The confusion usually sits between two activities. A risk assessment measures and prioritises exposure. A risk review tests whether that assessment, the controls, the assumptions and the actions still reflect reality.
This guide covers how the two differ, when to use each, how to rate risks, and how UK fintechs can build evidence that stands up with leadership, investors, partners and regulators.
Key Takeaways
- An assessment analyses a defined risk or activity; a review revisits it as conditions change.
- Combine scheduled reviews with event-driven ones, not just an annual exercise.
- Rate inherent and residual risk separately, and tie each material risk to an owner and action.
- Tailor taxonomy and rating scales to your products, permissions and risk appetite.
Risk Reviews, Risk Assessments and Risk Audits: What Is the Difference?
No UK source sets one universal definition of "risk review", so firms should define their terms and apply them consistently. The distinctions below are a practical synthesis.
- Risk assessment: a structured process to identify, analyse, evaluate and treat risk in a specific activity, product, process, relationship or change. ISO 31000 groups this as identification, analysis and evaluation.
- Risk review: a recurring or trigger-based governance check on whether ratings, controls and treatment plans remain relevant and effective.
- Risk audit: independent, retrospective assurance that policies and controls were designed and operated as intended.
An assessment establishes or recalculates the risk position. A review challenges whether that position is still accurate. An audit sits apart from both. Under the IIA's Three Lines Model, internal audit is the independent third line, and assurance never transfers management's responsibility for risk.
What each process should produce
| Process | Typical outputs |
|---|---|
| Assessment | Risk statement, likelihood and impact analysis, control evaluation, rating, treatment plan, owner, review date |
| Review | Decisions: keep or change a rating, add controls, escalate, accept residual risk, close an obsolete risk, exit a relationship |
| Audit | Evidence-based findings, control observations, recommendations, owners, remediation deadlines |
Fraxtional offers both risk assessment services and independent audit services, and the two are kept separate so that the party testing controls is not the one that designed them.
How to Conduct a Risk Assessment: A Five-Point Method
Voluntary frameworks such as ISO 31000 and the HM Treasury Orange Book describe similar processes. Neither is a universal legal requirement. For financial crime specifically, regulation 18 of the Money Laundering Regulations 2017 requires in-scope firms to assess and record their ML/TF risks and keep that record up to date.
The five points below are a practical grouping, not a prescribed standard.
- Set scope, context and criteria. Name the product, process, third party, jurisdiction, customer segment or change. Confirm the risk appetite and who decides.
- Identify risks. Capture credible events, causes and consequences. Draw on workshops, incident data, complaints, compliance findings, threat intelligence and process maps, not only past risks.
- Analyse likelihood and impact. Use one consistent method. Consider financial loss, customer harm, regulatory consequences, operational disruption, data compromise, reputational damage and how fast harm could land.
- Evaluate controls and residual risk. Separate a control that exists on paper from one with evidence it works. The FCA warned about firms concluding that risks were low or controls effective without adequate evidence.
- Treat, assign and monitor. Record mitigation options, acceptance rationale, owners, target dates, key risk indicators, escalation thresholds and reassessment triggers.
Example: launching a new payment product
A UK payments firm adds cross-border transfers to a new corridor.
- Scope: the corridor, the customer segment and the partner bank.
- Identify: sanctions exposure, fraud typologies, partner outage.
- Analyse: sanctions breach rated high impact and medium likelihood.
- Controls: screening exists, but test results show a gap in name-matching thresholds, so residual risk stays high.
- Treat: tune screening, name an owner, set a 60-day target, and define a reassessment trigger if volumes double.
Fraxtional's Control Effectiveness Testing follows the same logic, verifying that controls work as designed rather than accepting the policy document at face value.
How to Run an Effective Risk Review
A review that only confirms the register was updated adds little. It should challenge the current picture.
Set cadence and triggers
No single UK interval applies to all enterprise risk. The MLR duty is to keep the record "up to date", FCA financial crime guidance says "regularly", and operational resilience rules are trigger-based. Set a proportionate schedule for material risks, then add event-driven reviews after:
- Incidents, near misses or control failures
- Major product or technology changes
- New third parties or critical outsourcing
- Regulatory developments
- Material growth or shifts in customer and geographic exposure
Challenge the risk picture
Examine:
- New and emerging risks
- Changes in likelihood or impact
- Control performance and overdue actions
- Complaints, key risk indicators and shifts in appetite
Look at how risks interact too. A vendor outage can become a safeguarding or conduct problem.
