The interest rate paid by an investment with the lowest possible level or risk, regarded until recently as being UK government bonds.

A system which identifies, assesses and prioritises risk and identifies resources to minimise, monitor and control it.

STOP PRESS: A significant restructuring of the UK listing regime came into effect on 29 July 2024, which included the removal of the premium and standard listing segments and the creation of a single listing category for equity shares in commercial companies. The commercial companies category is heavily disclosure-based and sits alongside other listing categories, such as the shell companies, secondary listing and closed ended investment fund categories. A new UK Listing Rules sourcebook came into force to implement the changes and the previous Listing Rules sourcebook was revoked. For further information, see Practice Note: Reform of the UK listing regime—fundamentals. This Practice Note reflects the listing regime as it was prior to 29 July 2024. In addition, this Practice Note refers to an earlier version of the UK Corporate Governance Code, rather than the current version that was published on 22 January 2024. For further information, see Practice Note: The UK Corporate governance Code. The purpose of internal control is to help identify, manage and control risk appropriately in an environment where

Our Risk management guide collection is an interactive resource. It identifies key risk management issues across core compliance areas, including data protection, crime prevention and information and data management. For each

This Risk management lifecycle flowchart suggests a process for identifying, assessing and managing risk across your business. Managing risk is not a one-off event—it is an

1 Introduction 1.1 Risk management is central to the way we operate and [insert organisation’s name] is committed to ensuring effective risk management within the business—all staff have a role to play in ensuring we achieve this. 1.2 This policy sets out: 1.2.1 what risk is; 1.2.2 our approach to risk management; 1.2.3 who is responsible for risk management; 1.2.4 our processes for identifying, reporting and evaluating risk; 1.2.5 our risk management policies and procedures; 1.2.6 details of risk management training; 1.2.7 the steps we will take to monitor and update this Risk management policy. 1.3 It also contains our: 1.3.1 Risk scorecard (matrix)—see Appendix 1; and 1.3.2 Internal risk report form—see Appendix 2. 2 What is risk? 2.1 Risk is the possibility of loss, or other adverse or unwelcome outcome. This could be a financial loss, but it could also be something less quantifiable, such as damage to reputation. 2.2 We categorise the risks we identify under three headings: 2.2.1 strategic risk—risks that could affect our survival or profitability; 2.2.2 operational risk—risks that are associated with our day-to-day activities; and 2.2.3 regulatory risk—the risks we face from non-compliance with our regulatory obligations. 2.3 Some risks may fall into more than one category. 2.4 Identifying risks is more important than meticulously categorising them. The [insert, eg risk

1 General information Date of review [Insert date] Person(s) conducting review [Insert name] 2 Review and findings Are your risk management policy and procedures up to date and fit for purpose? □ Yes□ No—ensure you set an action point at section: 3 to update your policy and processes Are you satisfied that your processes are working as they

1 Introduction 1.1 Risk management is central to the regulatory regime under which we operate. [Insert name of firm] is committed to ensuring effective risk management within the firm and all staff have a role to play in ensuring we achieve this. 1.2 This policy sets out: 1.2.1 what is risk; 1.2.2 our approach to risk management; 1.2.3 who is responsible for risk management; 1.2.4 our processes for identifying, reporting and evaluating risk; 1.2.5 our risk management policies and procedures; 1.2.6 details of risk management training; 1.2.7 the steps we will take to monitor and update this risk management policy. 2 What is risk? 2.1 Risk is the possibility of an adverse or unwelcome outcome. This could be a financial loss, but it could also be something less quantifiable, such as damage to our reputation. 2.2 We categorise the risks we identify under three heads: 2.2.1 strategic risk—risks that could affect our survival or profitability; 2.2.2 operational risk—risks that are associated with our day-to-day activities; 2.2.3 regulatory risk—the risks we face from non-compliance with our regulatory obligations. 2.3 Some risks may fall into more than one category. 2.4 Identifying risks is more important than meticulously categorising them. The [insert, eg risk partner or COLP] is responsible for categorising risks where possible.

There is a widely accepted definition of risk, ie: Risk = probability x impact Therefore, for any given risk faced by your business, there are two questions: • how likely is it that the risk will materialise, ie what’s the probability? • if the risk does materialise, how bad will it be, ie what’s the impact? SRA Standards and Regulations General risk You must identify, monitor and manage all material risks to your business. This obligation extends to risks that may arise from a connected practice, ie a body providing legal services that is established outside England and Wales, is neither an overseas practice nor an excluded body, and is connected to your firm by virtue of: • being a parent undertaking • being jointly managed or owned, or having a partner, member or owner in common, or controlled by or with, your firm • participating in a joint enterprise or across its practice generally, sharing costs, revenue or profits related to the provision

Question Correct answer 1. How do we define risk? (c) The possibility of an adverse/unwelcome outcome 2. How do we identify risks? (b) Using all available sources, including meeting staff, looking at claims and complaints records, reviewing our regulatory experience, analysing our breach report register and reviewing internal risk reports 3. How do we calculate the risk rating for an identified risk? (d) Multiply the probability of

How to use this test These questions are designed to test your understanding after your attendance at training on our risk management procedures. After you have completed this test, please return it to [insert name]. General Name of person completing test [Insert name] Role [Insert role] Date [Insert date] Multiple choice questions Circle the correct answer. Question Multiple choice answers 1. How do we define risk? (a) A hazard(b) A financial loss(c) The possibility of an adverse/unwelcome outcome(d) A regulatory breach 2. How do we identify risks? (a) By analysing suspicious activity report (SAR) records(b) Using all available sources, including meeting staff, looking at claims and complaints records, reviewing our regulatory experience, analysing our breach

Risk is part of everything we do. It is impossible to eliminate all risks but it is essential to manage them. We are committed to ensuring that all our activities are conducted responsibly, transparently and in accordance with sound risk management practices. Managing risk improves the way we deliver our business and plays a key role in helping us achieve our strategic objectives and avoid unwelcome surprises. Everyone has a role to play in identifying, understanding and mitigating risks to protect our people, our customers and our