IR-01.1 · Insurance risk
Underwriting outside appetite or authority
Risks written outside the approved plan, line sizes or individual underwriter authorities.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Premium
- Key risk indicator
- Referrals breaching authority per month
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-001Underwriter authority lettersUnderwriting team · last tested 8 Aug 2026Effective
- C-002Peer review of large risksUnderwriting team · last tested 15 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-01.2 · Insurance risk
Inadequate pricing
Rates fail to cover expected losses, expenses and the cost of capital.
- Inherent123 × 4 · Medium
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Chief Actuary
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Premium
- Key risk indicator
- Rate change vs plan assumption
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-003Pricing model governanceActuarial team · last tested 22 Jul 2026Effective
- C-004Rate adequacy monitoringActuarial team · last tested 2 Aug 2026Effective
Actions
- ACT-041Reprice US trucking accounts at renewalChief Underwriting Officer · due 30 Nov 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
IR-01.3 · Insurance risk
Social inflation in US casualty
Rising US jury awards outpace casualty rate increases.
- Inherent164 × 4 · High
- Residual123 × 4 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9147
- Class
- Insurance risk · Premium
- Key risk indicator
- US casualty severity trend
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-005Claims trends fed into pricingUnderwriting team · last tested 9 Sep 2026Effective
- C-006Limit management on US E&SUnderwriting team · last tested 16 Jul 2026PartialOverdue
Actions
- ACT-041Reprice US trucking accounts at renewalChief Underwriting Officer · due 30 Nov 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
IR-01.4 · Insurance risk
Adverse selection in growth classes
Fast growth in casualty and reinsurance attracts poorer-quality risks.
- Inherent164 × 4 · High
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9147, Syn 9146
- Class
- Insurance risk · Premium
- Key risk indicator
- Loss ratio on new vs renewal business
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-007Portfolio steering reviewsUnderwriting team · last tested 23 Aug 2026Effective
- C-008New business quality metricsUnderwriting team · last tested 3 Sep 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-01.5 · Insurance risk
Softening market cycle
Rates fall faster than planned and erode margins.
- Inherent124 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Premium
- Key risk indicator
- Risk-adjusted rate change
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-009Rate monitoringUnderwriting team · last tested 10 Jul 2026Effective
- C-010Mid-year plan reforecastUnderwriting team · last tested 17 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-01.6 · Insurance risk
Unintended policy coverage
Wordings give cover that was never priced, such as silent cyber.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of Product
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Premium
- Key risk indicator
- Wording exceptions approved
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-011Wordings committeeUnderwriting team · last tested 24 Sep 2026Effective
- C-012Market cyber exclusions adoptedUnderwriting team · last tested 4 Jul 2026Effective
Actions
- ACT-047Approve or remove 4 unapproved wording exceptionsHead of Product · due 15 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
IR-02.1 · Insurance risk
Long-tail casualty reserve inadequacy
Casualty reserves prove too low as claims develop over many years.
- Inherent153 × 5 · High
- Residual123 × 4 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Actuary
- Where it sits
- Syn 9147
- Class
- Insurance risk · Reserving
- Key risk indicator
- Actual vs expected claims development
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-013Quarterly reserving committeeActuarial team · last tested 11 Aug 2026Effective
- C-014Independent actuarial reviewActuarial team · last tested 18 Sep 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-02.2 · Insurance risk
Reserving data quality
Incomplete delegated and fronted claims data distorts reserves.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Actuary
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Reserving
- Key risk indicator
- Bordereaux late or incomplete
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-015Bordereaux data validationActuarial team · last tested 25 Jul 2026Effective
- C-016Reserving data reconciliationActuarial team · last tested 5 Aug 2026Effective
Actions
- ACT-036Chase late binder bordereaux (INC-033)Head of Delegated Authority · due 15 Oct 2026Open
- ACT-029Agree claims service levels with the UAE fronting partner (INC-028)Head of Claims · due 31 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
IR-02.3 · Insurance risk
Climate litigation
Insureds are sued for climate-related harm under liability policies.
- Inherent82 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9147
- Class
- Insurance risk · Reserving
- Key risk indicator
- Climate-related claims notified
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-017Climate exclusions reviewUnderwriting team · last tested 12 Sep 2026Effective
- C-018Emerging risk monitoringUnderwriting team · last tested 19 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-03.1 · Insurance risk
Natural catastrophe accumulation
A major event exceeds modelled losses across property and reinsurance.
- Inherent153 × 5 · High
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Head of Exposure Management
- Where it sits
- Syn 9146
- Class
- Insurance risk · Catastrophe
- Key risk indicator
- 1-in-200 net cat loss vs appetite
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-019Realistic disaster scenario monitoringActuarial team · last tested 26 Aug 2026Effective
- C-020Catastrophe model validationActuarial team · last tested 6 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-03.2 · Insurance risk
Systemic cyber accumulation
One cyber event triggers losses across many policies at once.
