Internal Audit Guide · The Risk Library
Every major risk, taken apart.
Deep, practical guides to every major risk internal audit covers — credit, market, interest-rate, liquidity, operational, compliance, model, fraud, and more. Each risk gets the same treatment: what it is, how it’s measured and managed, and how to audit it.
The library is organized the way risk actually splits in practice: the financial-sector risks that dominate banks, insurers, and asset managers, and the cross-industry risks every organization carries — all anchored by risk management and ERM as the framework on top.
- 12 risk categories
- A working primer on risk itself
- The ERM framework
- How to audit each one
First principles
Risk, in plain terms
Strip away the jargon and risk is simply the effect of uncertainty on objectives — the possibility that what actually happens differs from what you planned, in a way that matters. That definition (it’s essentially ISO 31000’s) hides three useful ideas. First, risk is tied to objectives: nothing is risky in the abstract, only relative to something you’re trying to achieve. Second, risk lives in the future — once it happens, it’s not a risk anymore. Third, the effect can cut both ways: most risks organizations track are downside, but strategic risk in particular includes the upside you fail to capture.
Practitioners size a risk on two main dimensions — likelihood (how probable) and impact (how bad if it lands) — often with a third, velocity (how fast it hits once triggered). That’s what every risk heat map plots. Heat maps are a fine starting point and a poor ending point: they compress fat-tailed realities into tidy squares, ignore how risks aggregate, and can’t show that a “low likelihood” event with catastrophic impact may matter more than everything else on the chart combined. Use them to prioritize conversation, not to end it.
Inherent vs. residual: where the whole game is played
The single most useful distinction in risk work is between the risk you’d face with no defenses and the risk you actually live with:
Inherent risk
The raw exposure before any controls or mitigation — the risk in the activity itself.
→ Controls & risk management
Everything the organization does about it — controls, limits, hedges, insurance, monitoring, governance.
→ Residual risk
What’s left after the defenses — the number that gets compared against risk appetite.
Internal audit lives in the middle box. Most audit work is testing whether the controls that are supposed to turn inherent risk into acceptable residual risk are well designed and actually operating. When auditors say “design effectiveness” and “operating effectiveness,” that middle box is what they’re talking about.
Risk, issue, incident — not the same thing
Sloppy vocabulary causes real confusion in risk committees and audit reports alike, so keep these apart: a risk is something that could happen; an incident (or loss event) is a risk that did happen; an issue is an identified weakness — a broken or missing control — that makes a risk more likely, whether or not anything has gone wrong yet. Auditors mostly raise issues; risk managers track risks; operational-risk teams log loss events. All three feed the same picture, but they are different objects with different owners and different clocks.
Risk is not the enemy
One mindset error shows up constantly in weaker audit functions: treating all risk as bad. Businesses are paid to take risk — a bank earns its margin by taking credit risk, an insurer by underwriting risk, a startup by strategic risk. The goal of risk management is not elimination; it’s making sure the organization takes the risks it is paid to take, knowingly and within appetite, and avoids the ones it isn’t. The sharpest audit functions internalize this: the question is rarely “is there risk here?” (there always is) but “is this risk understood, chosen, measured, and controlled to the level the board signed up for?”
How the risk universe gets organized
There is no single official taxonomy of risk — every organization, framework, and regulator slices the universe a little differently, and arguments about the “right” categories are mostly wasted energy. What matters is that a taxonomy is reasonably complete, that every category has an owner, and that it stays stable enough to trend over time. The most common cuts you’ll meet: the financial vs. non-financial split this library uses; Basel’s capital trio of credit, market, and operational risk; US bank supervisors’ examination categories (the OCC works with eight — credit, interest rate, liquidity, price, operational, compliance, strategic, and reputation); and the classic corporate ERM quadrant of strategic, operational, financial, and compliance risk.
