Teardown · Risk management
How a regulated fintech runs a risk committee that makes decisions
A teardown of the quarterly risk committee papers of a licensed payments company in Nigeria. It shows how the agenda, risk appetite dashboard, top risks, incidents and regulatory tracker fit together, what the committee does well and what we would change, so you can run a committee that decides rather than reviews.
The company
- Sector
- Fintech, licensed payments
- Stage
- Growth, profitable
- Size
- About 250 people
- Markets
- Nigeria
Shared with permission and anonymized. Figures and names that could identify the company have been changed.
The document, section by section
Quarterly risk committee papers · 24 pages
- 1
An agenda built around decisions
The agenda lists each item with the time allowed and whether it is for decision, discussion or information.
Our note
Information items are taken as read. Two thirds of the meeting is spent on decisions.
- 2
Risk appetite dashboard
One page shows each risk appetite measure, such as fraud losses as a share of volume, against its limit, with green, amber and red.
Our note
The clearest page in the pack. Anything red automatically becomes a decision item.
- 3
Top risks with owners and trend
The top twelve risks, each with an executive owner, the trend since last quarter and actions due.
Our note
Good, but actions have no dates. We would add a due date and a status to every action.
- 4
Incidents and near misses
Every incident and near miss in the quarter, with root cause and the control that failed or held.
Our note
Recording near misses is rare and valuable. It shows the committee where controls are close to failing.
- 5
Regulatory tracker
All open regulatory requirements, returns and examinations, with deadlines and owners.
Our note
Useful, but it should be reviewed monthly by management, not quarterly by the committee.
- 6
Decisions and escalations log
The last page records each decision the committee took, who acts on it and what goes to the board.
Our note
This page is what turns a meeting into governance. Start yours here if you have nothing else.
What works
- Every agenda item is marked for decision, discussion or information
- Risk appetite breaches automatically become decision items
- Near misses are recorded alongside incidents
What we would change
- Add due dates and status to every action against a top risk
- Move the regulatory tracker to a monthly management review
- Invite the owner of each red measure to present it in person
Build your own
- 1
Mark every agenda item as decision, discussion or information, and take information as read
- 2
Set a few risk appetite measures with hard limits, and make any breach a decision item
- 3
Keep a decisions log on the last page of every pack, and review it first at the next meeting
Free companion
Risk register starter
Thirty risks a growing regulated company should consider, grouped by category, each with a suggested owner.
We will also send one practical resource a month. Unsubscribe at any time. Privacy Policy
On its way
Check your inbox for the risk register starter
It should arrive within a few minutes. If it does not, check your spam folder or write to us.
From the practitioner
A risk committee earns its place when it changes something: a limit, a product launch date, a budget. If the minutes only say the committee noted the report, it is not doing its job. The company in this teardown measures its committee by the number of decisions it takes.
Questions
What does a risk committee do?
It oversees how the company identifies and manages its main risks, sets or recommends risk appetite limits, reviews incidents and decides what happens when limits are breached. In regulated companies it is often required by the regulator.
How often should a risk committee meet?
Quarterly is common for board risk committees, with a monthly management risk meeting underneath it to deal with day-to-day issues.
What should risk committee papers include?
An agenda marked by purpose, a risk appetite dashboard, the top risks with owners and actions, incidents and near misses, the regulatory position and a log of decisions.
More from the Library
Inside a board pack
How a growing company structures its monthly reporting to the board, section by section.
AI acceptable-use policy
A starting policy for a two-hundred-person company covering data, tools, review and accountability.
Metric dictionary
One definition per measure, with its owner, source and calculation, so every team counts the same way.
Put this to work inside your organization
A practitioner can adapt it to how you operate and embed it with your team, starting with a diagnostic.
