Top risks and controls for Investor Relations

From the Doorstep International risk register, curated by Ahmer Nehal. Last updated 17 Oct 2026.

The Investor Relations register lists 25 key risks and 62 best-practice controls across 5 units: Events and Conferences, Financial Communications, Shareholder Services, Strategy and Planning, Technology and Analytics. Use it to identify risks, benchmark your existing controls or start a risk and control self-assessment (RCSA).

Get the RCSA workbook Run it in the software

Building and maintaining relationships with a bank's investors and stakeholders is crucial for a bank's investor relations department.

Conducting risk assessments to detect potential hazards that could affect the bank's operations, financial performance, and reputation is a crucial component of this function.

Investor relations can help the bank's management and board of directors understand the risks that need to be addressed and reduced in order to safeguard the bank's interests and those of its investors by conducting risk assessments.

The bank will be better positioned to negotiate the constantly shifting market conditions thanks to this proactive approach, which can also help investors and stakeholders gain the bank's trust and confidence.

Events and Conferences: key risks and controls

Organising and taking part in investor conferences, roadshows, and other occasions where the bank can interact with investors and analysts to talk about its performance and strategy.

Risk	What can go wrong	Best-practice controls
Coordination and logistics	Organizing IR events and conferences involves complex coordination and logistics, including selecting the venue, scheduling speakers, managing invitations, and arranging travel and accommodation. This can be a time-consuming process that requires attention to detail and effective communication with all stakeholders involved.	Planning and coordination: Develop a comprehensive project plan and establish clear roles and responsibilities for all team members involved in organizing the event. Establish a timeline and deadlines to ensure that everything stays on track, and schedule regular check-ins to monitor progress. Vendor management: Select reliable and experienced vendors for venue, catering, and transportation services. Conduct due diligence on vendors to ensure they have the necessary licenses and insurance, and negotiate contracts that clearly define deliverables, timelines, and payment terms. Risk management: Conduct a risk assessment to identify potential risks associated with the event and implement controls to mitigate those risks. This could include measures such as contingency planning, insurance coverage, and emergency response protocols. Communication and stakeholder management: Establish effective communication channels with all stakeholders involved in the event, including speakers, sponsors, attendees, and vendors. Develop a communication plan that includes regular updates, clear instructions, and a point of contact for any questions or concerns. Budgeting and financial management: Develop a detailed budget for the event and closely monitor expenses throughout the planning process. Ensure that all financial transactions are properly documented and that there are appropriate controls in place to prevent fraud or other financial irregularities. Technology and data security: Use secure communication and collaboration tools to manage event logistics, and implement data security measures to protect sensitive information such as attendee lists, travel itineraries, and payment information.
Ensuring compliance	IR events and conferences must comply with various regulatory requirements, including rules on disclosure, insider trading, and anti-bribery and corruption. The investor relations department must ensure that all speakers and attendees are aware of these requirements and that the event is conducted in a compliant and ethical manner.	Controls for this risk are available in the full register. Ask us.
Managing investor expectations	Investor relations events and conferences are important opportunities to provide updates on the bank's performance, strategy, and outlook. However, managing investor expectations can be challenging, as different investors may have different expectations or may interpret the same information differently. The investor relations department must be able to provide accurate and transparent information while avoiding speculation or undue optimism.	Effective Communication Strategy: A well-defined communication strategy that outlines the key messages, target audience, and delivery channels can help the investor relations department to provide accurate and transparent information while avoiding undue optimism or speculation. Robust Disclosure Controls: A set of robust disclosure controls, including policies and procedures that govern the release of information to the public, can help ensure that the investor relations department is providing accurate and timely information. Investor Education Programs: An investor education program that explains the bank's business model, strategy, and risk management practices to investors can help align expectations and reduce the risk of misinterpretation. Consistent Investor Relations Policies: Establishing consistent investor relations policies, including guidelines on how to handle different types of inquiries, can help ensure that all investors receive the same level of information.
Maximizing attendance and engagement	Maximizing attendance and engagement at IR events and conferences is important to ensure that the bank's message is heard and understood by as many investors and stakeholders as possible. This can be challenging, as attendees may have competing priorities or may be limited by travel and scheduling constraints. The investor relations department must find ways to make the event appealing and engaging, such as by providing relevant content, interactive sessions, or networking opportunities.	Content Relevance and Quality Control: Ensuring that the content presented at IR events and conferences is highly relevant, informative, and valuable to the target audience is crucial. This control involves conducting thorough research to understand the interests and needs of investors and stakeholders. By delivering high-quality content that addresses their concerns, the bank can increase the attractiveness of the event and enhance attendee engagement. Interactive Session Design: Incorporating interactive sessions into the event agenda can significantly boost engagement levels.
Measuring effectiveness	Measuring the effectiveness of IR events and conferences is important to justify the time and resources invested in organizing them. This can be challenging, as it is difficult to quantify the impact of these events on investor sentiment, stock price, or other financial metrics. The investor relations department must find ways to track attendance, gather feedback, and evaluate the overall impact of the event on the bank's relationships with investors and stakeholders.	Post-event Surveys and Feedback: Implement a comprehensive survey mechanism to gather feedback from attendees, including investors and stakeholders. Design the survey to capture quantitative and qualitative data about their experience, satisfaction levels, and perceived impact on their sentiment towards the bank and its financial metrics. Use the feedback to assess the success of the event and identify areas for improvement. Key Performance Indicators (KPIs): Define and track relevant KPIs that can provide measurable insights into the impact of IR events and conferences.

