Inherent. Residual.
Entity-scoped.

Vantage Point starts you with a risk taxonomy, not a blank register: the Level 1 compliance risks a regulated firm carries (customer due diligence, financial crime governance, client assets, outsourcing, resilience and the rest), each broken into Level 2 risks and mapped to the obligations that drive them. Every entity in your book gets its own copy, so a fund and its administrator are assessed on their own facts.

Scoring is one method, applied the same way every time. Likelihood is rated on the nature of the compliance obligations and the firm’s exposure through its business model; impact on the plausible worst case for reputation, stakeholders and the regulator, each on a four-point scale. The greatest likelihood times the greatest impact is the inherent score, out of sixteen. Parent risks aggregate from their children, so the L1 picture is always the sum of what sits beneath it.

Controls do the rest. Each control’s design and performance rating, blended with the strength of the wider control framework, sets a deduction factor for the risk. Residual risk is inherent less that deduction, and because the inputs are on the record, so is the arithmetic. Residual is then read against the entity’s appetite bands, Accepted through Outside, set per entity, so a breach of appetite means the same thing on every board paper.

From there the risk is a working record: its controls, obligations, tests and open actions on one page, a review date the dashboard tracks, and an escalation raised when residual passes its threshold. The heatmap, the top ten by residual and the appetite ladder are the same numbers, one click away.