Record decisions
Document:
- Who attended and the evidence considered
- Rating changes and accepted risks
- Escalation routes, owners and deadlines
- Approval authority and the date or event for the next review
Clarify who does what
- First line: owns and manages risk day to day.
- Second line: supports, monitors and challenges.
- Senior management and board: set appetite and approve acceptance of material risks.
- Independent assurance: tests the whole arrangement.
The same team should not assess, approve, remediate and independently validate its own work. Risks that cross teams, or depend on a critical third party, need input from operations, compliance, information security, financial crime, legal and product together.
Seven Risk Types and Five Risk Rating Levels
No UK source mandates seven risk types or a five-level scale. Both are choices you make and document.
An illustrative seven-category taxonomy
- Strategic and business model
- Operational and resilience
- Financial and prudential
- Regulatory and legal
- Financial crime
- Technology and cyber
- Third-party and concentration
Depending on your model, these may deserve their own categories:
- Conduct and customer outcomes
- Data protection
- Liquidity
- Reputation
Consumer Duty and ICO data protection impact assessments, for example, bring distinct obligations.
A five-level scale
A common scale runs from low to critical. The labels matter less than the definitions behind them. For each level, set thresholds for likelihood, impact, control effectiveness, escalation and risk acceptance.
Say plainly that this is your methodology. The Orange Book supports common criteria and meaningful differentiation, but prescribes no universal scale.
Inherent versus residual risk
Inherent risk is exposure before controls. Residual risk is what remains after them. A likelihood-impact matrix helps prioritise, but avoid false precision. A score of 12 versus 10 rarely reflects real difference, and ratings should support judgement, not replace it.
For every rating, record:
- Evidence used and assumptions
- Control gaps and appetite position
- What would change the rating
Applying the Process in UK Fintech Governance
Map assessments and reviews to what you actually do:
- Products and permissions
- Customer activity and outsourcing
- Financial crime exposure
- Operational resilience
- Data handling and cross-border dependencies
Verify current FCA, PRA, financial crime and data protection requirements before relying on any summary. Several regimes are changing, including safeguarding and cryptoassets.
What good evidence looks like
Management, investors, sponsor banks, counterparties and regulators typically want to see:
- A current risk register and written assessment methodology
- A review calendar and meeting records
- Control testing results and issue logs
- Risk acceptance approvals
- Remediation tracking
- Documented links between risks and business decisions
The FCA fined Starling Bank £28,959,426 for financial crime control failings, noting that controls did not keep pace with rapid growth. That was not a fine for a risk assessment lapse alone, but it shows what happens when controls fall behind change.
Common implementation failures
- Copying a generic questionnaire
- Treating annual completion as sufficient
- Assigning ratings without evidence
- Leaving actions ownerless
- Failing to reassess after material change
Where Fraxtional fits
Fraxtional provides director-led fractional compliance leadership for fintech, crypto, banking, money transmission and embedded finance firms. That can mean designing a risk methodology, running reviews, overseeing remediation, or acting as a named CCO, CRO or MLRO without a full-time hire.
Engagements run from advisory to subscription to fractional models, scaling from a few hours a week to full-time coverage. Directors work as an extension of your team, with a handover if you later hire in-house. Accountability for risk decisions stays with your firm's own management.
Frequently Asked Questions
What is a risk review?
A scheduled or trigger-based examination of whether identified risks, ratings, controls, assumptions and treatment plans remain current and effective.
What are the 5 points of a risk assessment?
Scope and context; risk identification; likelihood and impact analysis; control and residual-risk evaluation; and treatment, ownership, monitoring and documentation.
What are the 7 types of risks?
Classifications vary. A fintech-relevant set is strategic, operational, financial, regulatory and legal, financial crime, technology and cyber, and third-party risk. Conduct, data protection, liquidity and reputation may be treated separately.
What are the 5 risk rating levels?
Labels differ between firms; low to critical is common. Each level needs defined likelihood, impact, control, escalation and acceptance criteria. No UK rule mandates a five-level scale.
How often should a risk review be conducted?
Run scheduled reviews plus event-driven ones after incidents or major change. Higher-risk activities, material third parties and fast-changing environments need more frequent attention.
What is the difference between a risk review and a risk assessment?
An assessment establishes or recalculates the risk position. A review checks whether that position and its controls remain appropriate as circumstances change.
