SECNAVINST 5200 - Navy Issuances

SECNAV M-5200.35JUNE 2008Table 3: Risk Type and Level TableRisk Low Moderate HighInherentControlCombinedHazard or misstatementdoes not have severeconsequences and isunlikely to occur.Controls will prevent ordetect any hazard oraggregate misstatementsthat could occur in theassertion in excess ofdesign materiality.Any hazard or aggregatemisstatements in theassertion do not exceeddesign materiality.Hazard or misstatementhas severe consequencesor is likely to occur.Controls will more likelythan not prevent or detectany hazard or aggregatemisstatements that couldoccur in the assertion inexcess of designmateriality.More likely than not, anyhazard or aggregatemisstatements in theassertion do not exceeddesign materiality.Hazard or misstatementhas severe consequencesand is likely to occur.Controls will unlikelyprevent or detect anyhazard or aggregatemisstatements that couldoccur in the assertion inexcess of designmateriality.More unlikely than likely,any hazard or aggregatemisstatements in theassertion do not exceeddesign materiality.Risk Assessment TableSome form of a risk assessment table will be necessary to document the riskassessment required by SECNAV Instruction 5200.35E. The numbers in the columnsof the Risk Assessment Table (Example 3) correlate to the following instructions:(1) Document the risk/control point (i.e. number) from the process flow chart.(2) Identify the risk. (The approach to this process of identifying risks is toenvision what could go wrong. What problems could arise that might hinderthe objective?)(3) Identify the level of Inherent Risk as High, Moderate, or Low. If inherent riskis determined to be “High”, stronger or more extensive controls to prevent ordetect misstatements may be needed than if inherent risk is “Low.”(4) Identify the level of Control Risk as High, Moderate, or Low. If control risk isdetermined to be “High” (i.e. controls have not been implemented or are noteffective in either design or operation), there is no need to test the controls forthat risk. Corrective action plans to address internal controls should bedeveloped to mitigate the risk.(5) Identify the level of Combined Risk as High, Moderate, or Low.(6) Document the control currently being used by the organization to mitigate therisk described in (1) above.13