Everyone's risk, no one's owner
A UK retail bank is nine months into a payments platform replacement. One risk - failure to produce complete regulatory reporting evidence for the new platform - is recorded as owned by the Head of Change, who has delegated all risk activity to a PMO analyst. The analyst can request information but cannot commit testing resources or change the release plan. The 'risk actionee' field names the outsourced testing vendor. The risk has been rated amber for 11 months; its response is 'tighten controls'. Internal audit sampled 12 risks and found that nine owners could not describe their risk's response, current rating or the appetite it should be judged against; four said they had never seen the register. A separate PCI DSS evidence risk sits between Finance and Technology, and each function says the other owns it. The board risk committee has asked who is accountable.
1. Explain what is wrong with the current allocation of risk owner and risk actionee, and propose a corrected allocation for the regulatory reporting risk.
Read the worked answer
The roles are being confused. In MoR the risk owner is accountable for the risk: understanding it, ensuring it is assessed, agreeing the response, monitoring it, and reporting or escalating. The risk actionee carries out specific actions but does not own the risk. Accountability cannot be delegated to someone who lacks the authority to act.
Three specific faults. First, the Head of Change has delegated the whole role to a PMO analyst who can only request information. That is delegation of accountability, which is not possible; at most the analyst provides support (data quality, reporting, scheduling). Second, naming the outsourced vendor as risk actionee for an internal regulatory obligation is wrong in kind: the vendor may perform testing actions, but accountability and the actionee role for producing internal evidence stay inside the bank. Third, 'tighten controls' is not a response - it names no action, date or resource.
Corrected allocation. Owner: the executive accountable for regulatory reporting (for example the CFO or Head of Regulatory Reporting), because that is where the obligation sits. Actionee: a named manager in Finance for the evidence pack, plus a named manager in Change for platform-dependent actions; the vendor can be an actionee for specific testing tasks. The PMO analyst supports. The response should be a dated plan with named actions, resources and a trigger for escalation if the evidence pack is not complete by a set date.
2. How should the PCI DSS risk that spans Finance and Technology be owned? Set out the options and give a recommendation.
Read the worked answer
Option A - single owner at the level where the objective sits. If PCI DSS compliance is a Finance obligation, Finance owns the risk and Technology is actionee for control design and operation. This gives clear accountability but risks Finance being unable to direct Technology work.
Option B - split the risk into distinct risks at the point where each objective is affected. One risk about control design and operation (owned in Technology), one about evidence, attestation and reporting (owned in Finance), linked by a shared cause. Each owner has authority over their part. This is usually the most workable, provided the link is visible so that nobody assumes the other part covers the whole obligation.
Option C - joint ownership with a lead owner. Attractive on paper, but joint accountability tends to produce no accountability when the two functions disagree, which is exactly the current symptom.
Recommendation. Split into two linked risks with named owners, and appoint a lead for the end-to-end obligation who is accountable for the aggregate position and reports to the board risk committee. In MoR terms, risk should be owned where the objective is affected and where the owner has authority to act. If the two functions cannot agree the split, escalate the ownership question itself - unresolved ownership of a regulatory risk is a reportable risk in its own right.
3. Describe what the Head of Change should actually do as risk owner if the role is to be more than a name.
Read the worked answer
Know the risk. Be able to state the cause, the event, the effect, and the objective threatened - here, the obligation to demonstrate regulatory reporting evidence for the new platform. Be able to explain why the current rating is amber and what would move it.
Challenge the assessment. Confirm the probability and impact rather than accepting them, and check them against appetite. An 11-month amber with no movement is evidence that the response is not working; the owner should treat that as a signal, not a status.
Choose and resource a response. Decide between avoid, reduce, transfer and accept, and secure the resources: testing capacity, release-plan changes, specialist input. 'Tighten controls' must become named actions with dates and owners.
Ensure implementation. Track actions, not just colour. Define indicators and triggers, such as 'if the evidence pack is not complete by the release candidate date, escalate to the board risk committee'.
Report and escalate. Report against the plan and against appetite, and escalate when authority or resource is missing. If the owner cannot commit the resources, the risk should be owned one level higher.
Close or transfer consciously. Confirm when the risk is genuinely reduced and record the residual position.