Top risks and controls for Risk Management
The Risk Management register lists 35 key risks and 92 best-practice controls across 6 units: Compliance Risk Management, Credit Risk Management, Enterprise Risk Management, Market Risk Management, Operational Risk Management, Quantitative Analysis. Use it to identify risks, benchmark your existing controls or start a risk and control self-assessment (RCSA).
AI-era lens: risk management functions now own the framework that decides how AI and models are governed. In April 2026 the Federal Reserve, OCC and FDIC replaced SR 11-7 with SR 26-2, a risk-based model risk guidance that scales validation to model materiality and excludes generative and agentic AI from its scope, so institutions need a separate, proportionate AI governance approach. The quantitative analysis and enterprise risk units below are where that work sits. See the AI risk governance guide and the new AI and model risk register.
For banks to preserve stability, financial security, and regulatory compliance, risk management is an essential task.
Risk assessment is a crucial component of risk management.
Risk assessments assist banks in locating, assessing, and mitigating potential risks related to their business operations, goods, and services, as well as external variables including the state of the economy, changes in regulations, and online threats.
Banks may proactively manage risks, reduce losses, and make sure they adhere to regulatory obligations by regularly conducting risk assessments.
Inadequate risk assessments can lead to major financial losses, damage to one's reputation, and legal repercussions.
Therefore, it is essential for a bank's risk management function to carry out routine risk assessments in order to preserve the bank's stability and protect its interests.
Units covered
Compliance Risk Management: key risks and controls
Accountable for ensuring that the bank complies with pertinent laws, rules, and industry standards, including know-your-customer (KYC) and anti-money laundering (AML) legislation.
| Risk | What can go wrong | Best-practice controls |
|---|---|---|
| Complexity of Regulations | The regulatory environment for commercial banks is complex and constantly evolving, with new rules and regulations being introduced regularly. Banks must stay abreast of these changes and ensure that they are complying with all relevant requirements. |
|
| Cost | Compliance risk management can be expensive, as banks must invest in technology, staff, and training to ensure that they are complying with regulations. This can be a significant burden for smaller banks that have limited resources. |
|
| Cross-border Operations | Commercial banks that operate across multiple jurisdictions must comply with a variety of different regulations, which can be challenging to navigate. Banks must ensure that they have a clear understanding of the regulatory environment in each jurisdiction and that they are complying with all relevant requirements. |
|
| Data Management | Compliance risk management requires the collection and analysis of large amounts of data, including customer data, transaction data, and regulatory data. Banks must have effective systems in place to collect, manage, and analyze this data in order to identify potential compliance risks. |
|
| Reputation Risk | Non-compliance with regulations can damage a bank's reputation and result in significant financial losses. Banks must be proactive in managing compliance risk to avoid negative publicity and potential legal action. |
|
Credit Risk Management: key risks and controls
Accountable for controlling the bank's exposure to credit risk, which includes determining a borrower's creditworthiness, establishing credit limits, and keeping track of credit exposures.
| Risk | What can go wrong | Best-practice controls |
|---|---|---|
| Credit risk concentration | Commercial banks often have significant exposure to a small number of borrowers or industries. This can create significant risk if those borrowers or industries experience financial difficulties, as it can lead to a large number of defaults at once. |
|
| Cybersecurity threats | As banks increasingly rely on technology to manage credit risk, they are becoming more vulnerable to cyberattacks. A successful attack could compromise borrower data, disrupt operations, and cause significant financial losses. |
|
| Economic downturns | Economic downturns can have a significant impact on credit risk, as borrowers may become less able to repay their loans. Banks need to be prepared for these downturns and have strategies in place to manage the associated risks. |
|
| Increasingly complex regulatory requirements | Banks are subject to a variety of regulations that govern their lending activities, and these regulations are becoming more complex and stringent over time. Compliance with these regulations can be time-consuming and costly, and failure to comply can result in significant penalties and reputational damage. |
|
| Lack of transparency in borrower data | Banks need accurate and timely information about borrowers in order to make informed lending decisions. However, in many cases, borrowers may be reluctant to share detailed financial information, or the data may be incomplete or unreliable. |
|
| Rapidly changing market conditions | The business environment is constantly changing, and commercial banks must be able to quickly adapt to new market conditions. This can be especially challenging in the current environment, where interest rates, exchange rates, and other key factors are highly volatile. |
|
Enterprise Risk Management: key risks and controls
The person in charge of managing the bank's overall risk management strategy is also in charge of establishing the bank's risk appetite and tolerance levels, as well as keeping track of and reporting on the bank's risk exposures.
| Risk | What can go wrong | Best-practice controls |
|---|---|---|
| Cultural Challenges | Banks may face cultural challenges in implementing ERM, as some employees may resist changes that disrupt their established ways of working. Banks need to ensure that employees understand the importance of ERM and the benefits it can bring to the organization. |
|
| Cybersecurity Risks | Cybersecurity risks are a significant threat to commercial banks. These risks are constantly evolving, and banks must keep up to date with the latest threats and vulnerabilities to ensure adequate protection of their systems and data. |
|
| Data Management | Banks have access to vast amounts of data, but integrating and analyzing this data to identify risk can be a daunting task. Banks need to ensure the accuracy, completeness, and consistency of their data to avoid incorrect risk assessments. |
|
| External Factors | Banks are exposed to risks from external factors such as economic conditions, geopolitical events, and natural disasters. These risks are difficult to predict and can have significant impacts on the bank's operations and financial performance. |
|
| Integration with Business Strategy | ERM needs to be integrated with the bank's overall business strategy to be effective. This requires a clear understanding of the bank's risk appetite and the risks associated with the bank's strategic objectives. |
|
| Operational Risks | Banks face operational risks from processes, people, and systems, which can lead to losses or reputational damage. Identifying and mitigating these risks requires a robust operational risk management framework. |
|
| Regulatory Compliance | Banks are subject to numerous regulatory requirements, which makes it difficult to maintain a standardized ERM framework across different jurisdictions. Compliance with these regulations can be time-consuming and expensive. |
|
Market Risk Management: key risks and controls
Accountable for controlling the exposure of the bank to market risks, such as interest rate risk, foreign exchange risk, and commodity price risk.
