Spreadsheet: 93326d1292925848-array-formula-and-parentheses-array-help
Sheet: Risk Register Testing

 | Risk Categories |  |  |  | Inherent Risks Comments | Risk owner | Potential (Inherent Risk) Grading Pre-mitigation |  | Key Existing Controls | Control Rating (Strong, Satisfactory and Needs Improvement) | Residual Risk Post Mitigation |  | Statement of Risk Appetite (Unacceptable, Tolerated, Acceptable) |  | Planned Action |  |  |  | Target Risk (after actions) |  | Risk Identification for ICAAP. Risk to be included in ICAAP Document (Yes/No) | Comments
 | Generic Risk Category |  | Risk Definitions | ICAAP Risk Category |  |  | Impact Grading (Critical, High, Medium, Low) | [NAME] (Likely, Possible, Unlikely, [NAME]) |  |  | Impact (Critical, High, Medium, Low) | [NAME] (Likely, Possible, Unlikely, [NAME]) |  | TEST COLUMN | Planned Action to Reduce Residual Risk to Target Risk | Planned Action Owner | Planned Action Deadline | Team Balance Scorecard Statistic | Impact (Critical, High, Medium, Low) | [NAME] (Likely, Possible, Unlikely, [NAME])
Risk Number | Main Risk Category | Sub-Risk Category | Risk Definition
A | B | C | D | E | F | G | H | I | J | K | L | M | N |  | O | P | Q | R | S | T | U | V
1 | Investor relations |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | Critical | Acceptable | Tolerated | Unacceptable | Unacceptable
1.1 | Investor relations | Shareholders |  | Strategic |  | Central Services |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | High | Acceptable | Tolerated | Tolerated | Tolerated
1.2 | Investor relations | Creditors/Banks |  | Strategic |  | Central Services |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | Medium | Acceptable | Acceptable | Acceptable | Tolerated
2 | Governance |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | Sub-Risk | Statement of Risk Appetite | Sub-Risk |  |  |  |  |  |  |  |  |  |  |  | Low | Acceptable | Acceptable | Acceptable | Acceptable
2.1 | Governance | Organisational Culture & Structure | This includes the risk that the Group fails to clearly and explicitly delegate and enforce roles and responsibilities, which results in managers and employees exceeding the boundaries of their defined authorities, or failing to fulfill their roles and responsibilities in an appropriate timeframe.  The exposure may result in employees performing unauthorised, unethical, or illicit activities, assuming excessive risks, or failing to attain business objectives. | Strategic |  | [NAME] | Critical | Likely | Procedures, defined team responsibilities, training, client focused culture | Satisfactory | Critical | Rare |  |  |  |  |  |  | Medium | Unlikely
2.2 | Governance | Board Effectiveness | The risk that the Group board does not maintain sufficient competence, independence, and ethics in its active oversight of and participation in the current and future affairs of the Group. This includes  the risk that the Group fails to implement an adequate governance strategy to monitor and record current business activity, ensure compliance with agreed policies and provides for corrective action in cases where rules have been ignored or miscontrued. | Strategic |  | [NAME] | Critical | Likely | Defined team, defined responsibilities, targets, non-exec director participation, streamlined board and committee structure | Satisfactory | High | Unlikely |  |  |  |  |  |  | High | Unlikely
2.3 | Governance | Opportunity/Business Concentration | The risk that the Group’s overall performance (revenue and profitability) is impacted by a disproportionate reliance on a small number of opportunities, business models or markets. | Strategic |  | [NAME] | Critical | Unlikely | Business structure, plans to diversify | Satisfactory | High | Unlikely |  |  | Strategy Review | JR |  |  | Medium | Unlikely
2.4 | Governance | Acquisitions & disposals | The risk that management and/or key decision makers are unable to reliably measure the value of both owned businesses (i.e. to decide whether to invest/grow, maintain/harvest, or divest/liquidate), and prospective businesses (i.e. acquire, joint venture, or strategically align) for strategic purposes. | Strategic |  | [NAME] | Critical | Possible | Due diligence, management information analysis | Satisfactory | High | Possible |  |  |  |  |  |  | High | Rare |  | Not a separate risk in ICAAP as assessment of every risk on register takes into account current situation and will therefore incorporate any projects.
