7:15

Risk Assessment

Principle 7 - Identify, Analyze, and Respond to Risks

Attribute 7.15 - Management documents the results of the risk assessments, including the identification, analysis, and response to risks, that are completed on both a periodic and ongoing basis. This includes documentation of the consideration of risks related to fraud, improper payments, information security, and significant internal and external changes that could impact the internal control system [documentation requirement].

Empasis added by US Government Accountability Office.