- Inherent153 × 5 · High
- Residual123 × 4 · Medium
- ControlsPartially effective
Register entry
- Owner
- Head of Exposure Management
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Catastrophe
- Key risk indicator
- Cyber PML vs tolerance
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-021Cyber aggregate scenariosActuarial team · last tested 13 Jul 2026Effective
- C-022Event limits and exclusionsActuarial team · last tested 20 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-03.3 · Insurance risk
Climate-driven loss frequency and severity
Warming increases the frequency and cost of weather losses beyond models.
- Inherent164 × 4 · High
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Head of Exposure Management
- Where it sits
- Syn 9146
- Class
- Insurance risk · Catastrophe
- Key risk indicator
- Secondary peril losses vs model
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-023Climate-adjusted catastrophe viewActuarial team · last tested 27 Sep 2026Effective
- C-024Climate scenario analysisActuarial team · last tested 7 Jul 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-03.4 · Insurance risk
Political violence accumulation
Terror and unrest exposure builds up in a small number of cities.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Dubai
- Class
- Insurance risk · Catastrophe
- Key risk indicator
- PV&T aggregate by city
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-025City and country aggregate limitsUnderwriting team · last tested 14 Aug 2026Effective
- C-026Quota share to 9147Underwriting team · last tested 21 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-04.1 · Insurance risk
Early termination of multi-year contracts
Multi-year policies and long-term agreements are cancelled early, removing expected profit.
- Inherent62 × 3 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Lapse
- Key risk indicator
- Retention rate by class
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-027Cancellation terms in contractsUnderwriting team · last tested 1 Jul 2026Effective
- C-028Retention monitoringUnderwriting team · last tested 8 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-04.2 · Insurance risk
Loss of coverholder agreements
Key coverholder binders are not renewed or are cancelled mid-term, removing planned premium.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of Delegated Authority
- Where it sits
- Syn 9146, Dubai
- Class
- Insurance risk · Lapse
- Key risk indicator
- Binder premium up for renewal in 90 days
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-029Coverholder relationship plansDelegated authority team · last tested 15 Sep 2026Effective
- C-030Binder renewal pipelineDelegated authority team · last tested 22 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-05.1 · Insurance risk
Concentration in Gulf energy
Middle East growth concentrates exposure in a few large energy sites.
- Inherent123 × 4 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Dubai
- Class
- Insurance risk · Accumulation & aggregation
- Key risk indicator
- Top-10 Gulf energy aggregates
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-031Zonal aggregate limitsUnderwriting team · last tested 2 Aug 2026EffectiveOverdue
- C-032Dubai underwriting referralsUnderwriting team · last tested 9 Sep 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
IR-05.2 · Insurance risk
Large single-risk exposure
One large loss on a big line exceeds tolerance.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Insurance risk · Accumulation & aggregation
- Key risk indicator
- Lines above guideline size
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-033Maximum line size guidelinesUnderwriting team · last tested 16 Jul 2026Effective
- C-034Facultative reinsurance for large linesUnderwriting team · last tested 23 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-01.1 · Market risk
Bond value loss from rising rates
Higher rates cut the market value of the fixed income portfolio.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Market risk · Interest rate
- Key risk indicator
- Portfolio duration vs limit
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-035Duration limitsFinance team · last tested 3 Sep 2026Effective
- C-036Interest rate stress testingFinance team · last tested 10 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-01.2 · Market risk
Asset-liability duration mismatch
Asset durations drift from long-tail casualty liabilities.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9147
- Class
- Market risk · Interest rate
- Key risk indicator
- Duration gap
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-037ALM matching policyFinance team · last tested 17 Aug 2026Effective
- C-038Duration monitoringFinance team · last tested 24 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-02.1 · Market risk
Equity market fall
A fall in markets reduces the value of the small equity allocation.
- Inherent42 × 2 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Market risk · Equity
- Key risk indicator
- Equity allocation vs cap
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-039Equity allocation capFinance team · last tested 4 Jul 2026Effective
- C-040Investment guidelinesFinance team · last tested 11 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-03.1 · Market risk
Credit spread widening
Wider corporate bond spreads reduce asset values.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Market risk · Spread
- Key risk indicator
- Average portfolio credit rating
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-041Credit quality limitsFinance team · last tested 18 Sep 2026Effective
- C-042Spread stress testingFinance team · last tested 25 Jul 2026Effective
Actions
- ACT-045Decide hold or sell on Tarn Capital (BB+)Chief Financial Officer · due 15 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
MR-04.1 · Market risk
Currency mismatch losses
Assets and liabilities in USD, EUR and AED are not matched.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Market risk · Currency
- Key risk indicator
- Net open FX position
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-043Currency matching policyFinance team · last tested 5 Aug 2026Effective
- C-044Monthly FX exposure reportFinance team · last tested 12 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-04.2 · Market risk
AED peg risk
A change to the dirham's dollar peg hits Dubai and fronted balances.