2.5 | Governance | Business Strategy & Operational Plans | The risk that the company fails to manage the evolution of its products, business entities, and industry, and its current position relative to its competitors, resulting in a business model that is obsolete and no longer relevant.  This also includes the failure to operationalise the Group’s strategy at the BU level.  The exposure may reduce the company’s chances for competing and ultimately its survival. | Strategic |  | [NAME] | Critical | Possible | Continued monitoring of competition and markets | Needs improvement | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely
3 | Market Dynamics
3.1 | Market Dynamics | Pricing/Product Charges | The risk that the Group’s pricing is not market competitive and/or fails to cover overhead costs.   Pricing may be established based on inadequate pricing strategies, market research etc. | Strategic |  | [NAME] | Critical | Possible | Obtain feedback from sales process, periodic review of charges  (benchmarking) | Needs improvement | High | Possible |  |  | RDR Pricing Review | GS | 2010-12-01 00:00:00 |  | Medium | Unlikely |  | Loss of clients
3.2 | Market Dynamics | Product Offering | The risk that current and new products are unattractive to clients, and the Group is unable to realise planned growth nor focusing on the client segments with greatest market potential etc. | Strategic |  | [NAME] | High | Possible | Obtain feedback from sales process, reviews of models | Needs improvement | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely |  | IFA
3.3 | Market Dynamics | Competitors | The risk that competitors including new entrants acquire company’s client base and/or attain and sustain competitive advantage; i.e., new products, improved quality, increase productivity, and reduced costs.  May be caused by not detecting and responding to changes in the industry or competitive environment, i.e., key competitive factors, capabilities of existing and potential competitors, and the company’s status relative to present and future competitors. | Strategic |  | [NAME] | Critical | Possible | Feedback from sales process, reviews of models | Needs improvement | High | Possible |  |  |  |  |  |  | Medium | Unlikely |  | Loss of clients
4 | Brands
4 | Brands | Brands | The risk that brands are not managed or marketed effectively, confused or ineffective brand messages are given out, diminishing the ability to sell or retain business. | Strategic | Especially in Scotland | [NAME] | Medium | Possible | PR Agency, client communication, third party network, audit of marketing materials | Needs Improvement | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely
5 | Marketing & Distribution
5 | Marketing & Distribution | Marketing & Distribution | The risk that the product marketing and distribution does not align with the Group’s capabilities, fully exploit opportunities to pursue client prospects, generate repeat business with its current client base, as well as adequately safeguard its client base from competitors and departing personnel. | Strategic |  | [NAME] | High | Likely | Business Development Director role | Needs Improvement | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely
6 | Acquisition & Retention
6.1 | Acquisition | Client acquisition | The risk that the client's risk/return profile is misunderstood and there is no formal Investment Management Statement or commission disclosure. Also risk that dishonest or inappropriate clients are on-boarded (due to poor KYC and AML checks) | Operational |  | [NAME] | Medium | Possible | Procedures, dedicated teams, risk profiler | Satisfactory | Low | Unlikely |  |  |  |  |  |  | Low | Unlikely
6.2 | Retention | Client Service | The risk that the Group fails to provide the quality of service expected by its client  nor is it keeping pace with the changing needs and expectations of each client segment, which may apply to service quality, features, availability, and/or speed of delivery. | Strategic |  | [NAME] | High | Possible | Monitoring of competition, Complaints handling, client risk ratings, general procedures | Satisfactory | Low | Unlikely |  |  |  |  |  |  | Low | Unlikely
