Risk registers · RiskAtoms Academy

By the end you will be able to

1Build a risk register row with a statement, owner, controls, ratings and actions.
2Tell a risk owner from a control owner and an action owner, and name each as a person.
3Tell a control from an action, and a preventive control from a detective or corrective one.
4Spot the signs of a weak register and keep a register alive with regular reviews.

Why it matters

A risk can sit in a register for years, with a rating and a colour, and still take the firm by surprise. What makes a register useful is not the list. It is the owner who acts, the control that works and the action with a date.

Core explanation

One row per risk, and every cell earns its place

A risk register is where the cycle (L2.4.01: The risk management cycle) writes things down. Each risk found in L2.4.02: Identifying risks and scored in L2.4.03: Assessing risks: likelihood and impact gets one row. Every business area keeps its own; the risk function joins them into the firm's register, and the top few go to the board (L2.4.07: Risk reporting).

The columns. Registers differ in detail, but a good one answers the same questions:

Column	What goes in	Test of a good entry
Risk statement	Cause, event, consequence	Could someone outside the team picture it?
Risk owner	One named senior person	Could they be asked about it tomorrow, and act?
Inherent rating	Likelihood × impact with no controls	Does it show why the risk needs controls at all?
Key controls	What runs today, and its control owner	Does it exist now, and is it tested?
Residual rating	Likelihood × impact with today's controls	Is it within risk appetite?
Response	Avoid, reduce, transfer or accept	Does it match the residual and the appetite?
Actions	What, who, by when, status	Could you tell on the due date whether it was done?
Indicator and review date	The KRI that watches it; when last reviewed	Is it recent?

Some firms add a target rating: where the owner expects the risk to be once the actions are done. How inherent and residual ratings are agreed is the subject of L2.4.05: Risk and control self-assessment; the indicator column comes in L2.4.06: Key risk indicators.

Controls and actions are not the same. A control runs today. An action is a plan to make things better. Controls come in three types: preventive (stop it happening), detective (spot it fast) and corrective (limit the damage). A good register has a mix: Larkfield cannot prevent every outage of its payments platform, so it also needs a failover that gets payments running again.

Larkfield's register. Here are its eight risks. Ratings come from its 5 × 5 scale. Row R6 came out of the cloud workshop in L2.4.02: Identifying risks and is still blank: you will complete it in the Try it below.

ID	Risk and owner	Inherent	Key controls	Residual	Response	Open action
R1	Payments platform outageChief Operating Officer	16High	Release testing and change approval; automatic failover to a second data centre	9Medium	Reduce	Test failover every quarter, not once a yearHead of Payments Technology, by 31 Mar 2027
R2	Card and app fraudHead of Fraud	15High	Real-time fraud model; limits on payments to new payees	10Medium	Reduce	Check the device when a customer changes phoneHead of Fraud, by 31 Jan 2027
R3	Cyber attack and data breachChief Information Security Officer	10Medium	Two-factor log-in for staff; critical patches within 14 days; offline backups	5Medium	Reduce and transfer	Review the cyber insurance limit against the €150m scenarioChief Financial Officer, by 28 Feb 2027
R4	Consumer loan losses above planChief Credit Officer	12High	Credit scoring and affordability checks; lending limits by score band	8Medium	Reduce	Raise the affordability buffer for new unsecured loansHead of Retail Credit, by 31 Dec 2026
R5	Mis-selling of payment protectionHead of Retail Products	12High	Sales scripts; recorded calls; monthly quality checks	8Medium	Avoid	Stop selling the add-on with loans; review past salesHead of Retail Products, by 31 Mar 2027
R6	Cloud provider failure	To be completed in the Try it below.
R7	Manual payment errorsHead of Payments Operations	10Medium	Second person checks every payment over €100,000	8Medium	Reduce	Automate the 20 most common manual paymentsHead of Payments Operations, by 30 Jun 2027
R8	Regulatory reporting errorChief Financial Officer	8Medium	Returns reconciled to the general ledger; second review before submission	6Medium	Reduce	Trace the data behind the liquidity return to its source systemsHead of Regulatory Reporting, by 31 Mar 2027

Before controls, 4 of the eight risks are High. After them, none is; most sit at Medium. Scroll sideways on a phone.

Spot itA draft register from the mortgage team

Click every cell you think is weak, then check. There are 7 flaws, and one row is fine.

Sort itWhich response?

Pick the response Larkfield's register should record for each risk.

