Many banks are looking for a better core banking system to support their business growth with a more efficient and flexible core banking system to improve their sales and services in the competitive market and to fulfill regulatory requirements. The decision of replacing the legacy core banking system is difficult due to the high IT investment cost required for banks because they are also trying to cut costs. But maintaining the legacy system is costly in terms of upgrade. Changing the core banking system is also a difficult process and increases risks. To have a successful Core Banking System implementation, risk assessment is required to be performed prior to starting any activities. The assessment can help project teams to identify the risks and then to mitigate the risks as part of the plan. In this research the Core Banking System replacement risks were assessed based on ISACA Framework for IT Risk. Fourteen risk scenarios related to Core Banking System Replacement were identified. The high and medium rated inherent risks can become medium and low residual risk after assessment by putting the relevant control in place. The result proves that by adding mitigation plan it will help to mitigate the Residual Risk to become low risk. There are still three residual risk which categorized as medium risk and should be further mitigated they are Software Implementation, Project Delivery and Selection/Performance of Third Party Suppliers. It is also found that COBIT 5 has considered some specific process capabilities that can be used to improve the processes to mitigate the medium risks.
