Understandably, this can be a daunting task, but I think most would agree that an effective risk assessment is critical. Managers should be expected to evaluate the risks and controls within their scope of authority at least annually. An enterprise-wide compliance-risk management program should be dynamic and proactive.
It should constantly assess evolving risks when new business lines or activities are added, when existing activities and processes are altered or when there are regulatory changes. The process should include an assessment of how those changes may affect the level and nature of risk exposures, and whether mitigating controls are effective in limiting exposures to targeted levels.