- Revision List
| Revision | Section | Date | Description |
| 3 | 1 | 01 July 2026 | Inclusion of revision history. |
| 3 | 1 | 01 July 2026 | Contract compliance and information governance included as key factor. |
| 3 | All | 01 July 2026 | Changes to font and corporate branding. |
| 3 | All | 01 July 2026 | Inclusion of section titles and numbering. |
| 3 | All | 01 July 2026 | Change of wording. |
| 3 | Contact | 01 July 2026 | Changes to Board chair details. |
Introduction
2.1 CompEx Certification Ltd is committed to mitigating actions or events that adversely affect its ability to operate effectively and achieve its planned objectives. CompEx manages potential adverse impacts via its risk management activities using its Risk Appetite Statement and Corporate Risk Register.
2.2 Risks relate to every area of CompEx’s functions: strategic, operational, reputational and financial. Some risks are inconsequential and easily mitigated, but others pose a more severe threat to the viability of the business. Consequently, they must be assessed, recorded, and reported within CompEx internally, and if required to / from ATPs to ensure all parties can appropriately and effectively manage risk.
Risk Management
3.1 By managing identified risks:
- Regulatory compliance is more likely to be maintained.
- The risks are less likely to occur.
- There can be a more efficient allocation of finances and resources.
- There will be better decision-making, planning, and prioritisation ensuring CompEx and ATPs can reduce risks when they occur.
- CompEx and ATPs can achieve optimum operational efficiency and effectiveness.
- Key factors that CompEx considers when identifying risks include (but are not limited to): o financial loss/instability.
o operational inefficiency and confusion.
o loss of public confidence.
o lack of regulatory compliance.
o impact on the validity of qualifications, particularly unreliable or inconsistent results.
o increased likelihood of malpractice.
o cyber security and data privacy.
o Contract compliance and information governance.
Risk register
4.1 The CompEx risk register is reviewed monthly and is assessed against the annual Risk Appetite Statement. CompEx may add emerging risks as required and update mitigating actions as appropriate. The risk register is also independently reviewed quarterly by the Audit and Risk Committee as part of our internal management review function.
4.2 The risk register records:
- Identifies risks and their likely impact.
- Mitigating actions.
- Risk ratings, based on a standard matrix of likelihood and impact.
- Contingency (action should risk occur).
4.3 The CompEx Senior Management team monitors actions arising from the risk register and reports to the Managing Director and the Board as necessary.
View Resource