Here’s how this library’s twelve sections line up against those maps:
| This library | OCC risk stripe | Basel view | Corporate ERM bucket |
|---|---|---|---|
| Risk Management & ERM | Spans all — the framework | Governance / Pillar 2 | The ERM program itself |
| Credit Risk | Credit | Credit (Pillar 1 capital) | Financial |
| Market Risk | Price | Market (Pillar 1 capital) | Financial |
| Interest-Rate Risk & ALM | Interest rate | IRRBB (Pillar 2) | Financial |
| Liquidity Risk | Liquidity | Liquidity standards (LCR / NSFR) | Financial |
| Operational Risk | Operational | Operational (Pillar 1 capital) | Operational |
| Compliance Risk | Compliance | Within operational for capital; its own discipline in practice | Compliance |
| Model Risk | Cross-cutting (SR 11-7 guidance) | Within operational / governance | Operational & financial |
| Fraud Risk | Within operational | Operational-risk event types (internal & external fraud) | Operational |
| Strategic Risk | Strategic | Not capitalized — Pillar 2 / supervisory review | Strategic |
| Reputation Risk | Reputation | Not capitalized — Pillar 2 / supervisory review | Strategic |
| Business Continuity | Within operational (resilience) | Operational resilience | Operational |
Mappings are directional, not gospel — regulators’ categories overlap, Basel treats liquidity through standards rather than capital, and model risk in the US is framed by supervisory guidance (SR 11-7) rather than a category of its own. The point of the table is orientation: whichever map your organization uses, you can find the shelf here.
Where do “emerging risks” fit?
Climate, AI, third-party dependency, geopolitics — the emerging-risk lists grow every year, and the temptation is to bolt a new top-level category onto the taxonomy for each. Usually that’s wrong. Most emerging risks are new drivers flowing through the same old categories: climate risk arrives as credit risk (collateral values), operational risk (physical damage), and strategic risk (transition exposure); AI arrives largely as model risk, third-party risk, and compliance risk. A taxonomy that sprouts a new bucket every time the headlines change can’t be trended — map the new driver through the categories it actually hits, and keep the shelves stable.
The framework
Start with the framework
Before the individual risks: how organizations identify, measure, and govern risk as a whole — and where internal audit fits.
Risk Management & ERM
The umbrella discipline — risk identification and assessment, enterprise risk management, frameworks and methodologies, and internal audit’s role in the risk governance structure.
Start with:
Newly added to the library
- Auditing the Underwriting Process: Where Credit Risk Is Born and How to Test It — policy versus practice, exceptions and overrides, approval authority, appraisals and covenants, with a worked bank engagement
- Auditing Trading Floor Controls: Limits, Confirmations and the Rogue Trader Playbook — limits and breach escalation, trade capture, confirmations, cancel-and-amend red flags, mandatory leave and what the classic failures teach
- How to Run a Strategic Risk Assessment: Surfacing the Bet-the-Company Risks — deconstruct the strategy into assumptions, test them with evidence and workshops, set signposts and report without second-guessing the CEO
- Liquidity Stress Testing: Scenarios, Horizons and the Death Spiral Dynamics — scenario design, survival horizons, the deposit-run and fire-sale loop, and how to audit the stress framework
- PD, LGD and EAD Explained: The Building Blocks of Credit Risk Measurement — the three parameters, how they combine into expected loss, the Basel floors, and what to test in each
- SR 11-7 and SR 26-2 Explained: The Model Risk Guidance, From 2011 to 2026 — what changed when the 2026 guidance replaced SR 11-7, and what a model risk audit tests now
- Building an Operational Risk Framework: Taxonomy, Tools and Governance — loss data, RCSAs, KRIs, scenarios and the governance that holds them together, with a worked rebuild
- Board Risk Reporting: The Quarterly Risk Pack That Directors Actually Read — what belongs in the pack, how to size it, and how internal audit assures the numbers directors rely on
The language of risk: appetite, limits, and measurement
Risk conversations run on a small set of terms that are used precisely by good functions and interchangeably by weak ones. The most important is the appetite ladder — four nested concepts that connect the board’s intent to a trader’s or underwriter’s daily reality:
| Term | What it means | Who sets it | Example (a consumer lending book) |
|---|---|---|---|
| Risk capacity | The maximum risk the organization could absorb before breaching capital, liquidity, or regulatory constraints | Determined by the balance sheet and regulators | Capital could absorb charge-offs up to 8% before minimums are threatened |
| Risk appetite | The amount and type of risk the organization is willing to take in pursuit of strategy | Board, on management’s proposal | “Grow consumer lending with through-the-cycle charge-offs at or below 3%” |
| Risk tolerance | The acceptable variation around appetite for a specific risk or metric | Senior management / risk committee | Charge-offs may range 2.5–3.5% before escalation |
| Risk limits | Hard operational caps that make appetite real at desk, portfolio, or counterparty level | Risk function, delegated downward | No single obligor above $25m; minimum credit score at origination |
An appetite statement that never cascades into tolerances and limits is a poster, not a control — and the cascade (or its absence) is one of the most productive things an internal auditor can test.
