Skip to main content
NFRisk Non-Financial Risk advisory Start a Conversation

Risk Architecture

The organising method for controlled transformation.

NFRisk connects intent, data and controls, technology, delivery and resilience before dependencies harden into programme failure.

Use the Structural DiagnosticExplore capabilities
NFRisk premise

Major institutional failures frequently involve interacting risks, dependencies and control weaknesses—not one isolated defect.

NFRisk Risk Architecture links intent and obligations, data and controls, technology and delivery, and operations and resilience through dependencies, decision gates and assurance. NFRisk Risk Architecture links intent and obligations, data and controls, technology and delivery, and operations and resilience through dependencies, decision gates and assurance.

Flagship model

Make the connected system visible.

Risk taxonomies classify exposures. NFRisk Risk Architecture is a practical way to examine how a transformation changes the behaviour of the institution: where ownership sits, what evidence is required and how a weakness can move across boundaries.

Four connected domains—intent and obligations, data and controls, technology and delivery, and operations and resilience—surround an NFRisk Risk Architecture centre focused on dependencies, decision gates and assurance. Four connected domains—intent and obligations, data and controls, technology and delivery, and operations and resilience—surround an NFRisk Risk Architecture centre focused on dependencies, decision gates and assurance.
A proprietary NFRisk model. It is applied proportionately to the mandate rather than as a fixed enterprise taxonomy.
01

Intent & obligations

Mandate, regulatory intent, customer outcome, scope and accountable sponsorship.

02

Data & controls

Evidence, lineage, completeness, correctness, ownership and exceptions.

03

Technology & delivery

Architecture, providers, requirements, mobilisation, testing and change.

04

Operations & resilience

Critical services, dependencies, recovery, acceptance and continuity.

Advisory lifecycle

One decision sequence from uncertainty to evidence.

NFRisk can enter at any point. Each transition should answer an explicit question before commitment increases. The result may be to proceed, reframe, remediate or pause.

See defined services
The lifecycle moves from Diagnose to Define and Design, Select and Mobilise, and Assure and Remediate, with an explicit decision at each transition. The lifecycle moves from Diagnose to Define and Design, Select and Mobilise, and Assure and Remediate, with an explicit decision at each transition.

Role and independence

Clear ownership makes challenge useful.

The regulated organisation remains accountable for outcomes and risk acceptance. A technology or delivery provider remains accountable for its implementation and evidence. NFRisk diagnoses, translates and independently challenges without obscuring those responsibilities.

The regulated organisation owns outcomes and risk acceptance; NFRisk provides independent diagnosis, decision architecture and assurance; the technology or delivery provider owns implementation and delivery evidence. The regulated organisation owns outcomes and risk acceptance; NFRisk provides independent diagnosis, decision architecture and assurance; the technology or delivery provider owns implementation and delivery evidence.
Independence is protected through explicit scope, conflict checks and visible responsibility boundaries.

Applied across four pillars

Depth where the evidence is strongest.

The architecture does not create a new catalogue of services. It connects the four areas in which NFRisk holds sustained practical experience and brings in adjacent lenses only where the mandate requires them.

Financial Crime

Control intent, data, operating models, workflows, remediation and defensible implementation.

Explore

Data & Control Integrity

Expected populations, lineage, transformations, reconciliation, exceptions and evidence.

Explore

Payments

Requirements, architecture, integration, scheme alignment, testing and operational acceptance.

Explore

Operational Resilience

Critical services, third parties, failure scenarios, recovery and programme assurance.

Explore
External context: The model is NFRisk analysis. Its emphasis on risk-data accuracy and completeness, dependency mapping and resilience testing is consistent with the Basel Committee’s BCBS 239 principles, the Bank of England/PRA SS1/21 operational-resilience statement and the FCA’s PS21/3 policy statement.

Default entry route

Use diagnosis when the structure is not yet clear.

The Structural Risk and Transformation Diagnostic establishes the actual problem, risk exposure, ownership and smallest credible intervention.

Use the Structural Diagnostic