The Group Risk Register is presented to the Board’s Audit & Risk Committee annually and for each risk identified includes: the inherent risk; detailed controls and monitoring activities to mitigate the risk; and a residual risk rating after mitigating activities.