This documentation includes any checklists and methods used to complete these activities. A risk assessment is an ongoing process to identify, analyze, and manage risk. An agency needs a plan to identify both external and internal risks. The plan will help management understand how those risks affect their activities, assess their significance, manage their effect, and provide for continuous monitoring. Risk identification can often be integrated with an organization s planning activities.
External risks arise from activities outside the agency.
Technological developments, changing public expectations, legislative directives, natural catastrophes and economic changes all have the potential for creating external risks in an agency. Internal risks are less predictable and arise from activities inside the agency. Disruption of the central computer system or telephone system causes obvious operational problems. When a new agency director is appointed, changes in management style can affect internal control objectives. Identification of risks can start from existing systems.