An agency needs a plan to identify both external and internal risks. The plan will help management understand how those risks affect their activities, assess their significance, manage their effect, and provide for continuous monitoring. Risk identification can often be integrated with an organization s planning activities. External risks arise from activities outside the agency. Technological developments, changing public expectations, legislative directives, natural catastrophes and economic changes all have the potential for creating external risks in an agency.
Internal risks are less predictable and arise from activities inside the agency.
Disruption of the central computer system or telephone system causes obvious operational problems. When a new agency director is appointed, changes in management style can affect internal control objectives. Identification of risks can start from existing systems. More informal opportunities include senior management planning meetings, meetings with management analysts or auditors, and everyday interaction with staff. More important than the specific method used to identify risks is management s careful consideration of factors unique to the agency.