A proposed crypto trading service would bring risks Larkfield has no way to control yet.
Floods could damage branches in two river towns.
Small card fraud losses, well inside the fraud appetite and cheaper than any further control.
Staff key high-value payments wrongly.

Signs of a register that has died

Statements that are one or two words. Owners that are committees or departments. Controls that are really plans. Actions with no date, or dates long past. Every risk rated medium. Review dates more than a year old. And the most telling sign: nobody can remember the last decision the register changed.

Try it

Complete Larkfield's row R6, cloud provider failure. Use the scales from L2.4.03: Assessing risks: likelihood and impact: likelihood band 1 is under 5% a year.

Try itComplete row R6: cloud provider failure

1Risk statement
2Risk owner
Who is accountable for this risk?
3Inherent rating (before controls)
With no controls: a 4% chance a year, costing €120m.
4Key controls
5Residual rating (with today's controls)
With the controls: still a 4% chance, but backups cut the loss to €30m.
6Action

Choose an option for every field first.

Worked example

Keeping the register alive: R1 after an outage

In October a failed software change takes Larkfield's card and app payments down for 5 hours. Customer compensation costs €2.1m. The quarterly review of row R1 comes two weeks later. Decide each change before you open the step.

Reviewing R1: payments platform outage

Step 1 of 5

1
Link the incident
The outage is logged as a loss event (business disruption and system failures) and linked to R1. The risk statement still fits, so it stays.

Regulatory lens

No rule says “keep a risk register” in so many words, but supervisors expect a complete, current inventory of a firm's risks with clear ownership. The Basel Committee's operational risk principles ask banks to identify and assess risk in all material products and processes. Solvency II's own risk and solvency assessment (ORSA) asks insurers to assess all the material risks they face.

For third parties the rules are explicit. In the EU, the EBA's 2019 guidelines on outsourcing ask banks to keep a register of all outsourcing arrangements, and the Digital Operational Resilience Act (DORA), applying from January 2025, requires a register of information on all contracts with ICT providers, such as Larkfield's cloud provider.

Sparks

SparkOwners with their names on it

After the 2008 crisis, UK regulators found it hard to hold anyone personally to account for failures decided “by committee”. The Senior Managers and Certification Regime, which started for banks in 2016, requires each senior manager to have a written statement of the areas they are responsible for. A register's owner column follows the same idea: one name per risk.

SparkThe pull of the middle

When people are unsure, they tend to pick the middle of a scale. Raters do it in staff appraisals and in risk workshops alike. A register where nearly every risk is “medium” is often a sign of uncertainty or caution, not of a well-balanced firm. Asking for the evidence behind each rating helps.

Key takeaways

A risk register gives each risk one row: statement, owner, inherent rating, key controls, residual rating, response, actions, indicator and review date.
Owners are named people: a risk owner who is accountable, control owners who run controls, action owners who deliver changes.
A control runs today; an action is a dated plan. Controls are preventive, detective or corrective.
Residual can never be above inherent, and only working controls can bring it down.
A register stays alive through regular reviews and after every incident, new product or major change.

Reaction

Check what stuck

Glossary

Risk register: A firm's list of its risks, with who owns each one, how it is controlled, how it is rated and what is being done.
Risk owner: The one named person accountable for a risk: for knowing it, rating it and making sure it is managed.
Control owner: The person who makes sure a particular control runs and works.
Inherent risk: How big a risk is before any controls, as if nothing were done about it.
Residual risk: How big a risk is after the controls in place today.
Preventive control: A control that stops the event happening, such as a second approval or a limit.
Detective control: A control that spots the event quickly once it has happened, such as a reconciliation or an alert.
Corrective control: A control that limits the damage after the event, such as a backup site or insurance.
Action: A planned improvement, with an owner and a due date. It becomes a control once it is live.
Target rating: The rating the owner aims to reach once the open actions are done.

Deep Dives & Origins

Deep Dives

Chapelle, A., Operational Risk Management: Best Practices in the Financial Services Industry, Wiley, 2019, chapters on risk registers and controls. Intermediate.
Hopkin, P., Fundamentals of Risk Management, Kogan Page, for the Institute of Risk Management, chapters on risk registers and risk responses. Beginner.

Origins

International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines, clauses 6.5 (risk treatment) and 6.7 (recording and reporting).
Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021.
European Banking Authority, Guidelines on outsourcing arrangements (EBA/GL/2019/02), February 2019.
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Article 28.
Financial Conduct Authority and Prudential Regulation Authority, Senior Managers and Certification Regime.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.