---
title: Operational risk register
slug: risks-and-controls/operational-risk-register
icon: {"lucideIcon":"ListTree"}
docTags: 
createdAt: 2026-08-17T11:16:11.122Z
---

## 🎯 Purpose

Register of the material operational risks in the processes this workspace documents, with their key controls and current assessment. Maintained by the operational risk forum; reviewed monthly at the ops review.

## 📋 Register (extract)

| ID    | Risk                                          | Process area            | Gross  | Key controls                                      | Residual | Trend     |
| ----- | --------------------------------------------- | ----------------------- | ------ | ------------------------------------------------- | -------- | --------- |
| OR-01 | Unlicensed or unfit intermediary activated    | Intermediary onboarding | High   | CTRL-D-03, CTRL-D-04, CTRL-D-07                   | Low      | Stable    |
| OR-02 | Cover confirmed before KYC complete           | Customer onboarding     | High   | CTRL-C-01 hard stop                               | Low      | Stable    |
| OR-03 | Commission paid on uncollected premium        | Finance cycles          | Medium | Collected-basis rule in commission run            | Low      | Stable    |
| OR-04 | Banking detail fraud on agreements or refunds | Agreements, refunds     | High   | Call-back verification (CTRL-D-11 pattern)        | Medium   | Watch     |
| OR-05 | Underwriting authority breach                 | Referrals               | Medium | Delegation matrix, queue monitoring               | Medium   | Watch     |
| OR-06 | Policy record does not match issued schedule  | Policy administration   | High   | Endorsement four-eyes, discrepancy incident route | Medium   | Improving |
| OR-07 | Claims fraud not detected at FNOL             | Claims                  | Medium | FNOL fraud checklist, SIU routing                 | Medium   | Stable    |
| OR-08 | Client money unallocated beyond tolerance     | Premium reconciliation  | High   | Monthly rec, 60-day escalation                    | Low      | Stable    |

## 📐 Governance conventions

- Gross = risk with no controls; Residual = with controls operating as tested in the monthly self-assessment.
- A control failure in the self-assessment automatically flags the linked risk for re-assessment at the next forum.
- New risks enter through the forum with a named accountable owner from the RACI in **Roles and Responsibilities**.

:::ExpandableHeading
## 🔎 Assessment and review guidance

- Review risk trends monthly through operational governance forums.
- Escalate repeated control failures into formal remediation tracking.
- Verify that residual risk ratings align with current control effectiveness evidence.
- Ensure accountable owners are assigned to every material operational risk.
:::