- 1
Identify
Continuous; reviewed quarterly- Artefact
- Risk register entries
- Owner
- Risk owner (1st line)
New risks are raised against a category. Library risks pre-populate at onboarding; the register is added to as the business evolves, exits markets, or onboards new services.
See the register - 2
Assess
On entry; on material change- Artefact
- Inherent and residual scoring on the 5×5
- Owner
- Risk owner, validated by 2nd line
Likelihood × impact gives the inherent. Control effectiveness and evidence sufficiency reduce it to a residual. Every score traces to the ratified methodology version that was live when it was set.
See the heatmap - 3
Treat
On breach; on material change- Artefact
- Accept / mitigate / transfer / avoid decisions
- Owner
- Risk Committee or delegate
Where residual is above appetite, a decision is logged with rationale and owner. The decision becomes part of the audit trail and surfaces in the next board pack until ratified.
See appetite & tolerance - 4
Monitor
Daily / weekly / monthly per KRI- Artefact
- Key Risk Indicators (leading and lagging)
- Owner
- Risk owner; aggregated by CRO
KRIs carry amber and red thresholds in their own unit. Status recomputes on every reading. Reds and ambers light up the cockpit and the board pack automatically.
See the KRIs - 5
Report
Quarterly pack; live cockpit- Artefact
- Board pack (quarterly) and cockpit (continuous)
- Owner
- CRO and Committee Secretary
The pack is generated from the same data, in the same methodology, that risk owners have been operating against all quarter. No re-keying, no parallel spreadsheet.
See the board pack - 6
Ratify
Quarterly; on methodology change- Artefact
- Committee minute, recorded against the version
- Owner
- Audit & Risk Committee
The committee ratifies the methodology, the appetite statements, and any treatment decisions awaiting it. Ratification is a named, dated event — the foundation of defensibility to a regulator.
Back to the pack