The first, most egregious, and most common failure is to consider the risk assessment as a document and not a process.

FORBES: Risk Assessments: The Most Important Effort You're Doing All Wrong

This includes reviewing the operational risk framework, the effectiveness of the business self-assessment process, and the loss data-collection and reporting activities.

FORBES: JP Morgan Chase Named A New Chief Auditor (For Corporate!); Can You Name Him?