(a) A state agency described by Section 2102.004(b) shall conduct each year a formal risk assessment consisting of an executive management review of agency functions, activities, and processes.
(b) The risk assessment must:
(1) evaluate the probability of occurrence and the likely effect of financial, managerial, and compliance risks and of risks related to the use of information technology; and
(2) rank risks according to the probability of occurrence and likely effect of the risks evaluated.

(c) The state agency shall submit the written risk assessment to the state auditor in the form and at the time prescribed by the state auditor.