Look back across the FCA’s output over the last twelve months — the payments and e-money risk management review, the safeguarding rule changes, the Consumer Duty refinements, the financial crime enforcement action — and a single thread runs through all of it. The regulator is far less interested in whether a firm has a policy document than in whether that policy is actually lived, tested and owned day to day. 

That distinction — between having a framework and having a culture — is where most firms trip up. A risk register that gets updated once a quarter, a wind-down plan that hasn’t been touched since authorisation, a control that’s “owned” by a team rather than a named individual: none of these looks wrong on paper. They just quietly fail to do their job when it matters. 

THREE PATTERNS WORTH WATCHING 

Risk appetite set by instinct, not evidence. The FCA’s June 2025 multi-firm payments review found that risk appetites were not always based on the activities of the business, and that some firms relied on judgement rather than stress testing. It’s an easy trap: risk appetite statements get written once, by a small group, and then rarely revisited as the business changes shape. 

Secondly, group frameworks that don’t fit the entity. Parent-level risk frameworks look tidy in a global business, but a framework built for the group does not necessarily reflect the specific risk profile of each regulated entity underneath it. In practice, firms need to be able to show that the risk framework they apply reflects their own activities, risks and footprint. 

Plans that exist but aren’t tested. Wind-down plans, business continuity plans and safeguarding arrangements all suffer from the same problem: they’re written to satisfy an authorisationrequirement, then left untouched. A plan that hasn’t been stress-tested against a realistic scenario in the last year is, in practice, closer to a hypothesis than a plan. 

WHAT A LIVE RISK CULTURE LOOKS LIKE 

The firms that come through FCA reviews well tend to share a few habits. Risk ownership sits with named individuals, not teams, so there’s no ambiguity about who’s accountable when something needs escalating. This is closely aligned with the Senior Managers and Certification Regime (SM&CR), where clear statements of responsibility help make individual accountability explicit. Controls are scored and re-scored on a regular cadence, not just when an audit is looming. And — critically — the risk register, the wind-down plan and the safeguarding arrangements are treated as one connected picture, not three separate documents maintained by three separate people who rarely talk to each other. 

None of this requires reinventing risk management. It requires making the existing framework visible, current and genuinely owned — which is precisely where most manual, spreadsheet-based approaches start to creak. 

HOW AXIOL SUPPORTS A LIVE RISK CULTURE 

The Axiol platform is built around the idea that risk management should be a continuous discipline, not a periodic exercise: 

• Continuous risk scoring and control effectiveness tracking, so weaknesses can surface between scheduled reviews rather than waiting for the next formal assessment 

• Clear risk ownership, with named accountability that managers can assign and owners can accept 

• Risk relationship mapping, linking key risks to underlying risks and the controls meant to mitigate them, so the full picture is visible in one place 

• An audit-ready trail of every evaluation and update, giving the board and regulators demonstrable evidence of an actively managed framework 

A risk culture isn’t something you can buy off the shelf, but the right platform makes it far easier to build and sustain. Get in touch to see how Axiol can help your firm move from static policy documents to a living risk framework.