Risk identification, classification and risk registers
What the exam tests
Risk identification and classification: sources, taxonomies and register design. SP9 tests whether you can produce a usable register, not a list of worries.
Core rules
- Identification methods: process mapping, workshops, loss-event data, near misses, control self-assessment, scenario analysis, bow-tie analysis, horizon scanning and external data.
- A risk statement should contain cause, event and impact; 'lack of a backup site' is a cause or control gap, not an event.
- Classification often follows financial, operational, strategic, insurance/underwriting, conduct and emerging categories; choose a taxonomy that supports aggregation and reporting.
- Register fields: unique ID, risk description, cause, event, impact, inherent and residual likelihood/impact, controls, control effectiveness, risk owner, appetite reference, KRIs, review date and linked risks.
- Risks should be recorded at a consistent granularity; too many near-duplicates prevent aggregation.
Worked example
In claims, staff key payments manually. A register entry says: 'Manual keying error causes duplicate claim payment, leading to financial loss and reputational damage.' Controls: system duplicate check and supervisor review. Residual rating is lower than inherent. Reasoning: the description separates cause (manual keying), event (duplicate payment) and impacts. The control directly addresses the event. Recording 'manual keying' as the risk itself would obscure what is being managed and make control testing impossible.
Traps
Register entries that are control failures; undefined 1-5 scales; no named owner; stale entries; double counting the same risk across departments; ignoring dependencies such as a common supplier.