For a community bank, it can start to feel like everything comes back to a risk assessment. Information security, disaster recovery, identity theft, remote deposit capture, outsourcing: the term “risk assessment” shows up 215 times across the FFIEC IT Examination Handbooks. A risk assessment is only one step in a five-step risk management process, and it isn’t even the first one.

Regulators often use “risk assessment” and “risk management” almost interchangeably, and that blurs something important. Assessing risk matters, but if the assets being protected haven’t been identified correctly first, the assessment is aimed at the wrong target. Once the right assets are identified and the risk to them is assessed, the next job is building a system of controls that avoid, reduce, and transfer that risk down to a level the institution can live with. The environment around those risks and controls never sits still, so the work repeats.

There’s no single industry standard for documenting any of this, either. A standardized process would have made life on both sides of the exam table considerably easier, and that kind of standardization would have been a natural outcome of Dodd-Frank, one that could have served institutions, regulators, and the public alike. It didn’t happen.

Most banks end up leaning on the FFIEC handbooks instead. The term “risk assessment” appears there often, but “risk management” appears even more, 303 times across the handbooks. The essential elements of an effective risk management program are:

1. Identify the assets to be protected. What’s being protected, whether that’s customer information or a critical business process, and why it matters: privacy, security, or something else entirely.
2. Identify the threats to those assets. What could happen to the assets named in step one? Rank the threats by both impact and probability. This is the traditional risk assessment step.
3. Apply controls. Layer them so they overlap, until the risk is reduced to an acceptable level.
4. Test the controls. Confirm they’re both adequate and effective, not just on paper.
5. Monitor and repeat. Watch the program on a regular schedule, and run the process again as things change.

How this gets documented is up to the institution. Some build a matrix. Others write a narrative. A lot of banks end up with both, cobbled together over years rather than designed from scratch. What matters is that all five elements show up in the process, every time.

So the next time an examiner or auditor asks for a risk assessment, what they’re really asking about is one piece of a bigger risk management program. Deliver it as part of that whole program, and the answer holds up.