There is no established template for documenting compliance risk. Each institution should develop a risk assessment that fits its risk profile. The components that are commonly used throughout the industry are as follows EXCEPT:

The documentation of a compliance risk assessment focuses on identifying, measuring, and monitoring risk. Common components include identifying inherent risks, assessing the effectiveness of controls, and determining the residual risk level. Measuring Key Risk Indicators (KRIs) and identifying Key Performance Indicators (KPIs) for controls are standard methods used within this documentation. However, training the leadership is a risk mitigation activity or a control, not a component of the risk assessment document itself. The document would assess the effectiveness of training, but the act of training is external to the document.

A: While poorly worded, "risk assessment" likely refers to the core process of identifying and rating inherent and residual risks, a key component. B: Measuring KRIs is a standard component for monitoring the level of risk documented in the assessment. C: Identifying KPIs is a standard method for measuring the effectiveness of controls, which is a core part of the risk assessment.

1. Office of the Comptroller of the Currency (OCC). (2023, October). Comptroller's Handbook: Corporate and Risk Governance. Section: "Risk Assessment," pp. 17-18. The handbook details the risk assessment process, including identifying inherent risk, evaluating risk management activities (controls), and assessing residual risk. Training is cited as a control, not a component of the assessment document.

2. Federal Reserve System. (2021). Consumer Compliance Handbook. Section: "Compliance Management System," p. 12. The handbook describes the risk assessment process as identifying and measuring risk in products and services. It does not list training as a component of the assessment documentation itself.

3. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. This framework, widely used in banking, outlines risk assessment components like risk identification and analysis. Control activities, such as training, are a separate component of the overall ERM framework, not a part of the assessment documentation.