Identify gaps in your operational risk framework and prioritise improvements with this practical checklist. Designed for risk and compliance leaders, it helps you assess your current approach, strengthen oversight and focus action where it matters most.
Why this, why now
Your framework exists.
Can you prove it works?
A policy and a risk register aren't evidence. When the board, internal audit or the FCA asks how you know your key controls are effective, they expect to see named owners, tested controls and issues closed for good.
This checklist is for heads of risk, compliance, governance and operational resilience at banks, insurers, pensions, hedge funds, asset and wealth managers, e-money and payment firms, and other regulated firms.
Could we evidence the challenge our board gave on risk appetite?
Does every key risk and control have a named, accountable owner?
Would our KRIs warn us before a breach, or after?
Are closed issues actually fixed, or just closed?
What you'll come away with
17 statements. A clearer view of your framework.
✓Where your framework is strong
What you can already evidence with confidence.
✓Where the gaps are
The statements you can't yet tick without hesitation.
✓Where to focus first
Proportionate to your firm's nature, scale and complexity.
✓A sharper board conversation
Grounded in evidence, not assumption.
Download it to assess
Five areas regulators and auditors will test
01
Governance and risk appetite
Board-approved limits, evidenced challenge and a named owner for every key risk.
02
Risk identification
One taxonomy, change-triggered RCSAs and emerging risks like AI, cyber and fraud.
03
Controls and testing
Controls mapped to obligations, tested by the first line, challenged by the second.
04
Monitoring and reporting
KRIs, incident data and board reporting that lead to recorded decisions.
05
Remediation and assurance
Issues tracked to closure, fixes proven to stick, and independent assurance.