- Inherent31 × 3 · Low
- Residual31 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Dubai, Syn 9146
- Class
- Market risk · Currency
- Key risk indicator
- Net AED exposure
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-045AED exposure limitFinance team · last tested 19 Jul 2026Effective
- C-046USD settlement of fronted balancesFinance team · last tested 26 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-05.1 · Market risk
Liquidity squeeze after a major loss
Claims must be paid before reinsurance recoveries arrive.
- Inherent102 × 5 · Medium
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Market risk · Liquidity
- Key risk indicator
- Liquid assets vs 1-in-200 cash need
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-047Liquidity stress testingFinance team · last tested 6 Sep 2026Effective
- C-048Letter of credit facilityFinance team · last tested 13 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
MR-05.2 · Market risk
Trapped cash in Dubai
Cash builds up in the DIFC entity beyond what is needed locally.
- Inherent42 × 2 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Dubai
- Class
- Market risk · Liquidity
- Key risk indicator
- Cash held above buffer
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-049Remittance scheduleFinance team · last tested 20 Aug 2026Effective
- C-050DFSA capital bufferFinance team · last tested 27 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
A reinsurer fails to pay recoveries.
- Inherent82 × 4 · Medium
- Residual41 × 4 · Low
- ControlsEffective
Register entry
- Owner
- Head of Reinsurance
- Where it sits
- Syn 9146, Syn 9147
- Class
- Counterparty risk · Reinsurance
- Key risk indicator
- Recoverables from reinsurers below A rating
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-051Minimum security ratingUnderwriting team · last tested 7 Jul 2026Effective
- C-052Counterparty limitsUnderwriting team · last tested 14 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Outwards cover fails to respond as intended to a major loss.
- Inherent102 × 5 · Medium
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Head of Reinsurance
- Where it sits
- Syn 9146, Syn 9147
- Class
- Counterparty risk · Reinsurance
- Key risk indicator
- Unsigned contracts at inception
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-053Contract certainty checksUnderwriting team · last tested 21 Sep 2026Effective
- C-054Programme modellingUnderwriting team · last tested 1 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Outwards protection becomes more expensive or unavailable at renewal.
- Inherent93 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Head of Reinsurance
- Where it sits
- Syn 9146, Syn 9147
- Class
- Counterparty risk · Reinsurance
- Key risk indicator
- Reinsurance spend as % of GWP
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-055Early renewal planningUnderwriting team · last tested 8 Aug 2026Effective
- C-056Panel diversificationUnderwriting team · last tested 15 Sep 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
The group reinsurer cannot renew the stop-loss.
- Inherent82 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Syn 9146
- Class
- Counterparty risk · Reinsurance
- Key risk indicator
- Group reinsurer capital ratio
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-057Group capital agreementExecutive team · last tested 22 Jul 2026Effective
- C-058External stop-loss market testedExecutive team · last tested 2 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
A handful of brokers controls a large share of premium.
- Inherent93 × 3 · Medium
- Residual63 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Counterparty risk · Distribution
- Key risk indicator
- Share of GWP from top three brokers
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-059Broker distribution monitoringUnderwriting team · last tested 9 Sep 2026Effective
- C-060Broker due diligenceUnderwriting team · last tested 16 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Premium held by intermediaries is lost if they fail.
- Inherent63 × 2 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Counterparty risk · Distribution
- Key risk indicator
- Balances held by coverholders
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-061Trust account requirementsFinance team · last tested 23 Aug 2026Effective
- C-062Coverholder credit limitsFinance team · last tested 3 Sep 2026EffectiveOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Premium is not collected on time from brokers and coverholders.
- Inherent93 × 3 · Medium
- Residual63 × 2 · Low
- ControlsPartially effective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Counterparty risk · Distribution
- Key risk indicator
- Premium debt over 90 days
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-063Aged debt monitoringFinance team · last tested 10 Jul 2026Effective
- C-064Coverholder settlement termsFinance team · last tested 17 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Failure of the UAE or US fronting insurer leaves premium or claims funds exposed.
- Inherent82 × 4 · Medium
- Residual82 × 4 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147, Dubai
- Class
- Counterparty risk · Fronting partners
- Key risk indicator
- Fronting partner rating and balances
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-065Fronting partner financial monitoringFinance team · last tested 24 Sep 2026Effective
- C-066Funds withheld and collateralFinance team · last tested 4 Jul 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
A rating downgrade makes a fronting insurer's paper unacceptable to clients.
- Inherent62 × 3 · Low
- Residual62 × 3 · Low
- ControlsPartially effective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147, Dubai
- Class
- Counterparty risk · Fronting partners
- Key risk indicator
- Fronting partner ratings
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-067Rating triggers in fronting agreementsFinance team · last tested 11 Aug 2026Effective
- C-068Alternative fronting partner identifiedFinance team · last tested 18 Sep 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
A bank or custodian holding our cash or assets fails.