Financial Communications: key risks and controls

Responsible for creating presentations and other materials that inform investors about the bank's financial performance in addition to preparing the bank's financial reports, such as earnings releases and annual reports.

Risk	What can go wrong	Best-practice controls
Balancing transparency and confidentiality	Balancing transparency and confidentiality: The investor relations department must balance the need for transparency and disclosure with the need to protect confidential information. This can be challenging when communicating with different stakeholders, as some information may need to be kept confidential to protect the bank's competitive position or customer privacy.	Develop and implement a robust information classification system: This control involves categorizing information based on its level of sensitivity and ensuring that it is handled in accordance with its classification. This helps to ensure that only authorized personnel have access to confidential information, and that information is not disclosed to stakeholders who do not need it. Provide training and awareness to employees: Investing in training and awareness programs can help employees understand the importance of confidentiality and the potential consequences of unauthorized disclosure. This control helps to promote a culture of confidentiality and ensure that employees are equipped to handle confidential information appropriately. Implement strong access controls and monitoring mechanisms: This control involves restricting access to confidential information to authorized personnel and implementing monitoring mechanisms to detect and prevent unauthorized access. This helps to ensure that confidential information is only accessed by those who need it and that any unauthorized access is quickly detected and addressed.
Complexity of financial information	Commercial banks deal with complex financial information, such as financial statements, annual reports, and regulatory filings, which can be difficult to communicate effectively to investors who may not have a financial background. The investor relations department must be able to translate this information into clear and concise messages that investors can understand.	Training and Education: Providing training and education to investor relations personnel on effective communication techniques and financial language can significantly mitigate the risk of miscommunication or misunderstandings with investors. This can involve offering courses, seminars, or workshops to improve their communication and presentation skills. Regular Review and Monitoring: Regularly reviewing and monitoring the information that the investor relations department is disseminating can help to ensure that it is clear and concise, and that it accurately represents the financial position of the bank. This can involve implementing review processes, such as peer reviews or quality control measures, to ensure that information is effectively communicated. Use of Visual Aids: Using visual aids, such as infographics or charts, can help to simplify complex financial information and make it more accessible to investors who may not have a financial background. These visual aids can be used in investor presentations, reports, and other communications to help investors understand the bank's financial position and performance.
Compliance with regulations	Financial communication in the banking industry is heavily regulated, and the investor relations department must comply with various regulations when communicating with investors. This can be a time-consuming and challenging process that requires a deep understanding of the regulatory environment.	Regulatory Compliance Training: Providing comprehensive training to the investor relations department regarding the regulatory environment is essential. This control ensures that employees have a deep understanding of the regulations governing financial communication and investor relations. Training should cover topics such as the legal framework, reporting requirements, disclosure obligations, and prohibited practices. Robust Internal Controls and Processes: Implementing strong internal controls and processes is crucial to ensure compliance with regulations. This control includes establishing clear guidelines and procedures for communication with investors, maintaining proper documentation, and implementing review and approval processes.
Ensuring accuracy and transparency	Ensuring accuracy and transparency: The investor relations department is responsible for ensuring that all financial information released to investors is accurate and transparent. This can be challenging given the complexity of financial data and regulations, and any mistakes or omissions can lead to significant reputational damage and legal consequences.	Robust Internal Controls and Procedures: Implementing strong internal controls and procedures is essential to ensure accuracy and transparency in financial information. This includes establishing clear guidelines for financial reporting, verifying data accuracy through rigorous reconciliation processes, and implementing checks and balances to detect and prevent errors or omissions. Regular audits and reviews should be conducted to ensure compliance with regulations and identify any gaps in controls. Training and Education: Providing comprehensive training and education to the investor relations team is crucial. This includes educating them about financial reporting standards, regulations, and disclosure requirements. Training should also focus on enhancing their understanding of complex financial data and ensuring accurate interpretation and presentation to investors. Ongoing training programs can help keep the team updated on any changes in regulations or reporting standards.
Managing crises	In the event of a crisis or negative event, such as a data breach or regulatory violation, the investor relations department must communicate effectively to investors to maintain trust and minimize the impact on the bank's reputation and stock price.	Crisis Communication Plan: Developing a well-defined crisis communication plan is crucial to effectively mitigate risks associated with negative events. This plan should outline the steps to be taken, roles and responsibilities of the investor relations department, key messages, and communication channels to be used during a crisis or negative event. By having a pre-established plan, the department can respond quickly and confidently, ensuring effective communication with investors. Media Monitoring and Analysis: Implementing robust media monitoring and analysis tools can help the investor relations department stay informed about any negative news or media coverage related to the bank. By closely monitoring media channels, social media platforms, and online forums, the department can identify potential risks and respond promptly.

