Platform / One risk, end to end

One risk, followed all the way through

A feature list does not show what happens between the features, so here is one example risk followed from the register to the committee pack. There are no screens below, only the six records, drawn a step at a time.

The risk is client money reconciliation failing: the exposure a firm carries when the money it holds for clients stops matching the money it thinks it holds.

The chain from risk to committee pack, with the audit trail beneath Six steps in a row, each joined to the next: risk, control, indicator, threshold breach, remediation and committee pack. A rail beneath them carries a mark under every step, labelled to say that every step writes to the audit trail as it happens. 1 Risk 2 Control 3 Indicator 4 Thresholdbreach 5 Remediation 6 Committeepack Every step writes to the audit trail as it happens

The walk, one step at a time

Take the six steps in order, or start from whichever you want.

Step 1 of 6

The risk sits on the register, owned

"Client money reconciliation fails" is written once, under the client assets category, with a named owner, an inherent position of 16, a residual of 9 and an appetite the board chose (cautious, with the reasoning recorded). It appears on the register of every entity it applies to, and nowhere else. The risk register

A category with three risks beneath it, one expanded A category box labelled client assets sits above three risk rows. The first is expanded to show its residual score of 9, a named owner, an appetite position with reasoning, an inherent score of 16 resolving to a residual of 9 and a bow-tie with three causes and two consequences. CATEGORY Client assets 9 Client money reconciliation fails Owner: named · Appetite: cautious, with the reasoning Inherent 16 → Residual 9 Bow-tie 3 / 2 6 Unauthorised transfer 4 Misapplied client instruction

Step 2 of 6

A control mitigates it, and three other risks besides

The daily reconciliation is one control in the library, linked to this risk and the three others it protects. It was last assessed effective in design and in operation, on a date, by a named assessor, and that assessment stays on the record. Controls

One control linked to four risks A single control, daily reconciliation, assessed effective for design and effective for operation, is joined by four lines to four separate risks on the register. A caption says it is maintained once and a change reaches all four. CONTROL Daily reconciliation Design Operating Assessed, dated, by name Client money shortfall Misposted transaction Unauthorised transfer Late regulatory return Maintained once. A change reaches all four.

Step 3 of 6

An indicator is scored against appetite, and crosses red

The risk carries an indicator: unreconciled items older than five days, collected monthly, with green, amber and red thresholds set for this entity against the appetite for the risk. A value of 14 comes in against a red threshold of 10. It scores the moment it is entered, so nobody waits for a month-end consolidation to find out. Indicators

An indicator improving from red to green across four quarters A chart with three horizontal bands, red at the top, amber in the middle and green at the bottom. Four quarterly values plot a line that starts in the red band, moves through amber and ends in green, with the last point marked as scored on entry. Open complaints beyond target Red Amber Green scored on entry Q1 Q2 Q3 Q4 Thresholds and target set per unit. Trend held on the record.

Step 4 of 6

A breach record opens on its own

Crossing red raises a formal breach record the same day, with its own lifecycle. The person who submitted the value is frozen onto it and cannot write the response, and neither can anyone who amended it, so somebody else responds, in writing, and the response is versioned. Threshold breaches

A value crossing red raises a breach record that two people cannot respond to On the left, a value collected monthly climbs from the green band through amber and across a dashed red threshold into the red band. An arrow leads to a box labelled breach record. Beneath, three people: the one who submitted the value and the one who amended it are marked as unable to respond, and a third person is marked as the one who responds. red amber green red threshold JunJulAugSep Breach record own lifecycle, own response raised the same day submitted the value cannot respond amended it into red cannot respond somebody else writes the response

Step 5 of 6

Remediation answers it, and closing takes two

The response raises an action with an owner and a due date, tracked in the one view that shows every open action across the organisation. When the backlog is cleared, the owner requests closure and somebody in an oversight role who is not the owner decides, so closed means two people agreed it was. Remediation

Four sources feed one remediation action, which two people close Four boxes on the left, threshold breach, risk event, control failure and quality finding, each with an arrow into a central box labelled remediation action with an owner and a due date. On the right, one person requests closure and a different person approves it, and a green closed mark sits beneath them. Threshold breach Risk event Control failure Quality finding Remediation action owner · due date linked to its cause requests closure approves not the requester Closed

Step 6 of 6

The committee pack reports it, from the same data

When the risk committee next meets, the pack assembles from the live record: the risk, its control, the red indicator, the breach and the state of its remediation. Nothing is retyped on the way, so the figure the committee reads is the figure that was entered, and the pack goes through its approval chain with no one person clearing two steps. Committee reporting

Follow the pack end to end
Eight sections assemble into a pack that moves through four approval steps A stack of eight section bars on the left, from executive summary to control effectiveness, with an arrow into a document on the right watermarked draft. Beneath the document, four approval steps in a row: compiled, reviewed, signed off and released. Executive summary Indicator early warning Risk appetite Principal risks Risk events Path to green Indicator performance Control effectiveness switch on, reorder, filter, cap, comment DRAFT data as at · exported at Compiled Reviewed Signed off Released PDF or PowerPoint

Every step wrote an entry as it happened: who, what changed, from what to what, when, in what role and in which line of defence. That is what an auditor reads. The audit trail and the checks that run over it

See the same record on your own structure

Tell us how your organisation is structured and the risks it faces today, and we will walk one of your own risks through the platform the same way.

Request a walkthrough See the whole platform

or write to sales@puretrace.co.uk

A person reads every enquiry and replies in writing.