Risk taxonomy and RACI
The risk taxonomy is one list of names shared by every company of the group: risk categories, Basel event types and hazard types. Because every register uses it, the group’s reports consolidate without anyone mapping one company’s words to another’s.
Who may do it: the Group RM maintains the taxonomy at the group root. Every entity uses it. See Roles and permissions.
The 8 standard risk categories
Section titled “The 8 standard risk categories”| Category | Covers |
|---|---|
| Strategic | Risks to the company’s strategy, business model and objectives |
| Credit | Loss from a counterparty failing to meet its obligations |
| Market | Loss from movements in prices, rates and exchange rates |
| Liquidity | Being unable to meet payments when they fall due |
| Operational | Loss from failed processes, people, systems or external events |
| Compliance & Legal | Breach of law, regulation, licence conditions or contracts |
| Technology & Cyber | Failure, compromise or loss of systems and data |
| Reputational | Loss of trust among clients, regulators, investors or the public |
Every risk in the risk register and every appetite statement uses one of these categories.
Basel mapping
Section titled “Basel mapping”Loss events are classified by the seven Basel Level-1 event types, EL01–EL07 — see Recording a loss event and Standards mapping.
Hazard types
Section titled “Hazard types”The hazard types are the same list BCP Core watches and the BIA links activities to, so a hazard has one name across both modules.
RACI per process
Section titled “RACI per process”For each risk process — RCSA, loss reporting, KRI monitoring, BIA, management review — the group records who is Responsible, Accountable, Consulted and Informed. RACI is reference data: it documents the arrangement and does not grant rights. Rights come from roles — see Roles and permissions.
What the system does or refuses
Section titled “What the system does or refuses”- The taxonomy is set at the group root and applies to every entity beneath it. An entity cannot add its own categories.
- Every change is versioned and stamped — see Who-filed is stamped.