- Inherent41 × 4 · Low
- Residual31 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Managing agent, Syn 9146, Syn 9147
- Class
- Counterparty risk · Banks and custodians
- Key risk indicator
- Cash with a single bank vs limit
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-069Approved bank listFinance team · last tested 25 Jul 2026Effective
- C-070Deposit limits per bankFinance team · last tested 5 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-01.1 · Strategic risk
2027 growth plan shortfall
The 10% growth plan stalls or is delivered at poor margin.
- Inherent123 × 4 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Execution
- Key risk indicator
- Strategic milestones on track
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-071Strategy programme boardExecutive team · last tested 12 Sep 2026Effective
- C-072Quarterly KPI reviewExecutive team · last tested 19 Jul 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-01.2 · Strategic risk
Business plan deviation
Premium mix or rate departs materially from the Lloyd's-approved business plan.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Underwriting Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Strategic risk · Execution
- Key risk indicator
- GWP variance vs plan by class
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-073Monthly plan vs actual monitoringUnderwriting team · last tested 26 Aug 2026Effective
- C-074Lloyd's plan variance reportingUnderwriting team · last tested 6 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-01.3 · Strategic risk
Dubai platform underperformance
The Middle East growth plan is missed or achieved at poor margin.
- Inherent93 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Dubai Chief Executive
- Where it sits
- Dubai
- Class
- Strategic risk · Execution
- Key risk indicator
- Dubai GWP and loss ratio vs plan
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-075Dubai business plan reviewExecutive team · last tested 13 Jul 2026Effective
- C-076Local underwriting committeeExecutive team · last tested 20 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-01.4 · Strategic risk
Plan profit shortfall
Results fall short of the £75m plan profit.
- Inherent123 × 4 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Strategic risk · Execution
- Key risk indicator
- Forecast profit vs plan
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-077Quarterly reforecastFinance team · last tested 27 Sep 2026Effective
- C-078Board performance reviewFinance team · last tested 7 Jul 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-01.5 · Strategic risk
Expense overrun
Operating costs exceed budget as the business grows.
- Inherent63 × 2 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Execution
- Key risk indicator
- Expense ratio vs plan
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-079Budget holder sign-offFinance team · last tested 14 Aug 2026Effective
- C-080Expense ratio monitoringFinance team · last tested 21 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-02.1 · Strategic risk
Policy system replacement failure
The new policy administration system is late, over budget or loses data.
- Inherent123 × 4 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Operating Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Change
- Key risk indicator
- Milestones slipped
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-081Programme governanceOperations team · last tested 1 Jul 2026Effective
- C-082Independent assuranceOperations team · last tested 8 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-02.2 · Strategic risk
Infrastructure lagging growth
Growth strains underwriting, claims and data capacity.
- Inherent123 × 4 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Change
- Key risk indicator
- Headcount vs volume growth
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-083Capacity planningExecutive team · last tested 15 Sep 2026Effective
- C-084Board challenge of the planExecutive team · last tested 22 Jul 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-03.1 · Strategic risk
Insufficient capital for the plan
Funds at Lloyd's fall short of the requirement after losses or growth.
- Inherent102 × 5 · Medium
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Strategic risk · Capital and funding
- Key risk indicator
- Solvency coverage ratio
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-085Solvency monitoringFinance team · last tested 2 Aug 2026Effective
- C-086Capital contingency planFinance team · last tested 9 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-03.2 · Strategic risk
Loss of third-party capital on 9147
Capital providers withdraw after poor results or better returns elsewhere.
- Inherent123 × 4 · Medium
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9147
- Class
- Strategic risk · Capital and funding
- Key risk indicator
- Capital commitments for next year
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-087Capital provider reportingFinance team · last tested 16 Jul 2026Effective
- C-088Annual investor meetingsFinance team · last tested 23 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-03.3 · Strategic risk
Internal model misstatement
The capital model misses new classes, fronting or the Dubai book.
- Inherent123 × 4 · Medium
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Head of Capital
- Where it sits
- Syn 9146, Syn 9147
- Class
- Strategic risk · Capital and funding
- Key risk indicator
- Open validation findings
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-089Independent model validationActuarial team · last tested 3 Sep 2026Effective
- C-090Model change governanceActuarial team · last tested 10 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-04.1 · Strategic risk
Non-arm's-length intra-group reinsurance
The stop-loss or inter-syndicate quota share favours one party.
- Inherent82 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147, Managing agent
- Class
- Strategic risk · Group and intra-group
- Key risk indicator
- Intra-group terms reviewed
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-091Independent pricing reviewFinance team · last tested 17 Aug 2026Effective
- C-092Board approval of intra-group contractsFinance team · last tested 24 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-04.2 · Strategic risk
Conflicts between 9146 and 9147
Risk allocation or internal reinsurance favours one syndicate's capital providers.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of Compliance
- Where it sits
- Syn 9146, Syn 9147, Managing agent
- Class
- Strategic risk · Group and intra-group
- Key risk indicator
- Conflicts logged and resolved
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-093Conflicts of interest policyCompliance team · last tested 4 Jul 2026EffectiveOverdue
- C-094Allocation committeeCompliance team · last tested 11 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-05.1 · Strategic risk
Margin pressure from new capital and MGAs
New entrants push down rates and take lead positions.
