Risk management policies have a habit of becoming “that document we point to” rather than something the business actually uses. And in a regulated environment, that’s risky in itself—because when you’re challenged (internally or by the FCA), you need to show more than good intentions. You need to show how risk is managed day-to-day, who owns what, and what happens when things start drifting off track.
