Risk register

Enterprise risks, their inherent and residual ratings, and the controls that mitigate them.

7

Risks

on the register

1

High / Critical

residual rating

2

Outside appetite

breach risk appetite

5

Open

actively managed

Risks7

ID	Risk	Category	Inherent	Residual	Trend	Controls	Status
R-001	Critical ICT third-party concentration ● Outside appetite	Third-party / Operational	Critical	High		C-022C-031	Open
R-002	Inadequate ICT incident detection & reporting Within appetite	Operational resilience	High	Medium		C-014	Open
R-003	Privileged access misuse Within appetite	Information security	High	Low		C-001	Open
R-004	Backup & recovery failure Within appetite	Operational resilience	High	Medium		C-031	Open
R-005	Data subject rights non-compliance ● Outside appetite	Data protection	Medium	Medium		C-067	Open
R-006	Financial crime — high-risk onboarding Within appetite	Financial crime	High	Low		C-045	Monitoring
R-007	Board ICT governance gap Within appetite	Governance	Medium	Low		C-001C-014	Closed