Risk Analysis Chart

20.1.1- Risk Analysis Chart (Rev. 308, Issued: 10-26-18 Effective: 09- 01- 18, Implementation: 11-27-18) Table 1 - This chart is provided to assist contractors in selecting the high-risk activities within their organization. There are 3 columns that gives directions on how to rank operational areas for potential risk. HIGH RISK FACTORS (1) MEDIUM RISK FACTORS (2) LOW RISK FACTORS (3) • Recent review or audit findings showing material weaknesses related to internal control processes. • Areas affected by significant changes in laws, regulations, special requirements or instructions. • Areas where policies and procedures regarding internal control over financial reporting are not well documented. • Areas of significant financial vulnerabilities (e. g., new accounting or regulatory guidelines). • Areas where guidelines have varied interpretations and/or areas being restructured. • Areas with new contract activities. • Areas where objectives of the corporate mission could be in jeopardy if not properly implemented. • Areas lacking performance measures or monitoring. • Potential program weaknesses related to violation of privacy issues. • Areas with high visibility. • Areas where due dates are often not met or responses to correspondence are late. • Areas with consistent complaints or inquiry. • Areas where there are no written policies and procedures. • Areas where recent policy changes were implemented. • Areas with reorganization activities. • Areas where there is a breakdown in communication with corporate, regional, state or satellite offices, etc. • Areas with new or problematic performance measures. • Areas where CAPs have already been implemented. • Areas with low visibility; routine program operations. • Areas where workers are meeting routine program operations and performance targets and attitudes and staff motivations are high. • Areas that undergo frequent financial audits/ reviews by external parties (e.g., CFO, SSAE 18, A-123 Appendix A, CPIC, etc.). • Areas that managers perform periodic reviews to ensure that work assignments are performed consistently, and accurately. • Work activities are being phased out. • Areas with established and validated performance measures. Scoring Criteria Guidelines: Level Level Description High: If an activity has two or more high risk rating factors, review annually. Medium: If an activity has two or more medium risk factors, review biannually. Low: Low activities can be reviewed within a five (5)-year timeframe or at manager’s discretion that should be balanced with costs and resources. End Section 20.1.1 – Risk Analysis Chart: Back to Table of Contents