The Approach That Outgrew the Firm
Northgate Payments is a UK-regulated fintech that has grown from 80 to 300 staff in two years. Its risk management approach was written eighteen months ago by a chief risk officer who has since left. The board-approved appetite statement says the firm has 'low appetite for regulatory breach' but does not define thresholds. Product teams record risks in their own Jira labels; procurement manages third-party risk in a separate spreadsheet; there is no common risk taxonomy. A recent outage at a payment processor was logged as an IT incident but not escalated as a risk, although client money reconciliation was manual for two days. The new CRO has three risk staff, no budget for a new GRC tool, and four months before a supervisory review. The board has asked for a review of the approach and a plan to make it operate consistently across the firm.
1. Diagnose the weaknesses in Northgate's risk management approach. Structure your answer around the elements an M_o_R approach should define, not just the symptoms.
Read the worked answer
Approach elements and the gaps
Risk appetite and thresholds. 'Low appetite for regulatory breach' is a sentiment, not an operating instruction. Without thresholds, product teams cannot tell when a risk needs escalation, and the board cannot test whether appetite is being breached.
Taxonomy and scope. Jira labels and a procurement spreadsheet are not a taxonomy. Risks cannot be aggregated, compared or reported consistently. Third-party risk sits outside the main approach even though the outage showed a direct client-money consequence.
Roles and accountability. It is unclear who owns third-party risk, who escalates an outage, and what the CRO's mandate is. The absence of named owners is a design gap, not a discipline problem.
Process and escalation. The outage was an incident, but its risk implications - manual reconciliation, potential client-money error, regulatory notification - were not assessed. The approach lacks a route from incident to risk and from operational team to board.
Reporting and review. No single view exists, so the board cannot see concentration. The approach was written for an 80-person firm and has not been reviewed after growth or the CRO's departure.
Training and communication. Product teams inventing their own labels indicates no common language or training.
The symptoms are consequences of an approach that was never designed for the current scale, regulated activity and third-party dependency.
2. Propose a four-month refresh plan. Justify the sequencing and identify what you would leave unchanged.
Read the worked answer
Four-month plan
Month 1 - Appetite into thresholds. Work with the board to convert the regulatory appetite statement into risk categories and escalation thresholds, starting with regulatory, client-money and operational-resilience risks. Deliverable: approved categories and thresholds.
Month 2 - Roles and third-party integration. Define risk owners at executive and function level, risk actionees, and an escalation route. Bring the procurement spreadsheet into the common register with the commercial and operations leads. Deliverable: role descriptions and a third-party risk process.
Month 3 - Pilot and training. Pilot the common process in one product line plus finance and operations. Train risk champions, align incident reporting with risk reporting, and test the escalation route with a simulated processor outage. Deliverable: pilot report and training record.
Month 4 - Board approval and evidence. Refresh the approach document, agree a simple dashboard, and run an internal dry run of the supervisory evidence pack. Deliverable: approved approach and board dashboard.
Why this sequence
A supervisory review will look for governance, clear accountability, regulatory risk control and third-party oversight. The sequence builds evidence early, uses a pilot to reduce disruption, and avoids a big-bang roll-out with three staff and no tool budget.
What I would leave unchanged
Keep Jira and the procurement spreadsheet as data sources rather than replacing them with a GRC tool. Keep the board's appetite wording but add thresholds underneath it. Do not rewrite every policy; focus on the approach, roles, taxonomy and escalation.