A broker risk management process records what could go wrong, assigns controls to named people and checks whether those controls work. Use the register below to manage recurring risks across your brokerage, from incomplete files to interrupted commission income.
Start with the people who run the work. Bring a recent file-check result, your incident and complaints records, system access details and cash-flow forecast. Agree who can approve a risk that remains after controls.
Set Up the Brokerage Risk Register
Copy the table into a shared spreadsheet or document with restricted access. Keep client documents and incident evidence in their approved systems, and record references here instead of copying personal information.
- Describe one event per row, with its cause and the consequence for clients or the business.
- Assign a named owner who has authority to arrange the control and follow up failures.
- Rate the likelihood and impact using agreed definitions, then record the controls already operating.
- Set the next review date and record open actions, including the person responsible and due date.
This is an illustrative register. Replace the example roles with people’s names and adapt the controls to your business and licensee arrangements.
| Risk | Cause | Consequence | Owner | Likelihood | Impact | Control | Review status |
|---|---|---|---|---|---|---|---|
| Incomplete file reaches lodgement | Required check skipped during a handover | Unsupported recommendation or rework | Compliance manager | Possible | Major | Pre-lodgement review and retained sign-off | Open: test recent handovers and record next review date |
| Only authorised broker becomes unavailable | Illness or unexpected departure | Client work stalls | Brokerage owner | Possible | Major | Documented handover and authorised backup arrangement | Open: confirm backup can perform assigned work |
| Access to a frequently used lender is interrupted | Accreditation lapses or panel access changes | Applications need reassignment or alternatives | Accreditation owner | Unlikely | Moderate | Track accreditation requirements and lender notices | Open: check active access and upcoming requirements |
| Client information exposed through email | Account compromise | Privacy harm and interrupted operations | System administrator | Possible | Major | Multi-factor authentication and tested incident response | Open: check account settings and response contacts |
| Commission receipts cannot cover bills | Delayed payments, runoff or clawbacks | Payroll or supplier payments missed | Finance manager | Possible | Major | Reconcile receipts and review a short-term cash-flow forecast | Open: test a lower-income scenario |
For a simple rating method, use unlikely, possible and likely for likelihood. Define these against the same planning period, such as the coming year. Use minor, moderate and major for impact, with written examples covering client harm as well as financial loss.
For example, minor could mean internal rework with no client harm. Major could mean serious client harm or disruption that stops the brokerage meeting commitments. Management must agree the boundaries that fit its business.
Record a rating before controls and another after controls where that distinction helps prioritise work. The second rating is residual risk: the exposure that remains. Give major-impact risks management attention even when their likelihood is low.
This method is a starting point, not a prescribed universal scoring matrix. Australian Securities and Investments Commission (ASIC) Regulatory Guide 205: Credit licensing: General conduct obligations describes risk systems suited to a credit licensee’s business. If you are a credit representative, connect your register to your licensee’s procedures and escalation requirements.
Identify Risks Across the Business
Identify brokerage risks by following a client file, a staff absence and a commission payment through the business. At each handover, ask what can fail and who would notice.
File-quality risks include missing evidence, unexplained recommendations and checks completed after lodgement. A recurring failure across files belongs in the register, even when each individual mistake has been corrected.
Key-person reliance includes knowledge, authority and access held by one person. A written procedure does little if the backup lacks the required authorisation or cannot access the system. Test the handover while the usual owner is available.
For lender access, record who monitors accreditation requirements and panel changes. Keep contingency arrangements within the brokerage’s actual permissions and each client’s needs. Access to another lender does not make its product suitable for a client.
Privacy risks include compromised accounts, information sent to the wrong recipient and staff retaining access after departure. Include external providers where they handle client information or support work the brokerage depends on.
Cash-flow disruption can follow delayed settlements, falling trail, unexpected clawbacks or concentration in a few large income sources. Track payment timing alongside the amount expected.
An individual loan’s credit risk concerns the borrower’s ability to repay and the lender’s exposure. Brokerage risk management concerns repeated business failures, such as staff consistently omitting an assessment step. Use the separate guide to assessing risk in mortgage lending for the application-level assessment.
Turn a Risk Into an Assigned Control
An assigned control states who does what, when they do it and what evidence proves completion. Add the action to take when the control fails.
Missing File Check
In this hypothetical example, a file reaches lodgement without a required review. The compliance manager assigns a reviewer before submission and retains the signed checklist with the file. A sample of completed files shows whether the check actually occurred.
If a check is missing, the reviewer escalates the file under the licensee’s process and resolves the gap before further affected work proceeds. The manager checks whether other handovers have the same failure. Closing the action requires evidence of the corrected process operating on later files.
Unexpected Income Loss
Suppose monthly commission receipts fall below the amount needed for payroll. The finance manager compares actual receipts with the forecast, investigates missing payments and updates the cash position before payment commitments fall due.
Keep the reconciliation and revised forecast as evidence. Management sets the cash threshold that triggers action, such as reducing discretionary spending or arranging funding. Record who can approve that response and how quickly they must act.
Compromised Account
If a staff email account is compromised, the system administrator activates the incident response process. Restrict unauthorised access, preserve relevant logs and assess what information was exposed. Record actions and decisions in the incident file.
The Office of the Australian Information Commissioner (OAIC) describes four steps for responding to a data breach. Contain the breach, assess its effects, notify where required and review the response. Apply notification duties to the entity and incident concerned. The incident owner coordinates with the licensee and advisers where their responsibilities are involved.
Review Incidents, Insurance and Changes
Review an affected register entry whenever an incident or business change reveals a different exposure. A scheduled review is useful, but an active failure needs action when staff discover it.
- After a near miss or complaint, identify which control failed or which risk was missing.
- When staff change roles or leave, reassign ownership and test access removal and backup arrangements.
- Before introducing a new system or provider, assess its access, information handling and recovery arrangements.
- When lender access, income patterns or licensee requirements change, update the affected controls and ratings.
Keep the steps staff follow in the brokerage’s policies and procedures. The register points to those steps and records whether they work. It cannot establish compliance by itself.
Insurance can fund covered losses or claims, subject to the policy. Preventive controls reduce the chance of an event. Keep both in the register where relevant, and retain the control even when insurance exists.
For professional indemnity and cyber cover, confirm the insured entity and people, covered activities, limits, excesses and exclusions. Check notification requirements, renewal responsibility and how cover responds to past work or changed business activities. Record the policy reference and renewal date privately. The professional indemnity insurance guide for mortgage brokers covers that insurance in more detail.
Check Whether the Register is Being Used
Use a short management review to compare the register with evidence from actual work. Start with overdue actions and failed controls, then examine a sample of recent file checks.
- Ask each owner to show the evidence for their control, including who performed the check and when.
- Compare that evidence with complaints, near misses and payment exceptions. Reopen an action when the same failure recurs.
- Agree the next corrective action, its owner and due date. Record who accepts any remaining exposure.
- Set the next review and tell affected staff what has changed in their daily work.
A completed template lists a pre-lodgement review. A working control leaves a review record on the file before lodgement, with exceptions resolved or escalated. If staff can show only the template, assign a test of the actual process and keep the action open until evidence supports closure.
