Sections

The Pensions Regulator

Regulatory guidance

Regulatory guidance

Internal controls

Identify risks

Purpose

Using the risk-management objectives defined in the previous step, the purpose of this stage is to assemble a full list of the risks to which the scheme is exposed.

Description

The agreed risk-management objectives should be used to help you focus on the key activities of the scheme. You should then look in detail at the activities and identify the risks involved with each activity.

At this stage, you are trying to identify all the risks applicable to each activity and are not attempting to do any assessment of the likelihood and impact of the risk. It is important that as many risks as possible are identified and it will be helpful to get input from all the trustees and others representing the main activities carried out by the scheme (managers, administrators etc).

External risks that may affect its good running must also be considered. The risk of delegated services, such as third-party administrators, failing to deliver is one which will affect the majority of schemes. Even if you are involved in a scheme that uses in-house services, you are still likely to use external investment management or insurance companies.

As outlined in the code, when identifying the risks, you may find the categories below helpful.

Once you have identified the risks, these should be collated and recorded.

The conventional way of recording identified risks is through the use of a listing known as a risk register. You can view and download an example risk register on our website. The register schedules the identified risks and has additional columns for:

  • the risk assessment that follows;
  • the controls to be put in place; and
  • the residual risks.

It also provides the basis for identifying the responsibilities, monitoring procedures and follow-up action required to make the risk-management process effective.

Outcomes

A complete list of all the risks affecting the key activities of the scheme has been agreed. This has been recorded as a schedule in a risk register.