6.3 | Retention | Product performance | The risk that clients’ receive returns on investments  that do not meet or exceed their expectations or that of peer group performance.  Existence of this risk can be easily identified through complaints, analyst or distributor reviews/recommendations, decrease in repeat business, withdrawals, claims and litigation.  Exposures can impact the businesses reputation, market share and revenues. | Strategic |  | [NAME] | Medium | Possible | Portfolio reviews, weekly/monthly monitoring, client valuations, strategy meetings | Needs Improvement | Medium | Possible |  |  | 3rd Financial Implementation for monitoring | DA |  |  | Medium | Unlikely
7 | Risk Management
7.1 | Risk Management | Credit | The risk that an economic or legal entity in which client funds are  invested or deposited for safe custody will default on its obligations, resulting in financial losses such as excessive write-offs, collections costs, and/or opportunity costs. | Credit |  | Neil Hale & [NAME] | Medium | Unlikely | Due diligence / Procedures | Satisfactory | Medium | Unlikely |  |  |  |  |  |  | Medium | Unlikely
7.2 | Risk Management | Market | The risk that asset prices fluctuate, resulting in loss of client investment  value, adverse effects on management fee income, adverse client/potential client  reaction to less than expected performance. | Market |  | [NAME] | High | Likely | Risk profiles, Investment Committees (Asset allocation and recommendations) | Satisfactory | High | Possible |  |  |  |  |  |  | High | Possible |  | Model adverse market movements
7.3 | Risk Management | Interest Rate | The risk that fluctuations in interest rates may have adverse consequences for client investment funds resulting in loss of income, investments write-downs and write-offs. | Interest Rate |  | [NAME] | Medium | Unlikely | Assessment and monitoring of interest rates, ?? | Satisfactory | Medium | Unlikely |  |  |  |  |  |  | Medium | Unlikely
7.4 | Risk Management | Suitability, Disclosure & Fiduciary - ARFP | The risk that the Group does not adequately assess the investment suitability  for clients, make appropriate investment and risk disclosures and comply with its fiduciary duties to its clients e.g. aggressive selling, account churning, misuse of client confidential details  etc. | Operational |  | [NAME] | Critical | Possible | Investment modeling, Procedures (compliance monitoring/risk profiles) | Satisfactory | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely |  | Complaints/Monitoring Scores
7.4.1 | Risk Management | Suitability, Disclosure & Fiduciary - ARAM | The risk that the Group does not adequately assess the investment suitability  for clients, make appropriate investment and risk disclosures and comply with its fiduciary duties to its clients e.g. aggressive selling, account churning, misuse of client confidential details  etc. | Operational |  | [NAME] | Critical | Possible
8 | Fraud & Illegal Activity
8.1 | Fraud & Illegal Activity | Internal Fraud | The risk that employees including management individually or in collusion with others commit fraud against the Group, resulting in financial loss or unauthorised use of financial instruments, physical assets and/or confidential information.  Such fraud may also involve the intentional issuance of misleading financial statements to deceive the public or other decision-makers for the benefit of the Group.  In addition this also includes illegal acts that place the Group at such risk of fines, sanctions, and imprisonment as well as loss of clients, damage to reputation, and loss of business.  Such activities include bribes, kickbacks, financial statement falsification and other unacceptable business practices. | Operational |  | [NAME] | Critical | Unlikely | Segregation of duties, reconciliations (clients and corporate), dual authorisation | Strong | Medium | Rare |  |  |  |  |  |  | Medium | Rare
8.2 | Fraud & Illegal Activity | External Fraud | The risk that a third party defrauds or intends to defraud the Group, misappropriate property,  including physical assets, or circumvent the law e.g. losses arising from non-contractual and third party initiated fraud (for example, identity theft, forgery, fraudulent claims etc). | Operational |  | [NAME] | Critical | Unlikely | Segregation of duties, Money laundering training | Needs improvement | Medium | Unlikely |  |  | PT liaising with Compliance on roll-out of new on-going surviellance checking | [NAME] |  |  | Medium | Unlikely
9 | Human Resources
