Insights
Practical notes on enterprise risk management, operational resilience and third-party risk, written by people who have run risk functions.
- CASS: failure to protect client money and safe custody assets14 enforcement actions and £193.1 million in fines since 2013. The CASS enforcement record, the failure patterns behind it, the controls that prevent it, and how to calibrate the scenario for ICARA and ICAAP.
- FCA enforcement fines 2013–2025: a comprehensive analysis307 enforcement actions and £3.56 billion in fines over 13 years. What the complete FCA Final Notice dataset says about trends, sectors, the rules most often invoked and where enforcement is heading.
- GenAI in risk management: hype vs realityGenAI is a force multiplier for competent risk professionals, not a replacement for judgment. After months of experimentation, here is what works, what does not, and how to decide where to use it.
- Culture is not just a buzzword, it is a lifesaverLessons from the OceanGate Titan tragedy. The disaster was preventable, and the root cause was not just engineering. It was leadership, governance and values.
- The anatomy of a weak RCSAA strong Risk and Control Self-Assessment tells you whether a firm understands its operational risks or is just documenting them. Here is what weak RCSAs have in common, and what strong ones share.
Twenty minutes will tell us both whether there is anything worth exploring.
We look at what you capture today, what your regulator will ask for, and whether there is a gap. If there is nothing there, no need to take it further.
A gap check, not a pitch. No project, no budget conversation, no access to sensitive data.