The measurement toolkit, in one paragraph each
Expected vs. unexpected loss. Expected loss is the average you plan for — it belongs in pricing and provisions. Unexpected loss is the bad-year deviation — it’s what capital exists to absorb. Confusing the two is how organizations end up “profitable” right up until they aren’t. Credit risk formalizes this with PD × LGD × EAD — probability of default, loss given default, exposure at default — the three numbers behind nearly every modern credit model and allowance estimate.
VaR and Expected Shortfall. Value at Risk says “on 99 days out of 100 we shouldn’t lose more than $X.” Expected Shortfall asks the better question: “and on the hundredth day, how bad is it on average?” Both are only as good as their assumptions, which is why backtesting — counting how often reality beat the model — is itself a control auditors should look for.
Stress testing vs. scenario analysis. Related but distinct: stress testing pushes the portfolio through defined severe-but-plausible shocks (rates up 300bp, unemployment to 10%); scenario analysis builds narrative what-ifs, often for risks without rich data. The most revealing variant is reverse stress testing — start from “what would break us?” and work backwards to how it could happen.
KRIs vs. KPIs. A key performance indicator tells you how the business is doing; a key risk indicator warns you risk is building before losses arrive — attrition in a control team, aging reconciliation breaks, limit utilization creeping toward 100%. The best KRIs are leading, not lagging, and every risk category on this page has its own natural set.
The whole library on one page
Every shelf in the library, with the numbers each risk runs on and where internal audit usually digs:
| Risk | In one line | The numbers it runs on | Where internal audit digs |
|---|---|---|---|
| Risk Mgmt & ERM | How risk is governed enterprise-wide | Appetite metrics, top-risk reporting, RCSA coverage | Framework design, appetite cascade, committee effectiveness |
| Credit | Borrowers or counterparties fail to pay | PD / LGD / EAD, delinquencies, non-performing loans, allowance (CECL / IFRS 9), concentrations | Underwriting discipline, rating accuracy, allowance models, problem-loan workout |
| Market | Prices move against your positions | VaR / Expected Shortfall, sensitivities (the “Greeks”, DV01), backtesting exceptions, limit utilization | Limit framework, independent price verification, model backtesting, desk mandates |
| Interest-Rate & ALM | Banking-book value and earnings vs. rate moves | EVE and NII sensitivity, repricing / duration gaps, deposit betas | Behavioral assumptions, ALCO governance, hedge effectiveness |
| Liquidity | Can’t meet obligations when they come due | LCR, NSFR, survival horizon, funding concentration | Stress assumptions, contingency funding plan, collateral operations |
| Operational | Failed people, processes, systems, or external events | Loss events, RCSA results, KRIs, issue aging | Control design and operation, loss-event capture, remediation quality |
| Compliance | Breaking laws, regulations, or internal rules | Violations, exam and regulatory findings, training completion, alert backlogs | Program elements, AML / KYC testing, regulatory change management |
| Model | Models are wrong, or right models are misused | Model inventory and tiering, validation findings, overrides, performance drift | Validation coverage (SR 11-7), assumptions, use and change controls |
| Fraud | Deception for gain, internal or external | Fraud losses, red-flag indicators, whistleblower volume | Anti-fraud controls, segregation of duties, investigation protocols |
| Strategic | The wrong plan — or the right plan, poorly executed | Plan-vs-actual, market position, initiative milestones | Assumption challenge, execution governance, board reporting |
| Reputation | Stakeholder trust erodes | Complaints, sentiment and media signals, client and staff attrition | Crisis readiness, conduct programs, disclosure practices |
| Business Continuity | Operations can’t continue through disruption | RTO / RPO, test results, recovery exercise findings | Plan realism, testing rigor, third-party dependencies |
The balance sheet
Financial-sector risks
The balance-sheet risks at the heart of banks, insurers, and asset managers — where regulators expect internal audit to go deepest. (For how US bank supervisors carve up this universe, see the OCC’s eight risk stripes.)