9.1 | Human Resources | Employee Relations | The risk that the Group’s relationship with its employees is poor resulting in failure to align its business objectives with employee expectations resulting in dis-engagement , lack of motivation, work stoppages etc. | Operational |  | [NAME] | High | Likely | Performance reviews and development plan moving from annual to 6 monthly, manager training and Employee Engagement survey | Needs Improvement | Medium | Possible |  |  | Additional HPC training and support from L & D Manager. Employee engagement Survey. | [NAME] |  |  | Medium | Unlikely
9.2 | Human Resources | Compensation & Benefits | The risk that the compensation and benefits structure is not cost effective, may not be sufficiently competitive to retain talent, or may motivate people to perform unethically or contrary to Group objectives and prudent business practice, or may be perceived by employees as unobtainable based on unreasonable performance goals, resulting in inefficiencies due to low employee morale. | Operational |  | [NAME] | High | Likely | Annual salary reviews, new adviser and asset manager targets and bonus schemes, salary benchmarking and alignment exercises | Satisfactory | Medium | Possible |  |  | Internal and external review. Review of FSA guidance | [NAME] |  |  | Medium | Unlikely
9.3 | Human Resources | Talent Development | The risk that sufficiently talented resources are not being developed within the Group to provide for sufficent skilled personnel and/or leadership succession in the future. | Operational |  | [NAME] | High | Likely | New performance review system, talent pipeline, L&D manager | Satisfactory | Medium | Possible |  |  | L & D manager to develop individual plans for all | [NAME] |  |  | Medium | Unlikely
9.4 | Human Resources | Headcount | The risk that the Group does not possess the necessary headcount or competence necessary to achieve operational goals and objectives. | Operational |  | [NAME] [NAME] | Critical | Possible | Board meetings, team structures and leadership | Needs Improvement | Medium | Possible |  |  | Weekly updates at Sales call. Managers tasked with recruitment | [NAME] and [NAME] |  |  | Medium | Unlikely
10 | Business Continuity
10.1 | Business Continuity | Information Technology Disaster Recovery | The risk that the Group may fail to expeditiously and effectively restart failed IT operations.  Failure may be due to inability to access main processing centres, corruption of data due, external threats etc | Operational |  | [NAME] | Critical | Likely | Back-up DR site, Recovery to end of day | Needs improvement | Medium | Possible |  |  | Project Dais will deliver a resilient tier 3 Data Centre with technical recovery plans for all infrastructure. Applications will be migrated into this environment with full DR testing. | [NAME] |  |  | Medium | Unlikely
10.2 | Business Continuity | Business Process | The risk that  the Group is unable to expeditiously and effectively restart interrupted business processes including non-availability of main premises processing centres, loss of key personnel  etc. | Operational |  | [NAME] | Critical | Likely |  | Needs improvement | Medium | Possible |  |  | Crisis Management Plan and Business Continuity Plans are being created/ updated. Call Tree and scenario testing will be performed across the Group. | [NAME] |  |  | Medium | Unlikely
11 | Process Execution Management
11.1 | Process Execution Management | Research & Analysis | The risk that the Group makes its client investment decisions based on incorrect, unreliable or biased research and analysis.  This could result from ineffective processes, conflicts of interest in the research team, the quality of the research team and lack of appropriate oversight over the research function. | Operational |  | [NAME] | Critical | Possible | Approved list, peer challenge, detailed analysis of potential investments/existing, committee approval | Satisfactory | Medium | Unlikely |  |  | Standardise research process, focused BAL | [NAME] |  |  | Medium | Unlikely
11.2 | Process Execution Management | Trade Execution | The risk that the Group fails to execute client transactions accurately, in a timely manner and in accordance with agreements with clients and internal guidelines (e.g. client mandates, authorised lists, watch lists, analyst’s reports etc). The risk may result from poor client service, data entry errors, transaction systems errors, accounting errors, incorrect application of charges, incorrect pricing, poor oversight of trade execution, poor process documentation. | Operational |  | [NAME] | Critical | Possible | Segregation of duties, dealing guidelines, model portfolios, approved lists, monitoring of data entry | Satisfactory | Low | Unlikely |  |  |  |  |  |  | Low | Unlikely
