Risk Management Policy

This policy sets out how RD1 identifies, assesses, and manages risk across its business, so that risks to the company, its clients, candidates, and placed workers are recognised early and managed proportionately, rather than addressed only after something goes wrong.

RD1's risk management covers: compliance risk (employment law, data protection, right to work, and sector-specific regulation); operational risk (loss of key systems, premises, or personnel — see our Business Continuity & Disaster Recovery Policy); financial risk (client payment default, cash flow, insurance adequacy); reputational risk (service failure, data breach, misconduct by staff or placed workers); and commercial risk (over-reliance on a single client or sector).

Risks are identified through day-to-day business activity, client and candidate feedback, complaints and incidents, compliance audits, and horizon-scanning for relevant legal or market change. Identified risks are assessed for likelihood and impact, and prioritised accordingly, with the most significant risks — such as those affecting worker pay, data security, or right to work compliance — receiving the closest and most frequent attention.

For each significant risk, RD1 identifies practical mitigations — for example, the due diligence and vetting processes in our Safer Recruitment & Vetting Policy and Right to Work Policy, the insurance cover set out in our Insurance Statement of Cover, and the continuity arrangements in our Business Continuity Policy — and monitors whether those mitigations remain effective.

RD1's risk register and this policy are reviewed at least annually by the Directors, and sooner following a significant incident, near-miss, or relevant change in law or client requirements.

The Directors have overall responsibility for risk management at RD1 and for ensuring risks are reviewed and mitigated on an ongoing basis.