Standard Operating Procedure: UK Corporate Risk Register Management

Standard Operating Procedure: UK Corporate Risk Register Management

Document ID: TR-SOP-RM-001
Effective Date: 2023-10-27
Version: 2.1.0
Review Cadence: Biannual (Every 6 Months)

1. Executive Summary & Purpose

This document establishes the institutional standard for maintaining a Risk Register within UK-based operations. It ensures compliance with the UK Corporate Governance Code and ISO 31000 standards. The purpose is to provide a unified methodology for the identification, assessment, mitigation, and monitoring of enterprise-level risks to ensure operational resilience.

2. Scope & Prerequisites

• Scope: All UK-based departments, subsidiary entities, and project management offices (PMOs).
• Tools/Software: Enterprise Risk Management (ERM) software (e.g., Archer, LogicGate) or standardized MS Excel/SharePoint integration.
• Data Requirements: Access to departmental KPIs, previous incident logs, and current financial forecasts.
• PPE: N/A (Digital-first administrative protocol).

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase I: Identification & Taxonomy

• Categorize risks using the standard framework: Strategic, Operational, Financial, Compliance (UK GDPR, Health & Safety, FCA).
• Conduct a stakeholder workshop to solicit "black swan" and "common" risk events.
• Populate the Risk Description field with the 'Cause-Event-Effect' structure.

Phase II: Quantitative & Qualitative Assessment

• Determine Inherent Risk (Likelihood x Impact) prior to controls.
• Apply the 5x5 Matrix: Assign Likelihood (1-5) and Impact (1-5) scores.
• Document existing controls (Preventative vs. Detective).

Phase III: Mitigation Planning

• Define the response strategy: Transfer, Tolerate, Treat, or Terminate.
• Calculate Residual Risk post-mitigation.
• Set "Trigger Points" (Key Risk Indicators - KRIs) that mandate immediate review.

Phase IV: Monitoring & Reporting

• Update status monthly; perform full review quarterly.
• Archive closed risks to the "Risk Ledger" for historical auditing.
• Generate Board-level summary reports focusing on risks with a Residual Score > 15.

5. Quality Assurance & Pro-Tips

Best Practices:

• The "So What?" Test: If a risk mitigation plan does not reduce the Residual Risk score, the control is ineffective.
• Version Control: Always maintain a immutable audit trail; never overwrite historical entries.

Common Pitfalls:

• Risk Vague-ness: "Brexit" is not a risk; "Supply chain disruption leading to a 15% increase in lead times" is a risk.
• Optimism Bias: Ensure Impact scores are validated against financial loss data, not speculative sentiment.

Metric Thresholds:

• High Risk (15-25): Immediate board escalation required.
• Medium Risk (6-14): Formal mitigation plan required; review quarterly.
• Low Risk (1-5): Monitor at departmental level.

6. Frequently Asked Questions

Q: How do we handle risks that cross departmental boundaries? A: Assign a single "Accountable Risk Owner" at the Executive level. Consult impacted department heads, but avoid dual-ownership, which leads to accountability dilution.

Q: Should I include "Issue" entries in the Risk Register? A: No. A Risk is a potential future event. An Issue is an event that has already occurred. Move closed risks that have materialized to an "Issue Log" for remediation tracking.

Approved by:
Julian Vance
Chief Architect, Template Registry