Is there a risk register template the FCA expects you to use?

No. The FCA does not prescribe a risk register template. It expects firms to have adequate systems and controls and to be able to show how they identify, assess, manage and monitor their risks. The fields in this article are what typically makes that demonstrable. What matters is that your register reflects your firm's actual risks and is used in decision-making. A well-formatted template with stale entries will not help you.

How often should a risk register be reviewed?

Most regulated firms review their principal risks at least quarterly, with more frequent review for risks outside appetite. You should also review a risk when something changes it, such as an incident, a failed control test, a new product or a regulatory change. The review date field makes this visible. An overdue review is itself a finding.

What is the difference between inherent and residual risk in a register?

Inherent risk is your exposure before controls, and residual risk is your exposure after the controls you rely on. The difference between them represents the work your controls are doing. That difference should be supported by control test results. If it is not, the residual score is an assumption.

Can a spreadsheet work as a risk register for a regulated firm?

Yes. A spreadsheet can work, particularly for smaller firms with a modest number of risks, and it can hold every field described here. The limits tend to show as the firm grows: keeping a reliable change history, linking evidence, controlling who edits what, and producing board reporting without manual consolidation. Those are the points at which firms usually consider dedicated tooling.

How many risks should be on a risk register?

There is no correct number. The register should hold enough risks to cover your firm's material exposures at a level where each one can be owned, scored and controlled. Too few and risks are too broad to assess. Too many and the register becomes a list nobody reviews.

Back to Articles and Learning

Risk Management12 min read

Risk Register Example: The Fields a Regulated Firm Needs

Elliot Poublan

Nov 3, 2026

Risk Register Example: The Fields a Regulated Firm Needs

Most people searching for a risk register example already have one. It is usually a spreadsheet. Internal audit reviewed it last year and the finding was minor: a few review dates had slipped. Every row had an owner, a likelihood score, an impact score and at least one control.

Then the board risk committee met. A non-executive director asked three things. Which risks are outside appetite right now? Of the controls listed, which were tested this year and what did the tests find? And why did the top operational risk move from amber to green since the last meeting? Nobody could answer from the register. It recorded where each risk stood, not why, and not on what evidence.

That is the gap this article closes. The layout of your register rarely matters much. The fields do. What follows is the list of fields an FCA or PRA regulated firm's register needs, the reason each one exists, and a way to check your own register against it before the next review.

In short

A risk register for a regulated firm needs a risk description tied to a taxonomy, a named accountable owner mapped to SM&CR responsibilities where relevant, inherent and residual scores on a defined scale, the controls relied on with their last test result, appetite status, actions with owners and dates, a review date, and a change history that shows how each risk moved.

The core fields make the register usable day to day.
The regulated-firm fields (SM&CR mapping, regulatory mapping, change history, evidence links) make it defensible to a regulator, an auditor or a board.
An enterprise risk register is not a project risk log, and the fields differ.
The most common failure is listing controls that nobody has tested, which makes the residual score an opinion rather than a finding.

What Should a Risk Register Example Include?

A risk register is the single record of the risks your firm has identified, who owns them, how they are assessed and what is being done about them. For a regulated firm, these are the core fields.

Field	What it holds	Why it exists
Risk ID	A unique, stable reference	So actions, incidents, controls and board papers can point to the same risk over time
Description	Cause, event and consequence	So everyone reads the risk the same way and can tell it apart from its neighbours
Taxonomy category	Where the risk sits in your firm's risk taxonomy	So you can aggregate, spot gaps and report by category
Accountable owner	One named person, not a team	So someone answers for the risk and its actions. Naming a person is the start of real ownership.
Inherent score	Impact and likelihood before controls	To show how much the controls are doing
Residual score	Impact and likelihood after controls	To show where the firm actually stands
Controls relied on	Each control, its owner and last test result	To show the residual score rests on evidence
Appetite status	Within, at or outside appetite	So the board sees what needs a decision. The threshold comes from the appetite statement.
Actions	What will be done, by whom, by when	So outside-appetite risks have a route back
Review date	When the risk was last reviewed and when it is next due	So stale entries are visible

The description is where most registers are weakest. A taxonomy is the agreed, hierarchical list of risk categories your firm uses, such as operational, conduct, credit and financial crime, each broken into sub-categories. Writing each risk as cause, event and consequence against that taxonomy stops two things happening: vague entries such as "cyber risk" that nobody can assess, and duplicates that sit under different names in different departments.

How Should You Score Inherent and Residual Risk?

Inherent risk is the exposure before you take account of any controls. Residual risk is the exposure that remains once the controls you rely on are working as designed.

