How to Build Stakeholder Risk Assessment Into a Regulatory Filing

Most regulatory filings fail the stakeholder test not because the firm lacks information, but because the stakeholder analysis is written last, by someone who was not in the room when the decision was made. The result reads as justification rather than assessment. If you are preparing a filing where stakeholder impact matters, whether a variation of permission, a change in control, a significant resolution submission, or a product governance notification, the assessment needs to be built into the thinking from the start, not appended at the end.

Key Executive Takeaways

• A credible stakeholder risk assessment identifies who is affected, how, and what the firm has done or will do about it, with evidence, not assertion.
• The assessment must be sequenced before the filing narrative is finalised, so the mitigation story is real and the filing reflects actual decisions.
• Regulators look for honesty about trade-offs and residual risk, not a clean sheet. Overstating control is the single most common failure.

Start With Who Is Actually Affected

Stakeholder mapping for a regulatory filing is not a generic exercise. It is specific to the decision being filed. For each filing, write down the groups whose position changes as a result: customers (segmented by vulnerability, product, tenure), employees affected by restructuring or role change, counterparties and intermediaries, investors and funders, the regulator itself, and any adjacent public bodies. If the filing touches a product book, add distributors. If it touches operations, add critical third parties.

What goes wrong here is lumping. "Customers" is not a stakeholder group when 12% are in financial difficulty and 3% hold legacy products with features that no longer exist in the market. Segment to the point where the impact statement for each segment is meaningfully different.

Assess Impact Before You Draft Mitigation

For each stakeholder group, document three things: the nature of the impact (financial, operational, informational, reputational), the magnitude and distribution of that impact, and the time horizon over which it crystallises. Do this before you write anything about what the firm will do.

This matters because mitigation written in parallel with impact tends to shrink the impact to match the mitigation available. Separating the two steps forces honest sizing. If 4,000 customers will lose a feature they actively use, say so. Then decide what to do.

Build the Mitigation Story From Decisions, Not Intentions

Regulators distinguish quickly between mitigations the firm has decided and funded, and those it intends to consider. Every mitigation in the filing should reference a governance decision: board or committee approval, budget allocation, operational owner, delivery date. If it does not have those four things, it is an aspiration, and it should be labelled as such.

Where residual risk remains after mitigation, state it plainly. A filing that claims full mitigation of a material stakeholder risk invites challenge. A filing that identifies residual risk, explains why it is acceptable, and sets out monitoring arrangements is far more credible.

Integrate Into the Filing Narrative

The stakeholder risk assessment should not sit as an annex that nobody references. It should be visible in the executive summary, the rationale for the decision, the risk section, and the implementation plan. If the filing is about a change in control, the stakeholder assessment informs the integration plan. If it is about product withdrawal, it drives the customer communications timetable and the complaints handling uplift.

Governance Trail Matters as Much as Content

The assessment should have a clear owner, a date, a version history, and evidence of challenge. Board or risk committee minutes should reflect substantive discussion of the stakeholder analysis, not approval of a pre-cooked paper. If the regulator asks how the firm reached its conclusions, you want to point to a trail that shows real deliberation.

What Good Looks Like

A strong filing lets a regulator reconstruct the firm's reasoning: who is affected, how badly, what the firm considered, what it chose to do, what it chose not to do and why, and how it will know whether the mitigation is working. It is specific, quantified where possible, and honest about what the firm does not yet know.

Your next decision: look at your current draft filing and ask whether a reader could identify the three stakeholder groups most at risk and the specific actions committed to each. If not, the assessment is not yet doing its job.

Frequently Asked Questions

How detailed should the stakeholder segmentation be?

Detailed enough that the impact statement and mitigation differ meaningfully between segments. If two segments have the same impact and the same mitigation, they are one segment. If a single segment has a wide range of impact, split it.

Should we include stakeholders we have not consulted?

Yes, if they are materially affected. State clearly that they have not been consulted and explain why, whether timing, confidentiality, or market sensitivity. Omitting them to avoid the question is worse than disclosing the gap.

How do we handle stakeholder groups whose interests conflict?

Name the conflict. Explain how the firm weighed the competing interests, which interest took priority, and why. Regulators understand that trade-offs exist. They are suspicious of filings that pretend otherwise.

What if the assessment surfaces a risk we cannot mitigate within the filing timetable?

Flag it, size it, and set out an interim control plus a path to full mitigation. Do not delay the filing to engineer a cleaner story, and do not file as if the risk is resolved when it is not.

Who should own the stakeholder risk assessment internally?

It needs a senior accountable owner, typically the executive sponsor of the filing, with input from risk, compliance, customer functions, and operations. Ownership by the filing project manager alone is a common failure mode: it ends up as a documentation task rather than a governance one.