Enterprise risk and capital adequacy support
Smaller regulated firms rarely have a risk problem in the sense a consultant means it. They have a proportionality problem. The framework is either an eighty-page document nobody uses, inherited from a template, or it is four spreadsheets and the founder's judgement. Neither survives a supervisory conversation, and neither helps the board decide anything.
Oakbridge Agility builds risk frameworks, capital assessments and appetite statements for firms that need them to work rather than to look impressive. That includes ICAAP and ILAAP support for small firms, and its more common cousin for investment firms, the ICARA.
Risk frameworks proportionate to your size
The fear we hear most often is that engaging anyone on risk means a six-month programme, a workshop series and a document nobody reads. That is a reasonable fear. It describes how a great deal of risk consulting is sold.
An enterprise risk framework for an SME should be short enough that the board has read all of it. In practice that means a risk taxonomy of perhaps eight to twelve categories rather than sixty, a register your risk owners can actually maintain, a scoring approach the board understands without a key, and reporting that fits on two pages. The test is not whether the framework covers every eventuality. It is whether the people who own the risks can name them, and whether the board sees the ones that matter before they crystallise.
We build to that standard, then stress it against what your supervisor will ask. Where you already have a framework, we usually find the issue is not the document but the operating rhythm around it: registers updated quarterly by one person, no linkage between the risks recorded and the decisions taken, and no evidence of challenge.
ICAAP and ILAAP support
The first question is which document you need
Banks and PRA designated investment firms produce an ICAAP, with an ILAAP where liquidity requirements apply. If you are a MIFIDPRU investment firm, the equivalent is the ICARA under MIFIDPRU 7, and the difference is not cosmetic: the ICARA is built around potential harm and wind-down, not solely around capital held against risk. Payment and e-money firms sit outside both regimes but face capital requirements, safeguarding obligations and an expectation of credible wind-down planning.
We write these documents with the firm rather than for it, because a capital assessment the executive cannot explain in a supervisory meeting is worse than none. Work typically covers the harm and risk assessment, capital and liquidity modelling, stress and reverse stress testing that reflects your actual business rather than generic scenarios, the wind-down plan and its trigger points, and the board approval trail that shows genuine challenge rather than a nodded-through paper.
Risk appetite statements the board actually uses
Most risk appetite statements fail the same way
They are written in adjectives. A firm declares itself averse to conduct risk and moderate on credit risk, and nothing follows, because nothing in the statement can be breached.
A usable statement attaches a measurable metric to each material risk, sets a limit and a warning threshold, names who owns it, and states what happens when a threshold is crossed. It says what the firm will not do at all. It gets reported against monthly, so the board sees position and trend rather than a reaffirmation of the words.
We draft appetite statements alongside the board, then design the reporting that makes them live. The drafting is the easy half. The half that decides whether it works is agreeing what the firm will actually stop doing when a limit is hit, and getting that written down before the first breach rather than after it.
Third-party and outsourcing risk
This area changed materially in 2026
The FCA published Policy Statement PS26/2 in March 2026, creating a single FCA, PRA and Bank of England regime for operational incident and third-party reporting. Firms will have to maintain a register of their material third-party arrangements and submit it to the FCA annually, with the rules applying from 18 March 2027 and finalised guidance in FG26/4.
For most smaller firms, building the FCA third-party risk register is not the hard part. Working out which arrangements are material is, particularly where dependencies sit behind a supplier rather than with it, and where intra-group arrangements rely on outside providers. We map dependencies to your important business services, apply the materiality definition, build the register in the format the regime expects, and set up the governance that keeps it current between submissions.
Alongside that we review contractual provisions, exit and substitutability, concentration risk and the SYSC 8 outsourcing obligations that continue to apply.
Fractional CRO and interim support
Senior risk capability without a full-time hire
A fractional chief risk officer gives a UK firm senior risk capability without a full-time hire it cannot yet justify. It suits firms in three situations: those that have outgrown risk being a part of the CFO's role but cannot support a six-figure permanent appointment, those covering a gap between departure and hire, and those where an investor or supervisor has made clear that risk needs a senior owner.
The arrangement is usually two to four days a month. That buys ownership of the risk framework and register, preparation and presentation of risk reporting to the board, attendance at board and risk committee meetings, oversight of the ICARA or ICAAP cycle, engagement with supervisors, and the coaching that builds risk capability in the people who will eventually take it on permanently.
Where the role involves performing the chief risk function, SMF4 approval is required, and we work through whether the arrangement needs approval and how to structure it if so. A fractional appointment should have a stated end condition, whether that is a permanent hire, a funding milestone or a capability threshold. An interim arrangement with no exit is just an expensive dependency.
Frequently asked questions
Common questions about risk and capital work
Need a risk framework, a capital assessment or senior risk capability? Start with a scoping conversation and we will tell you what your permissions actually require.