Inherent risk: likelihood times impact, honestly
Score inherent risk on a 4 by 4 grid: likelihood from 1 to 4, impact from 1 to 4, product from 1 to 16. The scale is deliberately coarse. Compliance risk is not measured with instruments; it is judged by people who know the business, and a coarse scale stops the register pretending to a precision it does not have.
The discipline is to score inherent risk as if the controls did not exist. The temptation is to think “we have good procedures, so this is a 2”. That is a residual thought. Inherent is the exposure the business runs by being what it is: a trust company holding client money has a high inherent risk of misappropriation whatever its controls say.
The deduction controls earn
Residual risk is inherent less what your controls earn, and what they earn should be a function of two ratings: how well the control is designed and how well it operates. Rate both on the same scale (Weak, Developing, Established, Strong) and let the lower of the two drive the deduction. A well-designed control that nobody follows is a weak control, and the residual score should say so.
This is why the risk register and the control register cannot live in separate spreadsheets. When a monitoring test fails, the control’s operating rating should fall and the residual risk should rise, the same day, without anyone remembering to update a second file.
Show residuals to one decimal place. The extra precision is not accuracy; it is what lets two risks with the same inherent score be ranked by how well they are controlled.
Appetite: bands, not adjectives
Appetite is the board’s statement of how much residual risk it is willing to carry, and an appetite band is that statement made testable. Written as an adjective (“low appetite for regulatory risk”) it cannot be tested. Written as thresholds on the residual score it can: Accepted up to a point, Within up to the next, Approaching after that, Outside beyond it.
Set the thresholds per entity. Your own firm and a client entity you administer may share a taxonomy and a scoring method, but their boards have not agreed to carry the same risk. A residual 9 can be Within appetite for one and Approaching for another, and both boards deserve a heatmap that reflects their own decision.
The heatmap your committee will open
A heatmap earns its place when it answers a question, and the question a committee has is not “where are our risks?” but “which of our risks are outside what we agreed to carry, and what is being done about them?”. Plot each top-level risk by its inherent likelihood and impact, colour the cell by the appetite band the residual score falls into, and put beside it the count of risks per band, the ten highest residuals and the open actions against them. That page is a committee conversation. A wall of forty coloured cells is not.
Keeping the register alive
A risk register decays from the day it is approved. Three things keep it alive: a review date on every risk, set shorter for risks approaching or outside appetite; a link from every risk to the obligations that give rise to it and the controls that treat it, so a change in either prompts a look; and the monitoring programme feeding control ratings back into the residual scores as tests conclude. What the committee should then see of it is covered in What the committee pack needs.
How Vantage Point runs it
Vantage Point ships a pre-built risk taxonomy mapped to the obligations in the library. Inherent is likelihood times impact on the 4 by 4 (scores 1 to 16), residual is inherent less the deduction controls earn (the lower of design and operating effectiveness), shown to one decimal place and read against each entity’s own appetite bands: Accepted, Within, Approaching, Outside. The heatmap and the risk register and appetite reports read from the same records. See the Risks module.
Questions
- What is the difference between inherent and residual risk?
- Inherent risk is the exposure before controls are considered: how likely the thing is to happen and how bad it would be. Residual risk is what remains after the controls you actually operate are taken into account. The gap between the two is what your controls earn, and it should be visible, not assumed.
- How should a compliance function set risk appetite?
- As thresholds on the residual score, per entity, agreed by the board. Four bands are enough: Accepted, Within, Approaching and Outside. The point of the bands is to make the heatmap answer a question the committee actually has: which risks are outside what we agreed to carry?
- Why score risk per entity rather than for the group?
- Because a fund administrator's client entities carry different licences, different clients and different boards. A house average hides the one entity that is outside appetite. Per-entity scoring with a consolidated view gives both the client board and the group committee the truth about their own position.
- How often should the risk register be reviewed?
- Each risk carries a review date set by its residual score and appetite band; risks approaching or outside appetite are reviewed sooner. The whole register is re-approved annually and whenever the business or the regulation changes materially.