11.3 | Process Execution Management | Valuation/Pricing | The risk that the Group is unable to or incorrectly values/prices investment funds, including relevant taxation.  This could result in erroneous net asset value computations (and consequently erroneous disbursements and incorrectly priced investment inflows), fee calculations and negative client experience. | Operational |  | [NAME] | High | Possible | Third party price data imports, ad hoc monitoring of prices/values | Satisfactory | Medium | Unlikely |  |  |  |  |  |  | Medium | Unlikely
11.4 | Process Execution Management | Disbursements | The risk that the Group makes erroneous or incomplete payments to clients, vendors or third parties. This could result from  incorrect client documentation, trade execution, valuation/pricing etc. | Operational |  | [NAME] | Medium | Possible | Reconciliations, matching deals, accountancy balance sheet  procedures | Satisfactory | Low | Unlikely |  |  |  |  |  |  | Low | Unlikely
11.5 | Process Execution Management | Vendors & Suppliers | The risk that Group cannot procure supplies within a timeframe, quality, quantity, or cost that is sufficient to meet client demand.  Also includes the risk that outsourced providers act outside of their intended authority or perform in a manner inconsistent with the company’s business objectives and values. | Operational |  | [NAME] and [NAME] | Low | Unlikely | Monitoring of third party services, agreements | Strong | Low | Unlikely |  |  |  |  |  |  | Low | Unlikely
11.6 | Process Execution Management | Corporate Actions | The risk that corporate actions and dividends are not processed and accounted for in a timely or correct manner. There is also the risk that the wrong decision is taken on corporate actions, or that different decisions are taken for different funds due to a lack of communication between fund managers. | Operational |  | [NAME] and [NAME] | High | Possible | Separate corporate actions and dividends department | Strong | Medium | Unlikely |  |  |  |  |  |  | Medium | Unlikely
11.7 | Process Execution Management | Client Reporting | The risk that client accounting and records are erroneous resulting in incorrect client statements being sent out, or being significantly delayed. | Operational |  | [NAME] and [NAME] | Critical | Possible | Reconciliations | Needs Improvement | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely
12 | Projects and Change
12.1 | Projects and Change | Project Execution | The risk that the Group’s change and other project initiatives fail to deliver planned results or meet major milestones.  This could result from lack of understanding of the project objectives, communication requirements (employee engagement) key risks impacting the project, planning, adequate resourcing for the projects, adaptability to changing situations and events. | Operational |  | [NAME] | Critical | Likely | Project plans, miles stones, clear communications | Needs improvement | High | Possible |  |  |  |  |  |  | Medium | Unlikely |  | Not a separate risk in ICAAP as assessment of every risk on register takes into account current situation and will therefore incorporate any projects.
12.2 | Projects and Change | Business as Usual ("BAU") Impact | The risk that the Group’s focus on projects has an unexpected and detrimental effect on BAU processes.  This could result from an inability to effectively and efficiently transition change and projects to BAU. | Operational |  | [NAME] | Critical | Likely | Project plans, miles stones, clear communications | Needs improvement | High | Possible |  |  |  |  |  |  | Medium | Unlikely |  | Not a separate risk in ICAAP as assessment of every risk on register takes into account current situation and will therefore incorporate any projects.
13 | Market
13.1 | Market | Interest Rate | The risk that the Group’s cost of debt could increase should interest rates fluctuate. | Interest Rate | Little debt remains, impact on income from turn on client money on deposit | [NAME] | Low | Rare | Budgeting | Satisfactory | Low | Rare |  |  |  |  |  |  | Low | Rare
13.2 | Market | Currency | The risk that the Group may incur losses due to foreign exchange exposures that may arise through the receipt of revenues or expenditure in a currency other than the UK Sterling. | Market | No material FX exposures likely | [NAME] | Low | Rare | Monitoring of FX positions | Satisfactory | Low | Rare |  |  |  |  |  |  | Low | Rare