Credit Risk
The risk that borrowers and counterparties don’t pay — underwriting, portfolio quality, allowances, and how internal audit tests credit risk management end to end.
Start with:
Market Risk
Losses from moves in prices and rates — trading and banking book exposure, VaR and its limits, and what auditors should test in market risk management.
Start with:
Interest-Rate Risk & ALM
Rate risk in the banking book and the asset-liability management that controls it — IRR, IRRBB, repricing and duration, and the models behind them.
Start with:
Liquidity Risk
Having cash when it’s needed — funding and market liquidity, stress testing, contingency funding, and the lessons of every bank run in history.
Start with:
Everywhere else
Cross-industry risks
Every organization carries these, whatever it sells — the risks that fill most audit plans outside the trading floor.
Operational Risk
Failed processes, people, systems, and external events — the broadest risk category and the backbone of most audit plans.
Start with:
Compliance Risk
Laws, regulations, and internal rules — compliance programs, AML/KYC, regulatory expectations, and how audit provides assurance over all of it.
Start with:
Model Risk
When the models are wrong — model risk management, validation, SR 11-7 expectations, and auditing the models (and algorithms) management relies on.
Start with:
Fraud Risk
Deception for gain — fraud risk management, prevention and detection, the fraud triangle in practice, and internal audit’s role when things go wrong.
Start with:
Strategic Risk
Bad strategy, or good strategy badly executed — how strategic risk arises, how boards oversee it, and how internal audit can credibly cover it.
Start with:
Reputation Risk
The risk that trust evaporates — how reputational damage compounds every other risk, and why the fastest bank runs in history were runs on confidence.
Start with:
Business Continuity
Keeping the lights on — business continuity planning, disaster recovery, operational resilience, and how audit tests whether the plan would actually work.
Start with:
The bigger picture
Who owns risk — and where internal audit sits
Everything in this library is managed through some version of the three lines model. Getting the seating chart right matters, because the most common governance failures are ownership failures — risk “owned” by a committee, controls “owned” by the audit team, appetite owned by nobody:
| Line | Who it is | What it does with risk |
|---|---|---|
| First line | The business — management, process and control owners | Takes the risk, owns it day to day, and owns the controls over it. If a control fails, a first-line owner failed — not audit, not compliance. |
| Second line | Risk management and compliance — typically a CRO organization | Sets frameworks, appetite proposals, and policy; measures, challenges, and reports; runs the committees. Advises and constrains, but does not own the business’s risks. |
| Third line | Internal audit | Independent assurance over both other lines — including auditing the risk and compliance functions themselves — reporting to the audit committee, not management. |
Three points auditors should hold onto. Appetite is board property — management proposes, the board disposes, and reporting must let the board see when reality drifts from what it approved. The second line is auditable — a strong third line audits the CRO’s frameworks, models, and challenge process with the same rigor it applies to a business unit; deference is not independence. And internal audit manages a risk of its own: audit risk — the risk that the audit reaches the wrong conclusion — which is a property of your work, not of the business, and deserves its own management (sampling, supervision, skepticism).
