This tool includes a risk assessment questionnaire with instructions for completion. It also provides additional information and reference materials, including a risk model, rating guidance, environmental risk definitions, process risk definitions and information risk definitions.

The questionnaire collects responses for risk assessment as preparation for annual budgeting and business planning efforts. It includes functional goals, top three to five risks in functional areas, companywide top three to five risks and quantitative risk ratings. It also includes internal audit areas that provide the most value.