- Inherent93 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Competitive environment
- Key risk indicator
- Lead share on key accounts
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-095Competitor monitoringExecutive team · last tested 18 Sep 2026Effective
- C-096Distribution strategyExecutive team · last tested 25 Jul 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-06.1 · Strategic risk
Ineffective board oversight
The board and committees fail to challenge management effectively.
- Inherent82 × 4 · Medium
- Residual41 × 4 · Low
- ControlsEffective
Register entry
- Owner
- Company Secretary
- Where it sits
- Managing agent
- Class
- Strategic risk · Governance and reputation
- Key risk indicator
- Board actions overdue
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-097Board effectiveness reviewExecutive team · last tested 5 Aug 2026Effective
- C-098Committee terms of referenceExecutive team · last tested 12 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-06.2 · Strategic risk
Conduct culture misalignment
Behaviours fall short of Lloyd's and FCA culture expectations.
- Inherent82 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Governance and reputation
- Key risk indicator
- Speak-up cases
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-099Culture surveyExecutive team · last tested 19 Jul 2026Effective
- C-100Culture dashboardExecutive team · last tested 26 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-06.3 · Strategic risk
Reputational damage from poor communication
Mishandled messages damage trust with brokers, regulators or capital providers.
- Inherent62 × 3 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · Governance and reputation
- Key risk indicator
- Negative media mentions
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-101Crisis communications planExecutive team · last tested 6 Sep 2026Effective
- C-102Spokesperson protocolExecutive team · last tested 13 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
SR-07.1 · Strategic risk
Unmet ESG commitments
Public ESG commitments are missed.
- Inherent62 × 3 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Executive Officer
- Where it sits
- Managing agent
- Class
- Strategic risk · ESG and climate
- Key risk indicator
- Progress against ESG targets
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-103ESG committeeExecutive team · last tested 20 Aug 2026Effective
- C-104Underwriting exclusions policyExecutive team · last tested 27 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Critical systems are unavailable beyond impact tolerances.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Information Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Business continuity and IT resilience
- Key risk indicator
- Impact tolerance breaches
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-105Disaster recovery testingIT & security team · last tested 7 Jul 2026Effective
- C-106Important business services mappingIT & security team · last tested 14 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
London or Dubai offices become unusable for an extended period.
- Inherent62 × 3 · Low
- Residual31 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Operating Officer
- Where it sits
- Managing agent, Dubai
- Class
- Operational risk · Business continuity and IT resilience
- Key risk indicator
- BCP tests completed on schedule
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-107Business continuity planOperations team · last tested 21 Sep 2026Effective
- C-108Remote working capabilityOperations team · last tested 1 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Attackers encrypt systems and demand payment.
- Inherent204 × 5 · High
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Chief Information Security Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Cyber
- Key risk indicator
- Critical vulnerabilities unpatched over 30 days
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-109Endpoint detection and responseIT & security team · last tested 8 Aug 2026Effective
- C-110Immutable backupsIT & security team · last tested 15 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
A supplier leaks our or our clients' data.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Information Security Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Cyber
- Key risk indicator
- Suppliers with overdue assessments
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-111Supplier security assessmentsIT & security team · last tested 22 Jul 2026Effective
- C-112Data sharing agreementsIT & security team · last tested 2 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Staff misuse elevated system access.
- Inherent82 × 4 · Medium
- Residual31 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Information Security Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Cyber
- Key risk indicator
- Leavers with active access
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-113Privileged access managementIT & security team · last tested 9 Sep 2026Effective
- C-114Quarterly access recertificationIT & security team · last tested 16 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Key underwriters leave and take relationships with them.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of HR
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · People
- Key risk indicator
- Regretted leavers
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-115Retention plansOperations team · last tested 23 Aug 2026Effective
- C-116Succession planningOperations team · last tested 3 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Teams cannot keep pace with planned growth.
- Inherent93 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Head of HR
- Where it sits
- Managing agent
- Class
- Operational risk · People
- Key risk indicator
- Vacancy rate in key teams
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-117Workforce planningOperations team · last tested 10 Jul 2026Effective
- C-118Contractor frameworkOperations team · last tested 17 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Rules or Lloyd's minimum standards are breached.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of Compliance
- Where it sits
- Managing agent, Syn 9146, Syn 9147
- Class
- Operational risk · Regulatory and compliance
- Key risk indicator
- Open regulatory findings
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-119Compliance monitoring planCompliance team · last tested 24 Sep 2026Effective
- C-120Regulatory change trackerCompliance team · last tested 4 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
The Dubai entity falls short of DFSA rules.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Dubai Compliance Officer
- Where it sits
- Dubai
- Class
- Operational risk · Regulatory and compliance
- Key risk indicator
- DFSA returns submitted late
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-121DFSA compliance calendarCompliance team · last tested 11 Aug 2026Effective
- C-122Local compliance monitoringCompliance team · last tested 18 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Business is written in territories where we are not licensed.
