Risk Register Template for Banks

Standard Operating Procedure: Enterprise Banking Risk Register Architecture & Lifecycle Management

Document ID: SOP-TR-BRR-4092
Effective Date: October 24, 2023
Version: 3.4.0
Review Cadence: Semi-Annual
Author: Julian Vance, Chief Architect, Template Registry

---

1. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional requirements for establishing, maintaining, and auditing the Enterprise Risk Register within banking and financial institutions. In alignment with Basel III, SOX, and OCC Heightened Standards, this procedure ensures systematic identification, quantitative and qualitative assessment, continuous mitigation tracking, and real-time executive reporting of operational, credit, market, liquidity, and compliance risks.

Adherence to this SOP is mandatory for all Risk Management, Internal Audit, and Line of Business (LOB) units operating on the Template Registry platform.

---

2. Scope & Prerequisites

2.1 Scope

• Applicability: All domestic and international subsidiaries, business units, and shared service centers.
• Risk Domains: Credit Risk, Market Risk, Liquidity Risk, Operational Risk (including Cyber and Third-Party), Compliance/Legal Risk, and Strategic Risk.

2.2 Prerequisites & Tooling

• Software Environment: Template Registry Enterprise GRC Module (v14.2+), Microsoft Excel 365 (for offline modeling), and Tableau/PowerBI for risk dashboards.
• Access Control: Level 4 Enterprise Security Clearance with explicit Role-Based Access Control (RBAC) provisioning.
• Reference Frameworks: COSO ERM, ISO 31000, Basel Committee on Banking Supervision (BCBS) 239 risk data aggregation standards.

---

3. Roles & Responsibilities (RACI Matrix)

Legend: R = Responsible, A = Accountable, Consulted = C, Informed = I

---

4. Step-by-Step Procedure

Phase 1: Risk Identification & Intake

• 1.1 Initiate a new risk intake ticket within the Template Registry GRC module upon discovery of any internal control failure, audit finding, regulatory change, or strategic shift.
• 1.2 Categorize the risk event utilizing the Basel II Loss Event Type taxonomy (e.g., Execution, Delivery & Process Management; Business Disruption & System Failures).
• 1.3 Assign a unique globally unique identifier (UUID) following the syntax: BRR-[LOB]-[YYYY]-[SeqNum] (e.g., BRR-RETAIL-2023-0142).

Phase 2: Inherent Risk Assessment

• 2.1 Evaluate the Likelihood of the risk materializing in the absence of internal controls, utilizing the 5-point scale (1=Rare, 5=Almost Certain).
• 2.2 Evaluate the Impact across four mandatory dimensions: Financial Capital, Regulatory/Legal, Operational Disruption, and Reputational. Use the highest score to determine overall impact on a 5-point scale (1=Negligible, 5=Catastrophic).
• 2.3 Calculate the Inherent Risk Score (IRS) using the institutional matrix formula:
  $$\text{IRS} = \text{Likelihood (1-5)} \times \text{Impact (1-5)}$$

Phase 3: Control Mapping & Residual Risk Scoring

• 3.1 Link all existing mitigating internal controls from the Enterprise Control Framework to the risk record.
• 3.2 Assess the Control Effectiveness Rating as Effective, Needs Improvement, or Ineffective based on recent testing results.
• 3.3 Calculate the Residual Risk Score (RRS) factoring in design and operating effectiveness:
  $$\text{RRS} = \text{Inherent Likelihood} \times \text{Inherent Impact} \times (1 - \text{Control Mitigating Factor})$$

Phase 4: Action Plan & Treatment Workflow

• 4.1 Select the designated risk treatment strategy: Mitigate, Transfer, Accept, or Avoid.
• 4.2 For "Mitigate" strategies, draft an explicit Corrective Action Plan (CAP) including milestones, resource allocation, and a hard target completion date.
• 4.3 Assign a named Action Owner (must hold Vice President title or higher).

Phase 5: Monitoring, Reporting & Escalation

• 5.1 Re-certify risk entries on a mandatory quarterly cadence, or immediately upon any material operational change.
• 5.2 Trigger automated threshold escalations for any active risk maintaining an RRS $\ge 15$ (High/Critical) to the Risk Management Committee (RMC) within 24 hours.

---

5. Quality Assurance & Pro-Tips

5.1 Best Practices

• Granularity Control: Avoid "motherhood and apple pie" risks (e.g., "IT security is bad"). Decompose risks down to specific failure modes (e.g., "Unpatched vulnerability in core legacy payment gateway running COBOL stack").
• Dynamic Linkage: Always tie risks directly to the General Ledger or operational loss databases to ground qualitative assessments in quantitative reality.

5.2 Common Pitfalls to Avoid

• Control Overstatement: Do not rate control effectiveness as "Effective" without empirical testing evidence from the last 12 months.
• Risk Stagnation: Leaving a risk in "Open" status past its target remediation date without a formal change request violates regulatory compliance mandates.

5.3 Metric Thresholds

• Target Remediation Overdue Rate: $< 3%$ of total active CAPs.
• High-Risk Register Re-certification Compliance: $100%$ within the designated 5-business-day window post-quarter-end.

---

6. Frequently Asked Questions (FAQ)

Q1: What should be done if an identified risk crosses the institutional Risk Appetite Limit (RAL)?
A: Any risk exceeding the RAL automatically triggers an Exception Workflow. The LOB Head must submit an immediate Risk Acceptance Waiver or an Accelerated Mitigation Plan to the Chief Risk Officer (CRO) within 48 hours for board-level visibility.

Q2: How often must Inherent and Residual risk scoring methodologies be recalibrated?
A: In accordance with regulatory stress-testing requirements, the underlying scoring matrices and calibration curves must be reviewed annually by the Quantitative Risk Modeling Group and signed off by the Model Risk Governance Committee (MRGC).