The risk register is the central repository of all operational risks in financial firms. It is a document that includes all operational risks of a firm, the likelihood of the risks and the controls applied to each risk. The risk register is a critical tool in risk management as it provides a comprehensive view of all the risks a firm is exposed to, their potential impact, and the measures taken to mitigate them. It is a dynamic document that is updated regularly to reflect changes in the risk landscape. The risk register helps in prioritizing risks based on their likelihood and impact, and in developing appropriate risk response strategies. It also serves as a communication tool to inform all stakeholders about the risks and the actions taken to manage them.

Choice A is incorrect. A Risk universe is a tool used to identify potential risks in different areas of an organization. While it does list out all possible risks, it does not necessarily include their respective likelihoods or the specific controls implemented to mitigate each risk.

Choice B is incorrect. The Top-ten risks document typically lists only the most significant risks faced by an organization, rather than a comprehensive list of all operational risks. Furthermore, this document may not always detail the likelihoods of these risks or the specific controls implemented for mitigation.

Choice D is incorrect. Shock scenarios are hypothetical extreme events used for stress testing and do not provide a comprehensive list of all operational risks, their respective likelihoods, and mitigation strategies.

Things to Remember

• Operational risk: The risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. It includes legal risk but excludes strategic and reputational risks.
• Likelihood of risks: The probability or chance that a specific risk event will occur.
• Controls: Measures or actions taken to mitigate or manage risks effectively.