Returning to Cybersecurity: Building My First Banking GRC Risk Register

After working in digital marketing for three years, I decided to return to my original path: cybersecurity and Governance, Risk, and Compliance (GRC). To practice what I learned, I created a realistic Enterprise Risk Register and Treatment Plan for a fictional bank called Apex Bank Ltd.

I mapped out 10 common banking risks and scored them using standard frameworks (ISO 27005 and NIST SP 800-30).

Here is a quick look at why I built this project, how it works, and two key examples from the register.

The Problem: Old Systems and High Initial Risk

Banks run important operations every day, but many still rely on manual forms, paper logs, or slow email checks.

Without automated security checks:

• Starting Risk is Very High: Unprotected threats (like ransomware or unauthorized access) start with high initial risk scores (up to 20 out of 20).
• Manual Steps Fail: Hand-written exit checklists or manual spreadsheet checks easily lead to human error.
• Audits Need Real Proof: Bank auditors will not accept verbal promises, they want real proof (like automated system logs or test reports) to prove that safety steps actually work.

My risk register covers 10 real-world banking risks across cybersecurity, system hardware, regulatory rules, and physical safety.

2 Examples from My Risk Register

1. Stopping Former Employees from Logging In (Risk ID: R2026-05)

• The Problem: When an employee leaves, relying on manual paper checklists means their accounts might stay active too long, giving them unauthorized access to bank systems.
• Risk Score Drop: Reduced the starting risk score from 20 (High) down to 2 (Low).
• The Fix: Replaced manual emails with an automatic connection between the HR system and the login system to turn off accounts the same day an employee leaves.
• Audit Proof Needed: System setup documents, test logs showing HR talks to the login system, and time logs showing when accounts were closed.

2. Fixing Errors in Government Financial Reports (Risk ID: R2026-09)

• The Problem: Copying financial data manually into spreadsheets for official bank reports leads to human calculation errors and heavy government fines.
• Risk Score Drop: Reduced the starting risk score from 12 (Medium) down to 2 (Low).
• The Fix: Used specialized reporting software that automatically checks for errors before reports are submitted.
• Audit Proof Needed: Signed software contracts, data test reports, and error-check logs.

What I Learned from This Project

Building this project taught me three key things:

1. Grouping risks into clear levels (1–6 Low, 7–12 Medium, 13–20 High) helps managers understand what to fix first.
2. A risk plan only works if a specific person is responsible for fixing it by a set deadline.
3. A fix is not complete until you collect clear proof (like system logs or vendor reports) that shows the control is active.

You can view my complete 4-tab Excel workbook, risk scale, and action plan on GitHub.

View the Project Files: (https://github.com/PearlAina/Apex-Bank-GRC-Risk-Register)