Shareholder Services: key risks and controls

Accountable for overseeing the bank's interactions with its shareholders and handling their questions and requests.

Risk	What can go wrong	Best-practice controls
Compliance with regulations	The investor relations department needs to comply with various regulations related to shareholder communications and disclosures. These regulations can be complex and may change frequently, which makes it challenging to ensure compliance.	Regulatory Compliance Monitoring Software: Implementing specialized software designed to monitor and track regulatory changes and requirements can significantly enhance compliance efforts. This software can help automate the process of staying updated with evolving regulations, ensuring timely adherence, and reducing the risk of non-compliance. Robust Internal Control Framework: Developing and implementing a comprehensive internal control framework specific to investor relations can be highly effective. This framework should include documented policies, procedures, and controls to address various regulatory requirements.
Dealing with shareholder activism	Shareholder activism is on the rise, and investor relations departments need to be prepared to deal with activist investors who may have different views on the bank's strategy and governance. This can be challenging as it requires the department to engage with investors and address their concerns while ensuring that the bank's interests are protected.	Strong and transparent governance: A well-governed bank is less likely to attract activist investors, as they are more likely to target companies with weak governance structures. The bank should have a clear and effective governance framework that includes strong oversight from the board of directors, independent committees, and an effective whistleblower program. Proactive investor relations strategy: The bank's investor relations department should have a proactive strategy for engaging with shareholders and addressing their concerns. This can include regular communication and engagement with shareholders, as well as clear and transparent communication of the bank's strategy, financial performance, and risk management practices. Robust risk management practices: The bank should have robust risk management practices in place to identify and mitigate potential risks associated with shareholder activism. This can include regular monitoring of market trends and changes in ownership structure, as well as proactive engagement with key stakeholders to address potential issues before they escalate. Additionally, the bank should have a crisis management plan in place to manage any potential threats posed by activist investors.
Ensuring shareholder engagement	The investor relations department needs to ensure that shareholders are engaged and informed about the bank's strategy and performance. This can be challenging as it requires the department to develop effective communication strategies that are tailored to different types of shareholders.	Stakeholder Segmentation and Analysis: Effective communication strategies require a thorough understanding of the bank's shareholders. Conducting stakeholder segmentation and analysis is crucial in identifying the different types of shareholders and their specific information needs. By categorizing shareholders based on their demographics, interests, and investment profiles, the investor relations department can tailor their communication strategies accordingly. Regular Communication Channels and Events: Establishing regular communication channels and events is vital for keeping shareholders engaged and informed. This includes quarterly or annual reports, investor presentations, conference calls, webcasts, and shareholder meetings. These platforms provide opportunities for the investor relations department to share the bank's strategy, performance updates, and answer shareholders' questions directly.
Managing communication with shareholders	The investor relations department is responsible for managing the bank's communication with its shareholders. This can be challenging as shareholders may have different expectations, concerns, and communication preferences. The department needs to ensure that all shareholders receive timely and accurate information about the bank's performance, strategy, and financial results.	Robust Communication Plan: Develop a comprehensive communication plan that outlines the bank's communication strategy, channels, and timelines for sharing information with shareholders. This plan should ensure that all shareholders receive timely and accurate information about the bank's performance, strategy, and financial results. Regular updates, such as quarterly reports and annual meetings, should be included in the plan. Clear Policies and Procedures: Establish clear policies and procedures for the investor relations department to follow when communicating with shareholders. These guidelines should outline the standards for accuracy, transparency, and consistency in communication.
Managing investor relations during mergers and acquisitions	Commercial banks are frequently involved in mergers and acquisitions, and the investor relations department needs to manage communication with shareholders during these transactions. This can be challenging as it requires the department to balance the need for transparency with the need to protect the bank's interests and ensure a successful transaction.	Clear communication plan: Developing a comprehensive communication plan is the most effective control to mitigate the risk. The plan should outline how communication with shareholders will be managed throughout the merger or acquisition process. The plan should clearly define the messages that need to be conveyed, the audiences that need to be reached, and the channels that will be used to deliver the message. This will ensure that all stakeholders are informed and that the bank's interests are protected. Confidentiality agreements: Confidentiality agreements are another effective control that can be implemented to mitigate the risk. These agreements can be used to ensure that sensitive information is not disclosed to unauthorized parties. They can also be used to restrict the dissemination of information to a need-to-know basis, ensuring that only those who require the information have access to it. Disclosure controls: Disclosure controls are another important control that can be implemented to mitigate the risk. These controls can be used to ensure that all required disclosures are made in a timely and accurate manner. They can also be used to monitor and report on the effectiveness of the communication plan, ensuring that any issues are identified and addressed promptly.

