Safety Norms: Enterprise and Financial Risk Management

1Purpose, Scope, and Safety Principles

These norms set out how staff protect the organization, its customers, its employees, and its stakeholders from harm arising from enterprise and financial risk management work. In this field, harm usually takes the form of financial loss, misstatement, regulatory breach, data exposure, or poor decisions made on inaccurate information. Physical hazards are limited, but the consequences can be severe and spread quickly across the organization.

The scope covers risk identification, assessment, measurement, treatment, monitoring, and reporting across credit, market, liquidity, operational, compliance, conduct, technology, and third-party risk. It applies to employees, contractors, interns, and advisers who access risk data or produce risk outputs, whether they work in an office, at home, or on approved travel. A risk appetite is the amount and type of risk the board is willing to accept. A key risk indicator is a measure that signals rising exposure. A risk register is the controlled list of identified risks, their owners, and their rating.

• Mandatory: no one may accept, approve, or publish a risk decision outside their delegated authority.
• Mandatory: use only approved systems and data sources for risk calculations and risk reports.
• Recommendation: treat every risk figure as a claim that needs evidence, a stated method, and a named owner.

2Roles, Competence, and Accountability

The board or its risk committee approves the risk appetite and receives independent reporting on exposures. Senior management assigns risk owners, funds controls, and ensures that issues are resolved. The first line, comprising business units, owns and manages its risks day to day. The second line, the independent risk function, sets the framework, challenges assessments, and reports exposures. Internal audit, the third line, tests whether the framework operates as designed. Accountability follows these lines, and no function reviews its own work.

Competence must be demonstrated, not assumed. Analysts who perform model calculations, stress tests, or capital-related analysis need documented training and supervised experience before working unsupervised. Access to risk systems follows least privilege and is granted by the data owner, not requested by the user alone. Anyone who finds a gap in their own competence must stop, tell a supervisor, and seek support rather than guess.

• Mandatory: maintain a current delegation of authority matrix and check it before approving any limit breach, exception, or risk acceptance.
• Mandatory: record each risk owner's name, role, and acceptance decision in the risk register.
• Mandatory: complete required conduct, data protection, and financial crime training before system access is granted, where your jurisdiction or employer requires it.
• Recommendation: pair new analysts with an experienced reviewer for their first several significant reports.

3Realistic Hazards and Risk Assessment

The hazards in this subject are specific. Models and assumptions can be wrong or misapplied, leading to underestimated losses or false comfort. Spreadsheets with broken formulas, hidden rows, overwritten cells, or manual copy and paste steps produce wrong totals that reach senior readers. Concentration of exposure to one counterparty, sector, country, or currency can grow unnoticed between reporting cycles. Liquidity mismatches can turn a manageable shock into a funding problem. Operational failures include process errors, system outages, internal fraud, external fraud, and third-party service failures. Conduct risks include conflicts of interest, pressure to downplay ratings, and selective reporting of results.

Risk levels should be scored consistently using a documented scale of likelihood and impact, with a defined rule for what requires escalation. A high-rated risk, a limit breach, or a control failure in a critical process must be escalated within the time frame set by the risk policy. Scoring involves judgment, so the rationale must be written down and challenged by the second line. Scores that change without a recorded reason are treated as unreliable until explained.

• Hazard: data errors in risk inputs. Control: reconcile risk data to the general ledger or source system before each report is issued. Owner: data steward.
• Hazard: uncontrolled spreadsheet models. Control: register all material spreadsheets, restrict edit rights, and have changes independently reviewed. Owner: model owner.
• Hazard: concentration or limit breaches. Control: monitor limits at the frequency the business model requires and escalate any breach to the designated limit owner. Owner: first line risk manager.
• Hazard: unauthorized disclosure of confidential or price sensitive information. Control: classify data and restrict distribution lists. Owner: information owner.
• Hazard: pressure to misstate ratings. Control: require a documented rationale and second line sign off for any downgrade or upgrade. Owner: head of risk.
• Hazard: model misuse outside its validated scope. Control: record the approved use case and reject requests that fall outside it. Owner: model validation lead.

4Preventive Controls and Safe Practices

Controls work best when they are built into normal processes rather than added at the end. Segregation of duties keeps the person who builds a model or assumption separate from the person who approves it, and keeps the person who executes a transaction separate from the person who records or confirms it. Change control applies to models, parameters, reporting logic, and systems. Every change needs a ticket, a stated reason, testing evidence, and approval by someone independent of the change.

Safe practice also means working within stated limits. Do not run a scenario or stress test using unapproved assumptions, and do not present results as official until they have been reviewed. Keep assumption sets, version numbers, and a record of the data extraction in the working file, and never overwrite prior versions. When a method is uncertain, say so in the report and show a range of outcomes rather than a single figure that implies false precision. A result that cannot be reproduced by a second person is not ready for use.