How internal audit takes any risk apart
Credit at a global bank, business continuity at a nonprofit, fraud at a manufacturer — the subject matter changes, but a risk-management audit is remarkably repeatable. Whatever the risk, the same six-part skeleton covers it:
- Governance and framework — is there a policy, an accountable owner, a committee that actually decides, and an appetite that cascades into limits?
- Identification and assessment — does the organization systematically find this risk (risk assessments, RCSAs, new-product review), or only rediscover it after losses?
- Measurement and models — are the metrics and models fit for purpose, fed by reliable data, validated, and used with known limitations?
- Limits and monitoring — do limits exist at the level where decisions happen, are breaches caught and escalated, and do KRIs lead rather than lag?
- Reporting and escalation — does the board see an honest picture, at the right altitude, in time to act?
- Issues and remediation — when something is found (by anyone — audit, the business, regulators), is it fixed, validated, and fed back into the framework?
At every step the auditor asks the same two questions: is this designed well — would it manage the risk if it worked as described — and is it operating — does the evidence show it actually working, consistently, for the whole period? A beautiful framework that nobody follows fails the second test; a scrappy process that demonstrably works fails only the aesthetics.
Putting it to work: the fastest way from “risk” to “test plan” is a risk-and-control matrix. Our free, in-browser RCM Workbench builds one — risks, controls, assertions, and tests — with nothing leaving your machine.
When risks collide: lessons from real failures
Risk is managed in silos, but it fails in combinations. Nearly every famous blow-up is a chain: one risk triggers another, controls that assumed independence fail together, and the loss lands somewhere nobody was watching. Six cases every auditor should know cold:
| Case | What happened | The risk chain | The audit lesson |
|---|---|---|---|
| Barings (1995) | One trader’s unauthorized positions — concealed because he controlled both trading and settlement — produced losses (~£827m) that bankrupted a 233-year-old bank | Fraud → market → operational | Segregation of duties is not paperwork; it is the control |
| LTCM (1998) | A fund run on Nobel-grade models met a market where its diversified positions all fell together; the New York Fed had to coordinate a private-sector rescue | Model → market → liquidity → concentration | Models fail exactly when correlations go to one — stress the assumptions, not just the outputs |
| Knight Capital (2012) | A botched software deployment fired errant orders into the market — roughly $440m of losses in under an hour | Operational / change management → market | Change management is a market-risk control, not an IT formality |
| Archegos (2021) | A family office’s concentrated swap positions unwound; its prime brokers lost over $10b combined, Credit Suisse alone ~$5.5b | Counterparty credit → market → operational (margining, transparency) | Exposure you cannot aggregate is exposure you do not know you have |
| Wells Fargo (2016) | Sales-pressure incentives drove employees to open millions of unauthorized accounts; $3b settlement, a Federal Reserve growth cap, and years of restrictions followed | Conduct / operational → compliance → reputation → strategic | Incentive design is part of the control environment — and culture is auditable |
| Silicon Valley Bank (2023) | Unhedged interest-rate losses on a long bond portfolio met a concentrated, digitally connected deposit base — a run at smartphone speed ended the bank in days | Interest-rate → liquidity → concentration → reputation | Balance-sheet risks are one risk; behavioral assumptions (like deposit stickiness) deserve audit attention |
Every link in every one of those chains has a shelf in this library. The cheapest time to read about a risk is before the post-mortem.
Putting it to work
How auditors use the Risk Library.
Risk knowledge is what turns an audit plan from a checklist into coverage. Three good places to connect the dots: build the plan itself around risk with risk-based auditing 101; keep the concepts straight with audit risk: the definitive guide — audit risk is the risk the audit gets it wrong, not the same thing as the business risks on this page; and monitor what matters with the comprehensive table of key risk indicators.
Looking for cyber? IT and cybersecurity audit lives under Technology, Data & the Future.
The Risk Library is one lens. You can also browse everything by topic, find guidance for your role, grab a free audit tool, or — if you’re new — begin at Start Here. Looking for something specific? The search at the top of any page covers hundreds of in-depth guides.