Enterprise-Wide Risk Assessment for Financial Firms

What SYSC 4 and SYSC 7 actually require

The starting point is SYSC 4.1.1R. It requires a firm to have robust governance arrangements, which include a clear organisational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks it is or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems. The words 'the risks it is or might be exposed to' are the whole point: the duty is enterprise-wide, not confined to any single risk type.

SYSC 7 turns that into a risk-control programme. SYSC 7.1.2-AR requires a common platform firm to establish, implement and maintain adequate risk management policies and procedures which identify the risks relating to the firm's activities, processes and systems and, where appropriate, set the level of risk tolerated by the firm. SYSC 7.1.3R then requires the firm to adopt effective arrangements, processes and mechanisms to manage that risk, in light of the level of risk tolerance the firm has set. Identify the risks, set the tolerance, then manage against it: that is the spine of an enterprise-wide assessment.

Governance sits on top. SYSC 7.1.4R requires the management body to approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks the firm is or might be exposed to, including those posed by the macroeconomic environment. SYSC 7.1.5R requires the firm to monitor the adequacy and effectiveness of its risk management policies and procedures and the level of compliance with them. Where appropriate and proportionate to the nature, scale and complexity of its business, SYSC 7.1.6R requires the firm to maintain a risk management function that operates independently. These rules apply as guidance for many smaller firms, but the expectation to identify and manage firm-wide risk in a proportionate way runs across the population.

Enterprise-wide versus a financial-crime risk assessment

Firms often conflate the two, and supervisors notice when they do. A financial-crime risk assessment is a specialist, legally mandated document with a defined scope. Regulation 18 of MLR 2017 requires a relevant person to take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject, taking into account information made available by its supervisory authority and risk factors relating to its customers, the countries or geographic areas in which it operates, its products or services, its transactions and its delivery channels. The firm must keep an up-to-date written record of the steps taken and provide the assessment to its supervisor on request.

An enterprise-wide risk assessment is wider in scope and different in purpose. It covers financial crime as one category among several, and its job is to give the board a consolidated picture across credit, market, operational, conduct, prudential, strategic and financial-crime risk. The FCA's Financial Crime Guide reinforces the relationship: FCG 2.2.1 expects senior management to take clear responsibility for managing financial crime risks, which should be treated in the same manner as other risks faced by the business. In other words, financial crime is not a silo; it belongs inside the same enterprise-wide framework as everything else.

The practical consequence is that the financial-crime assessment should feed the enterprise view rather than duplicate it. FCG 2.2.4 states that a business-wide risk assessment should be comprehensive, draw on a wide range of relevant information, and be proportionate to the nature, scale and complexity of the firm's activities. Those same qualities define a credible enterprise-wide assessment. Our Control module is designed to hold both layers so the specialist assessment rolls up into the firm-wide view without being re-keyed.

The main risk categories to cover

An enterprise-wide assessment is only credible if it covers the full risk taxonomy relevant to the firm. The categories below are the ones commonly used across regulated firms and reflected in the FCA Handbook's risk-control framework. Not every firm carries every category in material size, and proportionality applies, but the assessment should consciously consider each and record why any are out of scope. SYSC 7.1.2-AR frames the task as identifying the risks relating to the firm's activities, processes and systems, which forces a business-model lens rather than a generic checklist.

For each category you name the specific exposures your business model creates, then assess likelihood and impact before and after controls. The table sets out the categories with example risks. Treat it as a prompt list, not a limit; your own products, customers, markets and outsourcing arrangements will suggest others. Where a category such as financial crime already has a dedicated assessment under Regulation 18, the enterprise view should reference and summarise it rather than repeat the detail.

The point of the taxonomy is comparability. When every category is scored on the same likelihood-and-impact basis, the board can rank them against each other and against appetite, and decide where mitigation spend does the most good. That comparability is what turns a pile of individual assessments into a genuine enterprise-wide picture.

Inherent risk, controls and residual risk

A defensible assessment scores each risk twice. Inherent risk is the exposure before any controls are applied, judged on likelihood and impact. Residual risk is what remains after your controls operate as designed. The gap between the two is the measurable value of your control environment, and it is exactly what SYSC 7.1.5R asks you to monitor when it requires firms to check the adequacy and effectiveness of their risk management policies and procedures and the level of compliance with them.

Score inherent risk first, on a consistent scale, without giving yourself credit for controls. Then assess control effectiveness honestly: a control that exists on paper but is untested, poorly staffed or routinely overridden should not reduce the score much. Residual risk is the output, and it is the number the board compares against appetite. If residual risk sits above appetite, you have a gap that needs a remediation action with an owner and a date; if it sits well below, you may be over-controlling and spending resource that could move elsewhere.

