Risk Management and Quality Assurance
Risk Management and Quality Assurance tests whether you can design controls, test whether they actually operate, and turn incidents and complaints into systemic improvement. Questions often present a control that exists on paper but fails in practice, and ask you to identify the missing element.
Risk framework
- A risk register records likelihood, impact, owner, and treatment (avoid, reduce, transfer, accept). It is a live document, reviewed on a cycle and after incidents.
- Control design and control operation are distinct: a documented dual-authorisation rule that everyone bypasses is an operating failure, not a design failure.
- Insurance transfers some risk but never all of it; exclusions, notification duties, and deductible levels matter.
Quality assurance
- File reviews use a defined sample, a published checklist, and a scoring method. Results are aggregated, not just filed.
- Complaints are free risk intelligence: categorise by cause (communication, delay, cost, outcome) and trend them over time.
- Root cause analysis asks why the control failed, repeatedly, until a systemic cause is found - not who to blame.
- Corrective actions need an owner, a deadline, and a verification step.
Continuity and reporting
- Business continuity planning covers loss of premises, systems, key people, and records, with tested recovery steps.
- Serious incidents are reported internally and, where required, to the regulator, insurer, or data authority within defined timeframes.
Worked example
A quarterly file review finds three matters where a limitation date was missed. The initial response - retraining the junior who diarised them - is inadequate. The root cause analysis shows dates were entered only in individual Outlook calendars, with no central register and no independent check. The corrective action is a central limitation register with a second-person verification step, plus a re-audit in the next cycle to confirm the control operates.
Traps that cost marks
- Offering retraining as the fix for a systems failure.
- Treating an existing policy as proof the control works.
- Analysing complaints individually and never aggregating them.
- Assuming insurance covers every consequence of a claim.