- Inherent82 × 4 · Medium
- Residual41 × 4 · Low
- ControlsEffective
Register entry
- Owner
- Head of Compliance
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · Regulatory and compliance
- Key risk indicator
- Licensing exceptions
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-123Licensing checks before bindingCompliance team · last tested 25 Jul 2026Effective
- C-124Territory controls in the policy systemCompliance team · last tested 5 Aug 2026EffectiveOverdue
Actions
- ACT-038Remediate Ridgeway Underwriting breaches (INC-031)Head of Delegated Authority · due 31 Oct 2026Open
- ACT-033Move Ridgeway Underwriting onto the current wordingHead of Delegated Authority · due 30 Sep 2026Overdue
Source: risk register, controls by team, action log at 30 Sep 2026
Premium taxes across territories, including UAE VAT, are miscalculated or unpaid.
- Inherent93 × 3 · Medium
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Head of Tax
- Where it sits
- Syn 9146, Syn 9147, Dubai
- Class
- Operational risk · Regulatory and compliance
- Key risk indicator
- Tax payments late or adjusted
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-125Tax engine on bordereauxFinance team · last tested 12 Sep 2026Effective
- C-126Annual tax health checkFinance team · last tested 19 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Regulatory returns are late or inaccurate.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · Regulatory and compliance
- Key risk indicator
- Returns resubmitted
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-127Return submission checklistFinance team · last tested 26 Aug 2026Effective
- C-128Four-eyes review of returnsFinance team · last tested 6 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Financial statements contain a material error.
- Inherent82 × 4 · Medium
- Residual41 × 4 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Managing agent, Syn 9146, Syn 9147
- Class
- Operational risk · Process
- Key risk indicator
- Audit adjustments
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-129Month-end close reviewFinance team · last tested 13 Jul 2026Effective
- C-130External auditFinance team · last tested 20 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Funds are paid to the wrong party through fraud or mistake.
- Inherent82 × 4 · Medium
- Residual31 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Financial Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Process
- Key risk indicator
- Payment exceptions
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-131Dual payment authorisationFinance team · last tested 27 Sep 2026Effective
- C-132Bank detail change verificationFinance team · last tested 7 Jul 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Money lost through weak adjusting, fraud or missed recoveries.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of Claims
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · Process
- Key risk indicator
- Leakage found in file reviews
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-133Large loss committeeClaims team · last tested 14 Aug 2026Effective
- C-134Fraud screeningClaims team · last tested 21 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Management information misleads decision-makers.
- Inherent93 × 3 · Medium
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Chief Risk Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Process
- Key risk indicator
- MI errors identified
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-135MI data lineageExecutive team · last tested 1 Jul 2026Effective
- C-136Risk report reviewExecutive team · last tested 8 Aug 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Coverholders bind risks outside their agreed limits, classes or territories.
- Inherent164 × 4 · High
- Residual164 × 4 · High
- ControlsIneffective
Register entry
- Owner
- Head of Delegated Authority
- Where it sits
- Syn 9146, Dubai
- Class
- Operational risk · Outsourcing and third parties
- Key risk indicator
- Out-of-authority binding
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-137Coverholder auditsDelegated authority team · last tested 15 Sep 2026✕ Ineffective
- C-138Bordereaux validationDelegated authority team · last tested 22 Jul 2026PartialOverdue
Actions
- ACT-038Remediate Ridgeway Underwriting breaches (INC-031)Head of Delegated Authority · due 31 Oct 2026Open
- ACT-033Move Ridgeway Underwriting onto the current wordingHead of Delegated Authority · due 30 Sep 2026Overdue
- ACT-035Clear the coverholder audit backlog (6 overdue)Head of Delegated Authority · due 30 Sep 2026Overdue
Source: risk register, controls by team, action log at 30 Sep 2026
The UAE fronting insurer delays or mishandles claims that we ultimately pay.
- Inherent164 × 4 · High
- Residual164 × 4 · High
- ControlsIneffective
Register entry
- Owner
- Head of Claims
- Where it sits
- Syn 9146, Dubai
- Class
- Operational risk · Outsourcing and third parties
- Key risk indicator
- Fronted claims settled outside agreed timescales
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-139Claims authority agreementClaims team · last tested 2 Aug 2026✕ Ineffective
- C-140Quarterly claims file auditsClaims team · last tested 9 Sep 2026PartialOverdue
Actions
- ACT-029Agree claims service levels with the UAE fronting partner (INC-028)Head of Claims · due 31 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
Monitoring of the coverholder network is too infrequent or shallow.
- Inherent93 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Head of Delegated Authority
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · Outsourcing and third parties
- Key risk indicator
- Coverholder audits overdue
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-141DA oversight committeeDelegated authority team · last tested 16 Jul 2026Effective
- C-142Coverholder scorecardsDelegated authority team · last tested 23 Aug 2026PartialOverdue
Actions
- ACT-050Refresh the delegated authority policy for the 2027 planHead of Delegated Authority · due 31 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
A fronting agreement fails on service, regulatory standing or data.
