Internal and external events that could affect achievement of a company's objectives must be identified and measured, and a distinction must be made between risks and opportunities. Opportunities are channeled back to management's strategic-planning or objective-setting processes. •  Risk assessment. The likelihood and the potential impact of various risks are analyzed, as a basis for determining how the bank should manage risks.
Risks are assessed on an inherent and a residual basis. •  Risk response. Management selects risk responses--avoiding, accepting, reducing, or sharing risk--and develops a set of actions to align risks with the organization's risk tolerances and risk appetite. •  Control activities. Policies and procedures are established and implemented to help ensure that the desired risk responses are effectively carried out.