We recommend that the Chief Operating Officer\Chief Risk Officer develop, document, and implement a formal process to prioritize risk management activities including the use of limited resources based on key risks within the organization. Management’s prioritization should be clearly documented and include formal steps to ensure risks are maintained at an appropriate level.