When considering which risk assessment technique would work best for your agency, consider the following:
Your agency, your risk.
- The final outcome of the risk assessment should be pertinent to your agency, your agency's function, activity, or process.
Many better than fewer.
- Focus on a wide array of techniques instead of a small sampling. A wider array will give you better insight to the risks your agency faces as different techniques foster different outcomes.
Check the personalities at the door.
- Open and honest discussion should be promoted whichever technique is used. Subordinates should feel comfortable disclosing a potential weakness in Internal Controls with Managers without the threat of retribution.
Go Team!
- Assemble an Internal Control team when beginning to evaluate the risks your agency faces. The team should consist of members ranging from all aspects of the organization. Diversity and cross-functional are key words in describing team membership. In small agencies, the team may be 3 or 4 (or fewer) members; larger agencies may have 6-10 (or more) members, depending on the needs of the agency.
Victory!!!
- A successful evaluation will produce a lengthy list of risks. The key objective for the team is to sift through the risks, determine the difference between a legitimate risk and a mere complaint, and to focus on the "vital few" instead of the "trivial many."