Strategy and Planning: key risks and controls

Accountable for creating and carrying out the bank's investor relations strategy and making sure that the bank effectively communicates with its analysts and investors.

Risk	What can go wrong	Best-practice controls
Adapting to changing market conditions	The IR strategy and planning must be adaptable to changing market conditions, such as economic downturns, market volatility, or changes in regulations. This requires the ability to anticipate and respond to market trends and developments, and to communicate effectively during times of uncertainty or disruption.	Continuous monitoring of market conditions: This involves keeping a close eye on market trends, economic indicators, and regulatory changes that could impact the company's IR strategy and planning. By staying informed, the company can anticipate changes and adjust its strategy accordingly. Scenario planning: This involves creating and testing different scenarios that could arise due to changes in market conditions. By developing contingency plans and preparing for different outcomes, the company can respond quickly and effectively to unexpected events. Effective communication strategy: This involves developing a clear and consistent messaging strategy that can be adapted to different market conditions. The company should be transparent with stakeholders and provide regular updates on any changes in its IR strategy and planning. This can help build trust and credibility, even during times of uncertainty or disruption.
Aligning with the bank's overall strategy	The IR strategy and planning must be aligned with the bank's overall strategy and goals. This requires a deep understanding of the bank's business model, markets, products, and customers, as well as the competitive landscape and regulatory environment. The investor relations department must work closely with senior management to ensure that the IR strategy and planning are consistent with the bank's overall vision and mission.	Strong Corporate Governance Framework: Establish a robust corporate governance framework that outlines the roles, responsibilities, and decision-making processes within the bank. This framework should clearly define the relationship between the investor relations department, senior management, and the board of directors. It ensures transparency, accountability, and effective communication channels to align the IR strategy with the bank's overall vision and mission. Regular Communication and Collaboration: Foster open lines of communication and collaboration between the investor relations department and senior management.
Balancing short-term and long-term goals	The IR strategy and planning must balance short-term and long-term goals, such as meeting quarterly financial targets while also investing in long-term growth and innovation. This requires a deep understanding of the bank's financial performance and strategic priorities, as well as the ability to communicate effectively with investors and stakeholders about the bank's performance and outlook.	Robust Strategic Planning Process: The bank must have a robust strategic planning process that includes a clear understanding of its long-term and short-term goals. This process should involve regular reviews of the bank's financial performance, market trends, and strategic priorities to ensure that they remain aligned with the bank's overall objectives. The planning process should be transparent, involve all relevant stakeholders, and incorporate feedback from investors and other external parties. Effective Communication Strategy: The bank must have an effective communication strategy to ensure that it can communicate effectively with investors and stakeholders about its performance and outlook. This strategy should include regular updates on the bank's financial performance and strategic priorities, as well as proactive engagement with investors and other stakeholders to understand