13.3 | Market | Investments | The risk that fluctuations in prices of the Group’s investments are not adequately managed resulting in financial losses such as excessive write-offs or write-downs.  This may include default on bonds. | Market | Minor, old balances in Savoy only | [NAME] | Low | Rare | Monitoring | Satisfactory | Low | Rare |  |  |  |  |  |  | Low | Rare
14 | Liquidity
14 | Liquidity | Funding | The risk that the Group may fail to meet its current or future obligations with access to available cash resources. | Liquidity |  | [NAME] | Critical | Possible | Budgeting & monthly monitoring, Central control of group cash, Scenarios analysed as part of ICAAP,[discussing working capital facility with bank] | Satisfactory | Critical | Unlikely |  |  |  |  |  |  | Critical | Unlikely
15 | Credit | Credit | The risk that an economic or legal entity, including clients,  owing money to  the Group  defaults on its obligations, resulting in financial losses such as excessive write-offs, collections costs, and/or opportunity costs. | Credit |  | [NAME] | Critical | Possible | Credit standards set for banks, Overdue customer fess can be drawn from funds, Monitoring of exposures, Review of write-offs | Satisfactory | Critical | Rare |  |  |  |  |  |  | Critical | Rare
16 | Reporting
16.1 | Reporting | Accounting | The risk that budgets and plans are based upon unreliable data and/or assumptions and as a result are not useful for management as a monitoring tool or lead to poor decisions. This also includes the risk that financial reports required by stakeholders including shareholders, clients, regulators etc are incomplete, inaccurate or untimely, therefore exposing the Group to fines, penalties and sanctions. | Operational |  | [NAME] | High | Likely | Central finance team working on common accounts platform, Experienced team, Well-defined procedures | Strong | Medium | Rare |  |  |  |  |  |  | Medium | Rare
16.2 | Reporting | Taxation | The risk that the Group is not in compliance with tax regulations including payment and filing requirements.  Also includes the risk that the Group does not structure its transactions appropriately so as to avoid excessive taxation. | Legal & Compliance | Provided by KPMG | [NAME] | High | Likely | KPMG complete returns, Group Financial Controller Monitors their service delivery | Satisfactory | Medium | Rare |  |  |  |  |  |  | Medium | Rare
17 | Capital Adequacy | Capital Adequacy | The risk that the Group (is not adequately capitalised in order to meet its regulatory capital requirements and attain its business objectives.  This may result from incorrect interpretations of the capital adequacy rules, incorrect capital adequacy computations, failure to adequately forecast capital requirements etc | Legal & Compliance |  | [NAME] | High | Likely | Monthly monitoring, ICAAP | Satisfactory | High | Rare |  |  |  |  |  |  | High | Rare
18 | Insurance | Insurance | The risk that the Group does not have appropriately comprehensive insurance arrangements in place to manage its exposures. Inadequate insurance arrangements may result from inadequate risk inventory, failure to periodically assess coverage, failure to assess the insurer’s ability and likelihood of settling claims etc. | Insurance |  | [NAME] | High | Possible | Annual review | Satisfactory | High | Rare |  |  |  |  |  |  | High | Rare
19 | Regulatory
19.1 | Regulatory | Current Rules | The risk that a Group does not comply with established laws and regulations either wilfully, or negligently through non compliant procedures, lack of awareness and training, ineffective monitoring unreliable regulatory reporting processes.  Risk exposure for noncompliance could result in significant fines; other government imposed sanctions, higher insurance premiums, as well as damaged reputation. | Legal & Compliance |  | [NAME] | Critical | Unlikely | Compliance managed at Syndicate Group level, with internal compliance management | Needs Improvement | Medium | Possible |  |  | Current procedures and policies being reviewed by Group advisory teams, training schedule being implemented for Sept, Oct and Nov 2010 and on-going | [NAME] [NAME] [NAME] |  |  | Medium | Unlikely
