Self-assessment: operational risk management

1. Risk analysis starts from the organisation's most important objectives, duties and requirements.

2. Leadership has defined common criteria for material risk and risk acceptance.

3. The risk picture influences operational plans, budgets, investments and priorities.

4. Executives or the board receive a combined view of the most material operational risks.

5. Risk analysis is updated when the environment, remit or operating conditions change materially.

6. Every material risk has a named owner accountable for the exposure.

7. The risk owner can approve action or escalate the need for a decision.

8. Responsibilities across operations, support, security, IT and suppliers are clear.

9. Risks at organisational interfaces and in external dependencies have clear owners.

10. Managers and staff know when and how a new or changed risk should be reported.

11. The organisation uses a common method to identify and assess risks.

12. Critical processes and dependencies on people, premises, information, technology and suppliers are mapped.

13. Causes, possible events and consequences are distinguished in risk descriptions.

14. Relevant scenarios are used to test vulnerability and operational resilience.

15. Incidents, deviations and exercises systematically lead to learning and improvement.

16. Risk assessments use reliable data and documented professional judgement.

17. Leadership monitors indicators that can show deterioration in exposure early.

18. Risk information can be aggregated without hiding important differences between operations.

19. Information security, data protection and cyber dependencies form part of the combined risk picture.

20. System support provides traceability from risk and decision to action and review.

21. The financial and operational consequences of major risks are assessed.

22. The cost of action is weighed against expected risk reduction and organisational benefit.

23. Contingency, insurance and continuity arrangements have a clearly defined purpose.

24. Residual exposure after action is reported and accepted at the correct decision level.

25. The risk portfolio is prioritised so resources address the most material exposure.

26. Approved actions have an owner, funding, deadline and clear intended outcome.

27. The organisation verifies that completed actions work as intended.

28. Change initiatives are risk-assessed before new working practices or systems are introduced.

29. The culture encourages early reporting of uncertainty, mistakes and weak signals.

30. Leadership can reprioritise quickly when risks change or a serious event occurs.