- Inherent123 × 4 · Medium
- Residual82 × 4 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Operating Officer
- Where it sits
- Syn 9146, Syn 9147, Dubai
- Class
- Operational risk · Outsourcing and third parties
- Key risk indicator
- Fronting SLA breaches
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-143Fronting agreement SLAsOperations team · last tested 3 Sep 2026Effective
- C-144Quarterly partner reviewsOperations team · last tested 10 Jul 2026PartialOverdue
Actions
- ACT-029Agree claims service levels with the UAE fronting partner (INC-028)Head of Claims · due 31 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
A key outsourced IT or claims provider fails.
- Inherent123 × 4 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Chief Operating Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Outsourcing and third parties
- Key risk indicator
- Material outsourcer SLA breaches
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-145Outsourcing registerOperations team · last tested 17 Aug 2026Effective
- C-146Exit plans for material outsourcersOperations team · last tested 24 Sep 2026Effective
Actions
- ACT-029Agree claims service levels with the UAE fronting partner (INC-028)Head of Claims · due 31 Oct 2026Open
- ACT-031Exit plan for the UAE fronting partnerChief Operating Officer · due 30 Sep 2026Overdue
Source: risk register, controls by team, action log at 30 Sep 2026
A risk or claim involves a sanctioned party, a heightened exposure in Middle East business.
- Inherent153 × 5 · High
- Residual82 × 4 · Medium
- ControlsEffective
Register entry
- Owner
- Money Laundering Reporting Officer
- Where it sits
- Syn 9146, Dubai
- Class
- Operational risk · Financial crime
- Key risk indicator
- Screening alerts open over five days
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-147Sanctions screeningCompliance team · last tested 4 Jul 2026Effective
- C-148Sanctions clauses on all policiesCompliance team · last tested 11 Aug 2026Effective
Actions
- ACT-026Re-review sanctions alerts cleared without evidence (INC-026)Money Laundering Reporting Officer · due 10 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
Staff or intermediaries offer or accept bribes.
- Inherent82 × 4 · Medium
- Residual41 × 4 · Low
- ControlsEffective
Register entry
- Owner
- Money Laundering Reporting Officer
- Where it sits
- Dubai, Managing agent
- Class
- Operational risk · Financial crime
- Key risk indicator
- Due diligence overdue
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-149Gifts and hospitality registerCompliance team · last tested 18 Sep 2026Effective
- C-150Third-party due diligenceCompliance team · last tested 25 Jul 2026Effective
Actions
- ACT-050Refresh the delegated authority policy for the 2027 planHead of Delegated Authority · due 31 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
Incomplete or inaccurate policy data undermines pricing and exposure management.
- Inherent124 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Data Officer
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · Data and models
- Key risk indicator
- Policies missing critical fields
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-151Data quality rulesIT & security team · last tested 5 Aug 2026Effective
- C-152Data ownership frameworkIT & security team · last tested 12 Sep 2026PartialOverdue
Actions
- ACT-036Chase late binder bordereaux (INC-033)Head of Delegated Authority · due 15 Oct 2026Open
Source: risk register, controls by team, action log at 30 Sep 2026
AI tools are used without validation, explainability or data controls.
- Inherent93 × 3 · Medium
- Residual93 × 3 · Medium
- ControlsPartially effective
Register entry
- Owner
- Chief Data Officer
- Where it sits
- Managing agent
- Class
- Operational risk · Data and models
- Key risk indicator
- Unregistered AI tools found
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-153AI use policy and registerIT & security team · last tested 19 Jul 2026Effective
- C-154Validation of AI toolsIT & security team · last tested 26 Aug 2026PartialOverdue
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
Policyholders receive unfair treatment or poor claims service.
- Inherent93 × 3 · Medium
- Residual62 × 3 · Low
- ControlsEffective
Register entry
- Owner
- Head of Compliance
- Where it sits
- Syn 9146, Syn 9147
- Class
- Operational risk · Conduct
- Key risk indicator
- Complaints upheld
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-155Consumer Duty MICompliance team · last tested 6 Sep 2026EffectiveOverdue
- C-156Complaints root cause analysisCompliance team · last tested 13 Jul 2026Effective
Actions
- ACT-035Clear the coverholder audit backlog (6 overdue)Head of Delegated Authority · due 30 Sep 2026Overdue
Source: risk register, controls by team, action log at 30 Sep 2026
Products fail Consumer Duty fair value assessments.
- Inherent62 × 3 · Low
- Residual42 × 2 · Low
- ControlsEffective
Register entry
- Owner
- Head of Compliance
- Where it sits
- Syn 9146, Managing agent
- Class
- Operational risk · Conduct
- Key risk indicator
- Products with open value actions
- Scoring
- Likelihood × impact, each 1 to 5. Residual is after controls.
Controls that hold it
- C-157Annual fair value assessmentsCompliance team · last tested 20 Aug 2026Effective
- C-158Product approval processCompliance team · last tested 27 Sep 2026Effective
Actions
No open actions in the action log.