You need a defined scale, written down, with descriptors for every point. A five by five matrix is common in practice, but the number of points matters less than the descriptors. Impact descriptors should cover the dimensions your firm cares about, typically financial loss, customer harm, regulatory consequence and operational disruption. Likelihood descriptors should state a timeframe. Without descriptors, a score of 3 means whatever the person filling in the row thought it meant that afternoon.

The gap between inherent and residual is a claim about your controls. If a risk drops from 16 to 4, the register should make it obvious which controls carry that reduction and whether they have been tested. Some firms also record a target score, the level they intend to reach once open actions close. That is useful, provided it is clearly labelled and never mistaken for the current position.

What Do FCA and PRA Regulated Firms Add?

The core fields are enough for a well-run unregulated business. Regulated firms are held to account for how they reached their view, not just the view itself. Four additions do most of that work.

SM&CR responsibility

Under the Senior Managers and Certification Regime, each Senior Manager has a Statement of Responsibilities setting out what they are accountable for. Mapping each material risk to the relevant Senior Manager and the part of their Statement of Responsibilities makes accountability traceable. The day-to-day owner can sit below that, often a head of function, but the chain should be visible in the register rather than reconstructed when someone asks.

Regulatory mapping

Regulatory mapping links each risk, and ideally each control, to the rules and obligations it relates to. For many firms that includes the Consumer Duty (PRIN 2A), systems and controls requirements in SYSC, the operational resilience rules in SYSC 15A where they apply, and sector rules such as CONC for consumer credit. Mapping lets you answer "what are we doing about this obligation" from the register, and shows where an obligation has no risk or control against it.

Change history

A change history records every movement in a score, owner or status, with who changed it, when and why. This is what the non-executive in the opening scene needed. In practice, the reason field matters more than the timestamp. "Residual reduced after control test passed" is an answer. A score that simply changed is not.

Evidence links

Evidence links connect the register to the workpapers behind it: control test results, attestations, management information, incident records. Auditors and supervisors typically test the register by following these links. If the evidence lives in someone's inbox, the register cannot stand on its own.

Enterprise Risk Register vs a Project Risk Log

People often search for a template and find a project risk log. They look similar. They do different jobs.

	Enterprise risk register	Project risk log
Purpose	Records the firm's ongoing risk profile	Records threats to delivering one project
Lifespan	Permanent, reviewed on a cycle	Closes when the project closes
Owner	Named accountable owner, often linked to a Senior Manager	Project manager or workstream lead
Scoring	Inherent and residual on the firm's defined scale	Often a single score, sometimes on a project-specific scale
Controls	Ongoing controls with test results	Mitigating actions, usually one-off
Appetite	Assessed against board-approved appetite	Assessed against project tolerances such as time and budget
Audience	Board, risk committee, auditors, regulators	Project board and sponsor

A project can create or change an enterprise risk, for example a system migration that affects an important business service. When that happens, the risk belongs in the enterprise register too, with the project log as supporting detail.

Worked Example: One Operational Risk

Example

A consumer lender, one override risk

A fictional consumer lender with 60 staff, regulated by the FCA. One operational risk, written out with every field in use.

Field	Entry
Risk ID	OP-07
Title	Manual override of affordability decisions without documented rationale
Description	Cause: underwriters can override the automated affordability outcome and the reason field is optional. Event: loans are approved outside policy with no recorded rationale. Consequence: unaffordable lending, customer harm and redress, and inability to evidence good outcomes.
Taxonomy	Operational risk, process execution. Linked conduct risk.
Day-to-day owner	Head of Lending Operations
Accountable Senior Manager	Chief Executive (SMF1), per Statement of Responsibilities
Inherent score	Impact 4, likelihood 4, score 16
Controls	C1: override permission limited to senior underwriters. Last test passed. C2: weekly review of all overrides by the Credit Manager. Last test partially effective, two weeks missed in the quarter. C3: monthly compliance monitoring sample. Last test passed.
Residual score	Impact 4, likelihood 3, score 12
Appetite	Low appetite for customer harm in lending decisions. Threshold 9. Status: outside appetite.
Key risk indicator	Override rate as a share of approvals, reported monthly. See what a key risk indicator is.
Actions	A1: make the override reason mandatory in the loan system. Owner: Head of IT. Due end of Q3. A2: appoint a deputy reviewer for C2. Owner: Credit Manager. Due next month.
Regulatory mapping	PRIN 2A (Consumer Duty), CONC 5.2A (creditworthiness assessment)
Review	Monthly until back within appetite
Change history	Residual raised from 8 to 12 at last review after the C2 test found missed weeks. Reason and reviewer recorded.
Evidence	Links to the C2 test workpaper and the monthly override report

Notice what the entry lets a reader do. A board member can see the risk is outside appetite, why it moved, which control failed and when the fix lands. An auditor can follow the evidence links. Nobody needs to ask the owner what the scores mean.

