A risk register is a maintained record of identified risks and how they are being assessed, controlled and followed up. For a trading business, it connects a possible loss mechanism to someone responsible for managing it. A position-risk report can show exposures; the register can also capture an untested backup, a fragile funding arrangement or an unresolved contractual uncertainty.
The register may be a spreadsheet or a workflow system. Its value comes from a reviewable record: what could happen, why it could happen, what is already being done, and what still needs a decision. Merely listing “market”, “credit” and “operations” gives categories, rather than usable risk statements.
Follow one record
Consider a fictional trading desk whose objective is to use reconciled positions for trading decisions. Its risk statement is:
Because the backup reconciliation service has not been tested, a primary-service outage may leave reconciliation unavailable, allowing incorrect positions to drive trading decisions and cause losses.
The cause is the untested backup; the event is reconciliation becoming unavailable; the consequence is decisions based on incorrect positions and resulting losses. This is an operational-risk mechanism. “Trading loss” alone would hide the weakness that management could address. HM Treasury’s Orange Book, Annex 5 explains this cause–event–consequence approach; the example here is original.
Original fictional desk example. A planned failover test is kept separate from controls already in operation; review can change the assessment without deleting the record’s history.
A useful version of this record might contain:
| Field | Fictional entry |
|---|---|
| Objective and scope | Reconciled positions for this desk’s trading decisions; primary and backup reconciliation services |
| Risk statement | The cause, uncertain event and consequences described above |
| Risk owner | Desk operations lead, under the firm’s documented mandate |
| Existing controls | Daily exception review and trade-entry checks; their coverage and operating evidence are linked to the record |
| Current assessment | Assessment with those controls in place, with its horizon, criteria, evidence and uncertainty stated |
| Further action | Perform a failover test and resolve any defects it reveals |
| Action owner and due date | Technology service lead; due 30 October 2026 |
| Status and next review | Action open; risk review on 2 November 2026, or sooner after a relevant outage or control failure |
These are useful fields, rather than a universal mandatory template. Dundee’s register guidance explicitly separates existing controls, further actions, risk ownership and action ownership. A control assessment should identify its baseline: an inherent assessment typically excludes specified controls, while a residual assessment reflects them. Record the organisation’s convention so that comparisons mean the same thing.
An action marked “complete” does not by itself establish that the control works. In this example, the review needs the test result, unresolved defects and any change to the assessment. Conversely, a successful test does not make reconciliation failure impossible. Hull’s discussion of risk control and self-assessment links identification to prospective indicators and remedial action; the record should help that work happen.
Keep scores and money separate
Suppose, solely for illustration, that the desk adds a one-year, two-outcome loss model to this record. After allowing for the existing controls, it assumes a 10% probability of one loss of USD 200,000 and a 90% probability of zero loss. Then
The USD 20,000 is the mean of that stipulated loss distribution. It is neither the event’s loss amount nor a guaranteed annual cost. The model excludes repeated incidents, varying severity and other losses. The probability is an assumption, not a calibration inferred from the register.
A qualitative likelihood score is different. Labels such as “unlikely” or ordinal category numbers rank assessments under a declared scale; they are not probabilities. Multiplying likelihood and impact category numbers may produce a policy prioritisation score, but it does not produce monetary expected loss. Nor does a lower score establish acceptability without considering the organisation’s risk appetite, uncertainty and other consequences.
Use the next review to make a decision
At review, ask whether the exposure, controls, evidence or operating context has changed, and whether the remaining risk should be accepted, escalated or treated further under the firm’s authority rules. Keep the decision and its basis with the record. The Orange Book’s risk-treatment principles support explicit responsibilities, completion times and monitoring; its government context does not impose a trading-firm procedure.
A risk dashboard can summarise overdue actions or changing assessments, while a risk report explains decisions and exceptions. Both are more useful when the underlying register is current. Closing an action and closing a risk are separate decisions.
For a trading application, Portfolio Risk Categories for Convert Arb builds a pre-trade register around exit assumptions, financing, contractual events and owners. The full lesson requires membership; its public preview is available.
Sources
- University of Dundee, Risk register template and guidance, 15 February 2023 — register fields and maintenance as an ongoing process.
- HM Treasury, The Orange Book, section D and Annex 5, page updated 29 July 2026 — risk statements, assessment limitations, treatment responsibilities and review.
- John C. Hull, Risk Management and Financial Institutions, 4th edition (Wiley, 2015), §23.6, p. 491, “RCSA and KRIs” — operational-risk identification, early indicators and action. The desk, dates and loss model above are fictional.