Risk Management

Risk management is the organised process by which a business identifies the things that could go wrong, measures how likely and how costly they are, decides what to do about them and checks over time that those decisions still hold. In finance it is a core function of every bank, insurer, payment company and fund, and a board-level duty that supervisors examine directly.

The discipline covers many separate kinds of risk: credit risk, market risk, liquidity risk, operational risk and newer headings such as cybersecurity risk and third-party risk. It is closely related to, but broader than, risk mitigation, which is only the step of reducing a risk once it has been found. Widely used reference frameworks include ISO 31000 and the COSO enterprise risk management framework.

Think of planning a long family road trip. Before leaving, you think about what might spoil it: a flat tyre, a closed road, a sick child, running out of money. Some problems you avoid altogether by choosing a different route. Some you prepare for by packing a spare tyre. Some you hand to someone else, such as a breakdown service. A few you simply accept, because they are unlikely and cheap to fix.

A financial firm does the same thing, only in writing and continuously. It keeps a list of what could hurt it, decides how much trouble it is willing to live with, chooses a response for each item, and keeps watching the road in case conditions change. The point is not to remove all risk, which would mean doing no business at all, but to take risks on purpose rather than by accident.

Most frameworks describe a repeating cycle rather than a one-off exercise:

1. Identify. The firm lists the events that could harm its objectives, often in a risk register, drawing on incidents, audits, new products and changes in the law.
2. Assess. Each risk is rated by likelihood and impact, and sometimes measured with models such as value at risk for trading books.
3. Respond. The firm chooses to avoid, reduce, transfer or accept each risk, in line with its stated risk tolerance or appetite.
4. Monitor and report. Indicators, limits and incident logs are tracked, and results go to senior management and the board.

A simple scoring method used in many risk registers multiplies two ratings:

• $L$ is the likelihood rating, for example from 1 (rare) to 5 (almost certain).
• $I$ is the impact rating on the same 1 to 5 scale, from negligible to severe.

A payment company rates a card-processing outage as likelihood 2 and impact 5, giving a score of $2 \times 5 = 10$. It rates a minor reporting delay as likelihood 4 and impact 1, giving 4. The outage ranks higher and gets attention first, even though it is less likely. Scores like these are rough ordering tools; they do not measure money directly.

• Avoid. Stop the activity, for example by leaving a high-risk market or declining a merchant category.
• Reduce. Add controls, such as multi-factor authentication, transaction limits or dual approval of large payments.
• Transfer. Shift the loss to another party through insurance, hedging or contract terms.
• Accept. Keep the risk knowingly, usually because it is small or the cost of controlling it is higher than the expected loss.

Spreading exposures is itself a control: diversification limits the damage any one borrower, supplier or market can do, which is the subject of concentration risk.

ISO 31000:2018 sets out principles, a framework for building risk management into an organisation's governance, and a process for applying it. The COSO framework, revised in 2017 under the title "Enterprise Risk Management: Integrating with Strategy and Performance", ties risk to strategy setting and groups its guidance into five components and twenty principles. Neither is a law; firms adopt them to structure their own programmes.

Inside banks, responsibilities are often split into "three lines": business units own and manage their risks, an independent risk and compliance function sets policy and challenges them, and internal audit gives the board independent assurance. External reviewers such as an independent auditor add a further check.

For banks, risk management is written into prudential rules. The Basel Committee on Banking Supervision standards, including Basel III, require capital against credit, market and operational risk and expect a supervisory review of everything else under "Pillar 2". In the European Union, the Digital Operational Resilience Act (DORA) has applied since 17 January 2025 and requires financial entities to run a documented framework for technology risk.

Payment firms and fintech companies face their own versions. Money transmitters and payment institutions must run an anti-money-laundering programme built on a risk-based approach, supported by a compliance risk assessment. Card merchants manage chargeback risk and payment fraud, and everyone moving money manages payment risk, including settlement risk.

Risk management cannot remove uncertainty. Models rely on past data and can understate rare, severe events, as the 2008 financial crisis showed when many firms' measures had not captured correlated losses. Risk registers can become box-ticking exercises that list risks without changing decisions. Incentives also matter: if staff are paid on volume, controls may be bypassed. Supervisors therefore look not only at a firm's documents but at its culture, its escalation of bad news and whether the board actually uses risk information to decide what the business does. Failures in this area also feed reputational risk, because customers and partners judge firms by how they handle problems.

• ISO 31000:2018 Risk management — Guidelines
• Committee of Sponsoring Organizations of the Treadway Commission (COSO)