19.2 | Regulatory | Emerging Rules | The risk that the Group fails to consider and plan for emerging laws and regulations that could have a significant impact on its operations and ability to attain its business objectives.  This could result in loss of competitiveness,  opportunities to influence key legislation, opportunities to assess impact on business strategy and objectives etc. | Legal & Compliance |  | [NAME] | Critical | Possible | Review of emerging rules, communication with businesses | Needs improvement | Medium | Possible |  |  | [NAME] being issued but need greater formalisation of process (i.e. [NAME] for which publications?, issue deadlines, action tracking) | [NAME] [NAME] [NAME] |  |  | Medium | Unlikely
20 | Contractual | Contractual | The risk that contractual commitments are not effectively monitored, resulting in legal consequences from breach.  Includes the risk that the Group’s contractual arrangements are not enforceable under law.  Risk exposures relating to contractual risk include loss of service, increased costs, litigation, and the loss of stakeholder confidence. | Legal & Compliance |  | [NAME] | High | Possible | Account management of invoices and approval of invoices, supplier agreements | Needs Improvement | Medium | Possible |  |  |  |  |  |  | Medium | Unlikely
21 | Employment Practices & Workplace Safety
21.1 | Employment Practices & Workplace Safety | Employee Relations | The risk that the Group fails to cultivate and maintain amicable relations with staff consistent with employment law and possibly resulting in industrial action, loss of key staff, management time spent rectifying human resource issues and attending labour tribunals. | Legal & Compliance |  | [NAME] | Medium | Possible | Centralised HR department ensures up-to-date understanding of legislation | Satisfactory | Low | Unlikely |  |  |  |  |  |  | Low | Unlikely
21.2 | Employment Practices & Workplace Safety | Safe Environment | The risk that the Group does not comply with Health and Safety, Public Liability and Employee Liability policies and regulations. | Legal & Compliance |  | [NAME] and [NAME] | High | Likely | New H&S Policies for each office, training and establish H&S Committee | Satisfactory | Medium | Unlikely |  |  |  |  |  |  | Medium | Unlikely
21.3 | Employment Practices & Workplace Safety | Diversity & Discrimination | The risk that the Group does not comply with Equal Opportunity and Human Rights legislation e.g. religious, gender, age, race, ethnicity. | Legal & Compliance |  | [NAME] | Medium | Possible | Equal opportunites & harassment policies, provide training on new legislation | Satisfactory | Medium | Unlikely |  |  |  |  |  |  | Medium | Unlikely
22 | Information Systems
22.1 | Information Systems | Hardware | The risk that the Group’s hardware (e.g. laptops, desktops, servers, networks, mobile equipment etc) fails to operate,  is inadequate or inappropriate for its business operations (e.g. cannot run the business required software).  This could result in limited availability, slow performance etc. | IT |  | [NAME] | Critical | Likely | Modern virtual servers, SAN storage & blade servers | Needs Improvement | medium | Unlikely |  |  | Project Dais | [NAME] | Q2 2011 |  | Medium | Unlikely
22.2 | Information Systems | Software | The risk that the Group’s software fails to operate, is inadequate or inappropriate for its business operations and that it has not been developed in accordance with required standards. Software risks include unstable operations, inaccurate processing, inadequate controls over access/changes, hardware compatibilities, poorly defined functionality etc. | IT |  | [NAME] | Critical | Likely | IT Strategy | Needs Improvement | High | Possible |  |  | Legacy applications need updating to meet new business priorities. The key projects to address the business priorities are Program Simple. Project Opus and the 1st AO merger. | [NAME], [NAME], [NAME] for the Operations/Middle Office component of Program Simple. [NAME] for the TFS implementation, [NAME] for the 1st AO merger and [NAME] for Project Opus. | Implementation dates for the Operations/Middle Office component of Program Simple have still to be defined. As agreed with [NAME] a Business Case for TFS will be produced by the end of September 2010 which will provide an idicative timeframe. Project Opus is being re-planned and a new timeline will be released no later than September. 1st AO is due to complete November 2010. |  | Medium | Unlikely