| Risk | What can go wrong | Best-practice controls |
|---|---|---|
| Complexity of financial instruments | Banks use a wide range of complex financial instruments to manage their risks and generate returns. However, these instruments can also increase the complexity of market risk management, as their behavior may not be easily predictable or observable. |
|
| Inadequate risk models | Banks rely on risk models to estimate their market risks. However, these models may not always accurately capture the complexities of financial markets, leading to erroneous risk estimates. |
|
| Lack of data | Market risk management requires historical data on market prices and other relevant variables. However, in some markets, historical data may not be readily available, making it challenging to accurately estimate market risks. |
|
| Regulatory requirements | Regulators require banks to maintain certain levels of capital and liquidity to manage their market risks. Meeting these requirements can be challenging, as they can limit the banks' ability to generate profits and compete in the market. |
|
| Volatility and unpredictability | Financial markets can be volatile and unpredictable, making it difficult for banks to accurately measure and manage market risks. Economic events such as recessions, pandemics, and geopolitical tensions can cause sudden and significant changes in market prices, leading to large losses for banks. |
|
Operational Risk Management: key risks and controls
Accountable for controlling the bank's exposure to operational risk, which includes risks from internal systems, processes, and people as well as hazards from the outside world.
| Risk | What can go wrong | Best-practice controls |
|---|---|---|
| Emerging Risks | Banks must also be prepared for emerging risks, such as climate change, geopolitical instability, and cyber threats, which can have a significant impact on their operations and customers. |
|
| Human Error | Human error remains a significant risk factor in operational risk management. Banks need to invest in training and awareness programs to reduce the risk of human error and ensure that employees understand their roles and responsibilities. |
|
| Increasing Complexity | The increasing complexity of banking operations has made it more challenging to identify, assess, and mitigate operational risks. Banks now have to deal with complex IT systems, data management, outsourcing, and cyber threats, which increase the risk of operational failures. |
|
| Lack of Integration | Many banks still have siloed operational risk management functions that do not integrate well with other risk management functions. This can lead to duplication of efforts, inconsistent risk management practices, and a lack of visibility into overall risk exposure. |
|
| Limited Data Availability | The data required for operational risk management is often fragmented and dispersed across multiple systems, making it difficult to analyze and use effectively. Additionally, some operational risks are difficult to quantify, such as reputational risk, making it harder to accurately measure and manage them. |
|
| Regulatory Compliance | Banks must comply with a range of regulations and guidelines that govern their operational risk management practices. These include the Basel Committee's Principles for the Sound Management of Operational Risk, which require banks to establish a comprehensive operational risk management framework, assess their operational risk exposures, and implement appropriate controls to mitigate those risks. |
|
Quantitative Analysis: key risks and controls
Responsible for creating and executing models and tools, such as credit risk models, market risk models, and stress testing models, to monitor and manage the bank's risk exposures.
| Risk | What can go wrong | Best-practice controls |
|---|---|---|
| Data quality and availability | Accurate risk measurement requires high-quality and relevant data. However, commercial banks often face challenges in obtaining timely and accurate data, particularly when dealing with complex financial instruments and derivatives. |
|
| Human error | The use of models and tools for risk measurement in commercial banks can be subject to human error, which can lead to incorrect risk assessments and decision-making. |
|
| Interpretability and transparency | Risk measurement models need to be transparent and interpretable to enable stakeholders to understand how risks are being measured and managed. However, some models can be complex and difficult to understand, which can limit their usefulness. |
|
| Model accuracy and reliability | Risk measurement models need to be accurate and reliable to enable effective decision-making. However, developing such models can be challenging due to the complexity of financial markets and the dynamic nature of risk factors. |
|
| Model validation | Once developed, risk measurement models need to be validated to ensure that they accurately capture the risks faced by commercial banks. This process can be time-consuming and resource-intensive. |
|
| Regulatory compliance | Commercial banks need to comply with a range of regulatory requirements when developing risk measurement models and tools. These requirements can be complex and subject to change, which can add to the challenges of developing effective models and tools. |
|
This register is a starting point for risk identification and benchmarking against international practice. Adapt the risks and controls to your institution's size, products, jurisdiction and regulatory requirements.
Get the Risk Management register as an RCSA workbook
A spreadsheet-ready CSV with every risk and control on this page, plus blank columns for control owner, inherent likelihood and impact, control design, operating effectiveness, residual rating and actions. We confirm your email with a 6-digit code, then email you the download link.
Frequently asked questions
What are the key risks in Risk Management?
The main risk areas covered are Compliance Risk Management, Credit Risk Management, Enterprise Risk Management, Market Risk Management, Operational Risk Management, Quantitative Analysis. Each unit lists its key risks with a short explanation and the best-practice controls that mitigate them.
How do I use this register for a risk and control self-assessment?
Select the risks that apply to your units, map the listed controls to the controls you actually operate, rate inherent risk and control effectiveness, then agree actions for gaps. The free RCSA workbook on this page has the columns ready.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.