• Mandatory: no one approves their own risk assessment, limit exception, or model change.
• Mandatory: store risk models and reporting templates in version control or a locked, controlled repository.
• Mandatory: reports sent outside the risk function must show the author, reviewer, data sources, and version number.
• Mandatory: do not copy live exposure or trading data into test files, personal workbooks, or personal cloud storage.
• Mandatory: stop and escalate when a control is bypassed, a figure cannot be reproduced, or a model output contradicts known facts.
• Recommendation: hold a short peer challenge session before any board or regulator facing report is issued.
• Recommendation: list the assumptions that drive the largest share of results and review them at a regular interval.

5Tools, Environments, and Information Safeguards

Tools in this field include enterprise risk platforms, spreadsheets, dashboards, statistical or modeling software, and shared drives. Environments include corporate offices, remote workstations, meeting rooms, and business travel. Risk information is often confidential, price sensitive, or personal. It must be protected in every location. Lock screens when away from a desk, do not discuss exposures in shared or public spaces, and avoid printing sensitive reports unless local procedure allows it and printouts are collected or shredded.

Privacy and security obligations depend on jurisdiction, contract, and internal policy. Customer data handling, retention, cross border transfer, and insider information rules must be confirmed with the organization's legal, privacy, and compliance teams. Cybersecurity controls such as multifactor authentication, timely patching by the technology team, and phishing awareness are part of risk work, not separate from it. Do not install unapproved software or connect personal storage devices to corporate systems. Workstations should be arranged to reduce strain during long analysis sessions.

• Mandatory: access risk systems only through approved accounts, with multifactor authentication where the system supports it.
• Mandatory: store confidential risk files only in approved repositories that keep access logs.
• Mandatory: confirm recipients and approvals before sharing any risk report outside the authorized group.
• Mandatory: report suspected phishing, lost devices, or misdirected messages to the security team immediately.
• Recommendation: use redacted or aggregated data in presentations and training material.
• Recommendation: report persistent eye strain, wrist pain, or other symptoms from screen work to the workplace health provider.

6Incident, Emergency, and Escalation Procedures

Risk incidents include limit breaches, data leaks, model failures, misreported figures, suspected fraud, system outages that affect risk calculations, and control failures. Report them at once to your line manager and the designated risk or compliance contact, using the incident system. Do not wait for a full analysis before reporting. A near miss, such as a wrong figure caught before distribution, is reported and reviewed in the same way, because it shows where the process is weak and prevents a later loss.

Emergency readiness means the business continuity plan covers risk systems, data backups, and alternative calculation methods, and that staff know how to use them. If a situation involves physical danger, contact building security or emergency services first, then the designated internal contacts. For suspected security breaches or fraud, preserve evidence and follow the approved response plan. Do not attempt to recover systems or investigate alone. Notification deadlines to regulators are set by jurisdiction and must be determined by compliance and legal teams.

• Mandatory: report any suspected data breach or misreported figure to the incident owner within the time frame in the incident policy.
• Mandatory: do not alter, delete, or overwrite records connected to an incident.
• Mandatory: escalate to senior management and the risk committee chair any breach of a board approved limit that is not resolved within the policy time frame.
• Mandatory: if you suspect fraud or insider activity, do not confront the individual; report to compliance or the designated investigator.
• Recommendation: run tabletop exercises at a regular interval covering a data outage, a major limit breach, and a model failure.

7Records, Training, Monitoring, and Review

Records show that the framework operates as intended. Keep risk registers, approvals, model documentation, exception logs, training records, incident reports, and review minutes in controlled repositories, with retention rules set by policy and law. Records should show who decided what, based on which information, and when the decision will be reviewed again.

Monitor the framework through key risk indicators, control testing, issue tracking, and lessons from incidents. Review the risk appetite, risk register, and key models at a set interval and after significant events such as acquisitions, new products, system migrations, or market stress. Continuous improvement means closing actions with named owners and evidence of completion, not merely recording them.

• Mandatory: complete required training before performing risk calculations or reporting, and refresh it when the procedure changes.
• Mandatory: maintain a log of exceptions and approvals, including the conditions under which each expires.
• Recommendation: track control failures and open actions on a dashboard reviewed by the risk committee.
• Recommendation: feed lessons from incidents and near misses into the next training session.

Implementation checklist

• Confirm you hold current delegated authority before approving any risk acceptance or limit exception.
• Reconcile risk inputs to the source system before issuing any report.
• Confirm that no one reviews their own assessment or model change.
• Store confidential risk files only in approved, access logged repositories.
• Lock your screen and keep sensitive figures out of shared or public spaces.
• Escalate limit breaches and suspected control failures through the incident process without delay.
• Preserve records and do not alter evidence after an incident.
• Document assumptions, versions, data sources, and reviewer names on every report.
• Complete required training before performing risk calculations or sharing results.
• Verify legal, privacy, and regulatory requirements with qualified professionals in your jurisdiction.