their concerns and feedback. The bank should also consider using a variety of communication channels, such as social media, press releases, and investor presentations, to reach a wide range of stakeholders. Strong Financial Management Practices: The bank must have strong financial management practices to ensure that it can meet its short-term financial targets while also investing in long-term growth and innovation. This includes effective budgeting and forecasting processes, robust risk management practices, and regular monitoring of key financial metrics. The bank should also consider using financial incentives to encourage employees to focus on long-term growth and innovation, rather than just meeting short-term financial targets.
Managing stakeholder expectations	The IR strategy and planning must manage the expectations of various stakeholders, including shareholders, analysts, regulators, and the media. This can be challenging, as each stakeholder group may have different expectations and priorities, and may interpret the same information differently. The investor relations department must find ways to provide accurate and transparent information that meets the needs of each stakeholder group while avoiding speculation or undue optimism.	Communication Strategy and Guidelines: Establishing a well-defined communication strategy and guidelines is crucial for managing stakeholder expectations effectively. This control involves developing a clear framework for communicating with different stakeholder groups, outlining the key messages, tone, and channels to be used. It should emphasize the importance of accuracy, transparency, and consistency in all communications. Stakeholder Engagement and Relationship Management: Actively engaging with stakeholders and managing relationships is essential to understand their expectations and priorities. This control involves conducting regular meetings, conferences, and forums to provide opportunities for dialogue and feedback. By actively listening to stakeholders, the investor relations department can gain insights into their concerns and align their communication efforts accordingly.
Measuring effectiveness	Measuring the effectiveness of the IR strategy and planning is important to justify the time and resources invested in it. This can be challenging, as it is difficult to quantify the impact of IR activities on investor sentiment, stock price, or other financial metrics. The investor relations department must find ways to track key performance indicators, gather feedback from stakeholders, and evaluate the overall impact of the IR strategy and planning on the bank's relationships with investors and stakeholders.	Establish Clear Objectives and Key Performance Indicators (KPIs): Defining clear objectives and KPIs is crucial to evaluate the effectiveness of the IR strategy and planning. These objectives should be aligned with the organization's overall goals and should include measurable metrics that can be tracked and evaluated. Examples of KPIs may include changes in investor sentiment, stock price performance, analyst coverage, or stakeholder feedback ratings. Regular Stakeholder Engagement: Maintaining consistent and open communication with stakeholders, such as investors, analysts, and other relevant parties, is essential to gauge the impact of the IR strategy and planning. This can involve conducting regular investor meetings, participating in industry conferences, hosting earnings calls, and providing timely and transparent updates on company developments. Gathering feedback from stakeholders through surveys, interviews, or focus groups can provide valuable insights to assess the effectiveness of the IR efforts and identify areas for improvement.

Technology and Analytics: key risks and controls

Creating and implementing technology and analytics solutions for investor relations, including investor relations websites, investor databases, and analytics tools.