The Common Pitfall: Controls Listed but Never Tested

Common pitfall

The residual score is a description of how things should work

The single most common weakness is a controls column full of controls that have never been tested. The register says "monthly reconciliation" or "four-eyes check", the residual score drops accordingly, and nobody has looked at whether the reconciliation happens or the second pair of eyes catches anything. When an incident exposes the gap, the firm discovers its real position was nearer the inherent score all along, and the register gave the board false comfort.

The fix is straightforward to describe and takes discipline to run. Every control the register relies on needs an owner, a test method, a test frequency proportionate to the risk, and a recorded result. Where a control has not been tested, say so in the register and do not give it full credit in the residual score. A partially effective result, like C2 in the example above, should move the score. Control testing is what turns that column from a list into evidence.

How Do You Audit Your Own Register?

You can do this in an afternoon for a register of modest size.

Check every risk has a description written as cause, event and consequence, and a taxonomy category.
Check every risk has one named owner, and every material risk links to a Senior Manager where SM&CR applies.
Check your scoring scale is written down with descriptors, and that inherent and residual scores are both recorded.
For each control, find the last test date and result. Flag any with none.
Check each risk shows appetite status, and every outside-appetite risk has an action with an owner and a date.
Check review dates. Flag anything overdue.
Pick three risks whose scores changed in the last year and try to explain the change from the register alone.

Step 7 is the real test. If you cannot reconstruct why a risk moved, neither can your auditor.

How Initia Risk Handles This

Initia Risk is a risk and compliance platform built around a single register that replaces the spreadsheets firms typically start with. Every field described in this article exists as a structured field rather than a free-text column, so descriptions sit against your taxonomy, scores use your defined scale, and owners are named individuals.

Controls are linked to the risks they support, with control testing and attestation recorded against each one. Test results, attestations and supporting documents are held as evidence with a full audit trail, so every change to a score, owner or status shows who made it, when and why. Regulatory mapping links risks and controls to the obligations they address.

The design is first-line ownership with second-line oversight. Owners in the business update their risks and attest to their controls, and the risk function reviews and challenges. Key risk indicators and appetite monitoring show which risks are within, at or outside appetite, and risk events and incidents can be linked back to the risks and controls they relate to.

Board and committee reporting draws directly from the register, so the questions in the opening scene can be answered from the same data the owners maintain, rather than from a separate pack assembled the week before.

Key Takeaways

A regulated firm's register is judged on the fields it holds, not its layout.
Write every risk as cause, event and consequence against a defined taxonomy.
Name one accountable owner, and map material risks to Senior Managers under SM&CR.
Record inherent and residual scores on a written scale, and make the gap traceable to tested controls.
Show appetite status, and give every outside-appetite risk an action with an owner and a date.
Keep a change history with reasons, and link the evidence behind each score.
Do not give a control full credit until it has been tested.

Short definitions of the surrounding terms sit in the GRC and risk management glossary.

Frequently asked questions

Is there a risk register template the FCA expects you to use?: No. The FCA does not prescribe a risk register template. It expects firms to have adequate systems and controls and to be able to show how they identify, assess, manage and monitor their risks. The fields in this article are what typically makes that demonstrable. What matters is that your register reflects your firm's actual risks and is used in decision-making. A well-formatted template with stale entries will not help you.
How often should a risk register be reviewed?: Most regulated firms review their principal risks at least quarterly, with more frequent review for risks outside appetite. You should also review a risk when something changes it, such as an incident, a failed control test, a new product or a regulatory change. The review date field makes this visible. An overdue review is itself a finding.
What is the difference between inherent and residual risk in a register?: Inherent risk is your exposure before controls, and residual risk is your exposure after the controls you rely on. The difference between them represents the work your controls are doing. That difference should be supported by control test results. If it is not, the residual score is an assumption.
Can a spreadsheet work as a risk register for a regulated firm?: Yes. A spreadsheet can work, particularly for smaller firms with a modest number of risks, and it can hold every field described here. The limits tend to show as the firm grows: keeping a reliable change history, linking evidence, controlling who edits what, and producing board reporting without manual consolidation. Those are the points at which firms usually consider dedicated tooling.
How many risks should be on a risk register?: There is no correct number. The register should hold enough risks to cover your firm's material exposures at a level where each one can be owned, scored and controlled. Too few and risks are too broad to assess. Too many and the register becomes a list nobody reviews.