RCSA scoring drift and an inoperable risk appetite at a wealth manager

Diagnosis The outputs are not comparable because the scale has labels but no anchors. 'Low' and 'high' mean different things to Operations and Finance, so the same risk can sit two or three points apart without either assessor being dishonest. The 38% 'medium' result is a classic clustering effect: without defined impact and likelihood criteria, assessors avoid the extremes.

The process is also unit-by-unit and bottom-up only. There is no calibration between units, no independent challenge and no top-down view of the firm's major risks. The register is disconnected from incident data: 11 incidents and £640,000 of losses should have prompted reassessment, particularly the two client money breaks. A register that does not move when losses occur is not being used as a risk tool.

Changes

• Define impact anchors in money and regulatory terms (for example, client loss, compensation, regulatory breach, reputational impact) and likelihood anchors in expected frequency.
• Require each risk to be scored on inherent risk, control effectiveness and residual risk, with evidence for the control rating.
• Run calibration workshops across units and have risk function challenge the top and bottom scores.
• Reconcile the register to losses, near misses, audit findings and regulatory issues each quarter.
• Add a small top-down set of firm-level risks so the board can see aggregation and concentration.

The board should be told that the current heat map is a first attempt, not a reliable measure. Presenting it as reliable would be worse than presenting the limitations.

Evaluation Zero tolerance is a legitimate principle but it is not an operable appetite statement. It does not define what a breach is, how it is measured, who declares it or what happens when one occurs. In practice the firm has already had two client money reconciliation breaks and no one has classified them as appetite breaches, which shows the statement is not being used.

A zero-tolerance principle can sit above a measurable metric. The metric should capture the outcome the firm cares about: client money not being protected or reconciled within the required time.

Proposed metric

• Primary: number and value of unreconciled client money differences, and the age of the oldest unreconciled item.
• Secondary: percentage of client money accounts reconciled within the required frequency; number of late reconciliations; number of breaks caused by process failure rather than timing.

Thresholds

• Green: no difference above £1,000 and all reconciliations completed within deadline.
• Amber: any difference between £1,000 and £10,000, or any reconciliation more than 24 hours late; escalation to the CRO and remediation within five business days.
• Red: any difference above £10,000, any difference older than five business days, or any breach of the client money rules; immediate escalation to the board risk committee, a breach record and a root-cause review.

Reasoning The thresholds must be set by reference to the firm's size and the harm caused, not copied from another firm. The existing incidents should be reclassified against the new metric so the board can see the starting position. The statement should then say: 'The firm has no appetite for client money breaches; any red threshold event is treated as an appetite breach.' That preserves the principle while making it testable.

Escalate

• The methodological limitations of the first RCSA, so the board does not place false reliance on the heat map.
• The disconnect between the register and the 11 incidents, including the two client money breaks.
• The fact that the 'zero tolerance' statement has no metric and that events have occurred without an appetite breach being declared.
• The proposed remediation plan, owners and dates, with a second-line view of whether the first line can deliver it.

The CRO should be explicit that the issue is not simply that a control failed; it is that the firm cannot yet demonstrate whether its controls are effective. That is a governance and measurement issue as much as a control issue.

Do not present as a control failure The absence of a linked incident for every risk is not itself proof that controls failed. Some incidents may relate to risks not yet on the register, and some register risks may not have crystallised. The CRO should distinguish between:

• known control failures (for example, a reconciliation not performed);
• measurement gaps (the incident was not linked because the taxonomy is immature); and
• appetite gaps (no threshold existed to trigger escalation).

Conflating these will produce a punitive response and discourage incident reporting. The right tone is that the firm is building the evidence base and needs better data, not that staff have been concealing failures. The board should approve the remediation plan and receive a progress report before the next RCSA cycle.