Operational risk register
🎯 Purpose
Register of the material operational risks in the processes this workspace documents, with their key controls and current assessment. Maintained by the operational risk forum; reviewed monthly at the ops review.
📋 Register (extract)
ID | Risk | Process area | Gross | Key controls | Residual | Trend |
|---|---|---|---|---|---|---|
OR-01 | Unlicensed or unfit intermediary activated | Intermediary onboarding | High | CTRL-D-03, CTRL-D-04, CTRL-D-07 | Low | Stable |
OR-02 | Cover confirmed before KYC complete | Customer onboarding | High | CTRL-C-01 hard stop | Low | Stable |
OR-03 | Commission paid on uncollected premium | Finance cycles | Medium | Collected-basis rule in commission run | Low | Stable |
OR-04 | Banking detail fraud on agreements or refunds | Agreements, refunds | High | Call-back verification (CTRL-D-11 pattern) | Medium | Watch |
OR-05 | Underwriting authority breach | Referrals | Medium | Delegation matrix, queue monitoring | Medium | Watch |
OR-06 | Policy record does not match issued schedule | Policy administration | High | Endorsement four-eyes, discrepancy incident route | Medium | Improving |
OR-07 | Claims fraud not detected at FNOL | Claims | Medium | FNOL fraud checklist, SIU routing | Medium | Stable |
OR-08 | Client money unallocated beyond tolerance | Premium reconciliation | High | Monthly rec, 60-day escalation | Low | Stable |
📐 Governance conventions
- Gross = risk with no controls; Residual = with controls operating as tested in the monthly self-assessment.
- A control failure in the self-assessment automatically flags the linked risk for re-assessment at the next forum.
- New risks enter through the forum with a named accountable owner from the RACI in Roles and Responsibilities.