Getting ready for… your Own Risk Assessments (ORA)

• Identifiable risk management processes. A documented risk management policy that details how risks are identified, assessed, monitored, and mitigated. Clear escalation and reporting procedures for emerging risks. Evidence of regular risk discussions in trustee meeting minutes.
• Internal controls and compliance measures. A structured internal control framework that ensures operational effectiveness. Policies for data protection, cyber security, and business continuity. Monitoring and reporting mechanisms to confirm ongoing compliance.
• Trustee training and knowledge management. Evidence that trustees have completed required training on governance and risk management. A knowledge and understanding policy to ensure trustees remain up to date with regulatory developments.

To support and evidence ORA (Own Risk Assessment) submissions, we are ensuring that schemes can present clear documentation demonstrating compliance with the General Code. This includes trustee meeting minutes, an up-to-date risk register, records of trustee training on governance, cyber security, and regulatory compliance, internal and external audit reports reviewing governance effectiveness and service provider contracts outlining key responsibilities and risk management practices.

There are a number of steps that we are undertaking to prepare for our ORAs here at Pi Partnership. We have already reviewed existing governance arrangements against the General Code requirements. We are now engaged in updating and enhancing risk management frameworks, ensuring all risks are documented and assigned mitigation strategies.