Source: risk register, controls by team, action log at 30 Sep 2026
- Time horizonNow
- Potential impactSevere · 5 of 5
- VelocityFast · rising
In the registerLiability & legal
- Books exposed
- US E&S casualty, D&O and financial lines
- Signals we watch
- Verdict sizes, litigation funding volumes, claims severity trend
- Our response
- Repricing US trucking at renewal (ACT-041); limits reduced on US E&S
- Owner
- Chief Underwriting Officer
Promoted to the register
IR-01.3 · Social inflation in US casualty
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon1 to 3 yrs
- Potential impactSevere · 5 of 5
- VelocityFast · rising
In the registerTechnology & cyber
- Books exposed
- Cyber large corporate, Cyber SME, Property D&F (silent cyber)
- Signals we watch
- Cloud concentration, outage frequency, war exclusion take-up
- Our response
- Event limits tightened; cyber war wording refreshed
- Owner
- Head of Exposure Management
Promoted to the register
IR-03.2 · Systemic cyber accumulation
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizonNow
- Potential impactSignificant · 3 of 5
- VelocityMedium · rising
In the registerClimate & environment
- Books exposed
- Property D&F, Property binders
- Signals we watch
- Secondary peril losses against model, frequency trend
- Our response
- Climate-adjusted catastrophe view in pricing
- Owner
- Head of Exposure Management
Promoted to the register
IR-03.3 · Climate-driven loss frequency and severity
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon3 to 5 yrs
- Potential impactHigh · 4 of 5
- VelocitySlow · rising
In the registerClimate & environment
- Books exposed
- Professional indemnity, D&O and financial lines
- Signals we watch
- Climate cases filed, outcomes against corporates
- Our response
- Climate exclusions reviewed; emerging risk monitoring
- Owner
- Chief Underwriting Officer
Promoted to the register
IR-02.3 · Climate litigation
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizonNow
- Potential impactHigh · 4 of 5
- VelocityFast · rising
Watch listGeopolitical & macro
- Books exposed
- Marine cargo, Offshore energy, Political violence & terror, MENA property
- Signals we watch
- Strait transit volumes, war risk rates, regional incident counts
- Our response
- Aggregates monitored weekly; MENA growth paused for PV
- Owner
- Chief Underwriting Officer
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon1 to 3 yrs
- Potential impactSignificant · 3 of 5
- VelocityFast · rising
Watch listUnderwriting & claims
- Books exposed
- Property binders, Cyber SME, Professional indemnity
- Signals we watch
- Doctored document detections, fraud referral rate
- Our response
- Fraud screening upgraded for image and document checks
- Owner
- Head of Claims
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon1 to 3 yrs
- Potential impactHigh · 4 of 5
- VelocityMedium · rising
Watch listLiability & legal
- Books exposed
- Professional indemnity, D&O and financial lines, Cyber large corporate
- Signals we watch
- AI-related notifications, market AI exclusions, wording gaps
- Our response
- Wordings review of AI cover across PI and D&O
- Owner
- Head of Product
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon1 to 3 yrs
- Potential impactSignificant · 3 of 5
- VelocityMedium · stable
Watch listGeopolitical & macro
- Books exposed
- D&O and financial lines, Professional indemnity
- Signals we watch
- Default rates, covenant breaches, insolvency filings
- Our response
- Underwriting guidance on highly indebted insureds
- Owner
- Chief Underwriting Officer
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon1 to 3 yrs
- Potential impactModerate · 2 of 5
- VelocityMedium · rising
Watch listRegulatory
- Books exposed
- All lines (operational)
- Signals we watch
- EU AI Act milestones, DFSA consultations, Lloyd's guidance
- Our response
- AI use register maintained; regulatory change tracker
- Owner
- Head of Compliance
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon3 to 5 yrs
- Potential impactHigh · 4 of 5
- VelocitySlow · rising
On the horizonLiability & legal
- Books exposed
- US E&S casualty, D&O and financial lines
- Signals we watch
- US regulatory limits, mass tort filings
- Our response
- Exposure review of US casualty book
- Owner
- Chief Underwriting Officer
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon5+ yrs
- Potential impactSevere · 5 of 5
- VelocitySlow · stable
On the horizonClimate & environment
- Books exposed
- Property D&F, Cyber large corporate, Offshore energy
- Signals we watch
- Solar cycle forecasts, grid resilience studies
- Our response
- Scenario included in reverse stress test
- Owner
- Head of Exposure Management
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee
- Time horizon5+ yrs
- Potential impactHigh · 4 of 5
- VelocitySlow · rising
On the horizonTechnology & cyber
- Books exposed
- Cyber large corporate, Cyber SME
- Signals we watch
- Quantum milestones, post-quantum standard adoption
- Our response
- Monitor; post-quantum readiness in IT roadmap
- Owner
- Chief Information Security Officer
Source: emerging risks at 30 Sep 2026, reviewed quarterly by the Risk and capital committee