often should banks conduct risk assessments?
Most regulatory guidance establishes annual review as the minimum, with updates required for material changes:
- New product launches
- Significant customer onboarding
- Mergers
- Regulatory changes
BSA/AML risk assessments are particularly sensitive to business changes; the FFIEC expects them to reflect the current risk profile.
What is the difference between inherent risk and residual risk?
Inherent risk is the exposure an institution carries before any controls are applied. Residual risk is what remains after controls, policies, monitoring, and training are factored in. The gap between them measures control effectiveness.
Examiners assess both: high inherent risk paired with strong, validated controls can produce acceptable residual risk; even moderate inherent risk with weak controls can produce an unacceptable residual risk profile.
Are risk assessments required by regulators?
Yes. Multiple federal banking agencies require documented risk assessments as part of their supervisory programs. The FFIEC BSA/AML examination manual sets explicit requirements.
The OCC, Federal Reserve, and FDIC’s 2026 interagency model risk guidance requires model risk assessments calibrated to institution complexity. The proposed 2026 AML/CFT program rule would formalize risk assessment requirements across FinCEN-regulated institutions.
What happens if a bank’s risk assessment documentation is inadequate?
Examiners may cite deficiencies through Matters Requiring Attention (MRAs) or, for more serious gaps, Matters Requiring Immediate Attention (MRIAs). Persistent weaknesses can lead to formal enforcement actions, formal agreements, or consent orders, depending on severity and history.
For institutions subject to OCC heightened standards, expectations for risk assessment rigor are particularly detailed.
For institutions managing risk assessments across multiple departments, centralizing documentation, control tracking, and board reporting in a risk management platform closes the documentation gaps examiners most commonly cite.
Risk management platforms such as Predict360 address this by consolidating risk assessment workflows, control tracking, and board-level reporting, providing the audit trail that regulators expect to see.
Discover AI-powered technology that helps manage every aspect of risk and compliance, all in one platform.
Request Demo- Risk Prediction
- Regulatory Tracking
- Workflow Automation
- Integrated GRC