22.3 | Information Systems | IT Operations | The risk that Group IT processes and procedures do not maintain a stable environment, respond to problem and issues and provide sufficient user support . | IT |  | [NAME] | High | Likely | Centralised team | Needs Improvement | High | Possible |  |  | Little change capability, BAU support is 'surviving'. Move to ITIL, drive out target service levels and thus resourcing & outsourcing options. | [NAME] | Q2, 2011 |  | Medium | Unlikely
22.4 | Information Systems | Information Systems & Strategy | The risk that the Group has not defined or failed to define adequately its information system stratey resulting in failure to meet business objectives and give it a competitive advantage.  This may result from an incorrect assessment of its current and future business requirements, its current capabilities and gap in IT operations, IT projects prioritisation and implementation etc. | IT |  | [NAME] | High | Likely | IT Strategy | Needs Improvement | Medium | Likely |  |  | Not yet possible to validate IT Strategy document produced in May 2009 against a detailed Business Strategy | [NAME] |  |  | Medium | Unlikely
23 | Information Security | Information Security | The risk that the Group has not adequately secured its information systems from accidental damage, unauthorised access, theft, sabotage etc e.g. hacking, theft of information, viruses. | IT |  | [NAME] | High | Likely | Benchmarked to ISO27001, Encrypted laptops & removeable media, Locked down third party access, Anti-virus, Firewalls | Needs Improvement | High | Unlikely |  |  | Need to address the resourcing of this function. In the meantime a "piecemeal" approach is being adopted. | [NAME] (Interim) |  |  | Medium | Unlikely
24 | Information Management
24.1 | Information Management | Maintenance | The risk that protecting the Groups information is not kept confidential, its integrity is not maintained and is not organised in a readily available manner. | IT |  | [NAME] | Medium | Unlikely | Formal procedures, client files disciplines /structures | Needs Improvement | Medium | Unlikely |  |  | Need to address the resourcing of this function. In the meantime a "piecemeal" approach is being adopted. | TBD |  |  | Medium | Unlikely
24.2 | Information Management | Sharing | The risk that training and knowledge sharing programs are ineffective and  that intellectual and/or proprietary information is not safeguarded to prevent unauthorised or unethical use.  Exposure to this risk could result in repeated mistakes, poorly trained or motivated employees, as well as loss of competitive advantage, market share and revenue stream. | IT |  | [NAME] | Medium | Unlikely | Formal procedures, client files disciplines /structures / procedures documented | Needs Improvement | Low | Possible |  |  | Need to address the resourcing of this function. In the meantime a "piecemeal" approach is being adopted. | TBD |  |  | Medium | Unlikely
 |  |  |  |  |  |  |  |  |  |  |  | Score for ExCo Balance Scorecard % of risks with a statement of risk appetite of 'Tolerated' or 'Unacceptable' where either no planned action has been recorded on the Risk Register or where the planned action has exceeded the recorded planned action deadline.
 |  |  |  |  |  |  |  |  | Score | Statement of Risk Appetite
 |  |  |  |  |  |  |  |  | 1.1 | Acceptable |  | No. of Acceptables
 |  |  |  |  |  |  |  |  | 2.1 | Acceptable |  | Total number of risks | 73
 |  |  |  |  |  |  |  |  | 2.2 | Acceptable |  | Difference
 |  |  |  |  |  |  |  |  | 3.1 | Acceptable |  | Sum of column R
 |  |  |  |  |  |  |  |  | 3.3 | Acceptable
 |  |  |  |  |  |  |  |  | 4.1 | Acceptable
 |  |  |  |  |  |  |  |  | 4.2 | Acceptable
 |  |  |  |  |  |  |  |  | 4.4 | Tolerated
 |  |  |  |  |  |  |  |  | 6.2 | Acceptable
 |  |  |  |  |  |  |  |  | 6.3 | Tolerated
 |  |  |  |  |  |  |  |  | 8.2 | Tolerated
 |  |  |  |  |  |  |  |  | 8.4 | Tolerated
 |  |  |  |  |  |  |  |  | 9.3 | Tolerated
 |  |  |  |  |  |  |  |  | 12.3 | Tolerated
 |  |  |  |  |  |  |  |  | 12.4 | Unacceptable
 |  |  |  |  |  |  |  |  | 16.4 | Unacceptable
 |  |  |  |  |  |  |  |  | Likelihood | Score
 |  |  |  |  |  |  |  |  | Rare | 1.1
 |  |  |  |  |  |  |  |  | Unlikely | 2.1
 |  |  |  |  |  |  |  |  | Possible | 3.1
 |  |  |  |  |  |  |  |  | Likely | 4.1
 |  |  |  |  |  |  |  |  | Impact | Score
 |  |  |  |  |  |  |  |  | Low | 1
 |  |  |  |  |  |  |  |  | Medium | 2
 |  |  |  |  |  |  |  |  | High | 3
 |  |  |  |  |  |  |  |  | Critical | 4