Risk	What can go wrong	Best-practice controls
Data management	One of the biggest challenges facing IR teams is managing large amounts of financial data. Commercial banks generate a lot of data, and IR teams need to ensure that this data is accurate, complete, and accessible.	Data Quality Controls: Implementing controls to ensure the accuracy, completeness, and integrity of financial data is crucial. This can involve setting up automated data validation checks, implementing data cleansing processes, and conducting regular data audits. By maintaining high data quality standards, IR teams can rely on accurate and reliable information for decision-making and analysis. Access Controls: Controlling access to financial data is essential for maintaining data security and preventing unauthorized access or misuse. Implement strong user authentication measures and role-based access controls (RBAC).
Earnings reporting	Commercial banks are required to report their earnings on a quarterly basis. IR teams are responsible for ensuring that these reports are accurate and that they communicate the company's financial performance effectively to investors.	Segregation of Duties: This control is the most effective in mitigating the risk because it involves separating duties among different individuals to ensure that no single person has the ability to manipulate financial data or report inaccurate information. For example, different people can be assigned to handle financial transactions, prepare financial statements, and communicate with investors. This separation of duties ensures that no one person has complete control over the process, making it difficult for anyone to manipulate the data. Review and Approval Processes: A review and approval process is an effective control that involves having a second set of eyes review the financial data and reports before they are released to investors. This control helps to ensure that any errors or inaccuracies are caught and corrected before they become public. The review and approval process can be conducted by someone within the same department or by an independent party. IT Controls: Information Technology (IT) controls are an effective control that involves implementing systems and procedures to protect financial data and ensure its accuracy. For example, an IT control could involve restricting access to financial data and reports to authorized personnel only, ensuring that data is backed up regularly, and implementing firewalls and other security measures to prevent unauthorized access to financial systems and data.
Investor targeting	Another important responsibility of IR teams is to identify and target potential investors. To do this, they need to use analytics tools to analyze investor behavior and preferences, and then develop targeted marketing strategies to attract those investors.	Data Encryption: One of the most effective controls to mitigate the risk of unauthorized access to sensitive information, such as investor data, is to encrypt the data both in transit and at rest. This would make it much more difficult for attackers to steal the data and use it for malicious purposes. Access Control: Implementing strict access controls can help ensure that only authorized personnel have access to investor data. This can include measures such as multi-factor authentication, password policies, and role-based access controls. By limiting access to sensitive data, the risk of unauthorized disclosure or misuse is significantly reduced. Analytics and Reporting: Using analytics tools to monitor and analyze investor behavior can help identify suspicious activity and potential threats before they can cause any harm. By setting up alerts and reports to highlight unusual patterns, IR teams can quickly respond to any potential threats and take appropriate action to mitigate the risk.
Regulatory compliance	Commercial banks are subject to a range of regulatory requirements, including those related to financial reporting, disclosure, and governance. IR teams need to ensure that the company is in compliance with these requirements and that it communicates any changes or updates to investors in a timely and effective manner.	Regulatory Compliance Monitoring and Reporting Systems: Implementing robust systems to monitor and ensure compliance with regulatory requirements is crucial. This includes establishing processes to track changes in regulations, assessing the impact on the bank's operations, and promptly implementing necessary adjustments. Effective monitoring and reporting systems help identify any gaps in compliance and allow for timely corrective actions. Internal Controls and Risk Management Framework: Developing and maintaining a strong internal control environment is essential for mitigating risks associated with regulatory requirements. This involves establishing clear policies, procedures, and controls to ensure accurate financial reporting, proper disclosure, and effective governance. A comprehensive risk management framework helps identify, assess, and mitigate risks, ensuring ongoing compliance with regulatory obligations.
Shareholder engagement	IR teams are responsible for engaging with shareholders and addressing their concerns. This includes responding to shareholder inquiries, providing updates on the company's performance, and ensuring that the company is in compliance with regulatory requirements.	Robust Communication and Engagement Protocols: Implementing clear and efficient communication channels and protocols between the IR team and shareholders is essential. This includes establishing regular reporting mechanisms, such as quarterly updates and annual meetings, to provide shareholders with timely and accurate information about the company's performance and compliance efforts. By fostering open and transparent communication, the risk of misunderstandings and dissatisfaction can be minimized. Comprehensive Compliance Framework: Develop a comprehensive compliance framework that encompasses regulatory requirements and best practices. This framework should include regular assessments of the company's compliance status, identification of potential compliance gaps, and the implementation of appropriate measures to address any issues. This helps ensure that the company remains in compliance with relevant regulations.

This register is a starting point for risk identification and benchmarking against international practice. Adapt the risks and controls to your institution's size, products, jurisdiction and regulatory requirements.

Get the Investor Relations register as an RCSA workbook

A spreadsheet-ready CSV with every risk and control on this page, plus blank columns for control owner, inherent likelihood and impact, control design, operating effectiveness, residual rating and actions. We confirm your email with a 6-digit code, then email you the download link.

Frequently asked questions

What are the key risks in Investor Relations?

The main risk areas covered are Events and Conferences, Financial Communications, Shareholder Services, Strategy and Planning, Technology and Analytics. Each unit lists its key risks with a short explanation and the best-practice controls that mitigate them.

How do I use this register for a risk and control self-assessment?

Select the risks that apply to your units, map the listed controls to the controls you actually operate, rate inherent risk and control effectiveness, then agree actions for gaps. The free RCSA workbook on this page has the columns ready.

Put these controls to work this month

Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.

Request a software demo Ask a question