A risk heatmap makes this legible for a board. Plotting residual risks by likelihood and impact turns a long register into a single picture of where the firm is most exposed. The heatmap below is illustrative of the cell structure, not a statement about any particular firm; each cell is a likelihood-and-impact combination with a colour that signals priority.

Risk appetite frames the whole exercise

Scoring risk is only useful if you can say whether the level is acceptable, and that is the job of risk appetite. Appetite is the amount and type of risk the firm is willing to take in pursuit of its objectives, set by the board and expressed for each material category. SYSC 7.1.2-AR anchors this in rule: firms must, where appropriate, set the level of risk tolerated by the firm. Without a stated appetite, a heatmap is just colours; with one, every residual score becomes a pass, a watch or a breach.

A workable appetite statement is specific enough to test against. For credit risk it might cap exposure to a single sector; for operational risk it might set a tolerance for system downtime; for conduct it might state that certain customer-harm outcomes are simply not acceptable. SYSC 7.1.3R connects appetite to action by requiring firms to adopt effective arrangements, processes and mechanisms to manage risk in light of the level of risk tolerance set. Appetite that is never used to trigger a control or an escalation is decorative.

Appetite also has to be owned at the top and reviewed. SYSC 7.1.4R requires the management body to approve and periodically review the strategies and policies for managing the risks the firm is or might be exposed to. In practice that means the board signs off the appetite, sees the enterprise-wide assessment measured against it, and revisits both when the business model, the market or the regulatory environment changes.

How to run an enterprise-wide risk assessment

The mechanics matter as much as the framework. A repeatable process keeps the assessment current, defensible and useful to decision-makers rather than a once-a-year artefact. SYSC 7.1.4R expects the management body to review risk strategies periodically, and FCG 2.2.4, though written for financial crime, captures the wider expectation well: assessments should be comprehensive, draw on a range of information and be proportionate to the firm's activities. The steps below turn those expectations into a working cycle.

Work through the taxonomy category by category, score inherent and residual risk consistently, compare against appetite, and route the output to the board with clear owners for any gaps. Then schedule the refresh and the triggers that force an out-of-cycle update, such as a new product, a major outsourcing arrangement or a significant regulatory change. If you want to see how this runs inside a live workflow, request a demo and walk through a worked assessment.

Governance and the three lines of defence

An enterprise-wide assessment only works if responsibility for it is clear, and the three-lines model is the standard way UK firms organise that. The Institute of Internal Auditors updated the model in July 2020 as the Three Lines Model, an evolution of the older Three Lines of Defence. It maps who owns risk, who oversees it and who provides independent assurance, which is exactly the clarity SYSC 4.1.1R demands when it requires well defined, transparent and consistent lines of responsibility.

In the model, first line roles are most directly aligned with the delivery of products and services to clients, and responsibility for managing risk remains a part of those first line roles. Second line roles assist with managing risk, providing complementary expertise, support, monitoring and challenge, and can span a broader responsibility such as enterprise risk management. The internal audit function forms the third line, providing independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management, and reporting its findings to management and the governing body.

Above the three lines sits the board. The IIA model states that the governing body delegates responsibility and provides resources to management while ensuring legal, regulatory and ethical expectations are met, and establishes and oversees an independent internal audit function. That mirrors SYSC 7.1.4R, under which the management body approves and periodically reviews the firm's risk strategies. For firms still building this structure as part of an authorisation application, mapping governance and risk ownership clearly before you submit avoids a common source of FCA challenge.

Conclusion

An enterprise-wide risk assessment is not a compliance document to be filed and forgotten. It is the mechanism by which a board sees every material risk in one comparable picture, scores it against a stated appetite, and directs mitigation to where it matters most. SYSC 4.1.1R requires the effective processes to identify, manage, monitor and report the risks the firm is or might be exposed to, and SYSC 7 turns that into a programme of setting tolerance, managing against it, monitoring effectiveness and reviewing at board level. The financial-crime risk assessment under Regulation 18 of MLR 2017 is an important input, but it is one category inside this wider view, not a substitute for it.

Build the assessment on a clear taxonomy, score inherent and residual risk consistently, frame everything with a testable risk appetite, and hold it inside a three-lines governance structure with genuine board ownership. Refresh it on cycle and whenever the business or its environment changes materially. Done that way, the enterprise-wide risk assessment becomes what the FCA's rules intend: a living tool that makes the firm's risks visible and manageable, rather than a snapshot that ages the day it is signed.

Frequently asked questions