The Risk Register Nobody Owns
You are the risk lead at a 900-person insurer. The board risk committee has just been told that the top enterprise risk - a legacy policy-administration system - is rated 'high' with a 'medium' residual after controls. On review you find: the control effectiveness ratings were last updated 14 months ago; the risk owner left eight months ago and the role is vacant; the 'medium residual' was calculated by the former owner and never challenged; and a recent penetration test found two unpatched critical vulnerabilities on that same system. The CRO is under pressure to keep the residual rating stable because a downgrade would trigger a regulatory conversation and a capital add-on. The next committee is in three weeks.
1. Evaluate whether the reported residual rating is defensible, and set out what must change before the committee.
Read the worked answer
The rating is not defensible. Three independent failures:
- Stale controls. 14-month-old effectiveness ratings cannot support a current residual assessment, especially for a fast-moving technology risk.
- No owner. A risk with a vacant owner has no one accountable for controls, monitoring or treatment. Ownership is a precondition for a credible rating.
- Contradicted by evidence. Two unpatched critical vulnerabilities directly undercut any claim that controls reduce the risk to 'medium'. The residual was inherited, not reassessed.
Before the committee:
- Re-rate the inherent and residual risk using current evidence, with the vulnerabilities explicitly factored in.
- Assign an interim owner (named individual, not a committee) with authority to act.
- Refresh control effectiveness for the key controls, with evidence.
- Document the change and its rationale, including that the prior rating was unsupported.
On the CRO pressure: a rating held stable to avoid a regulatory conversation is a misstatement of risk, not a prudential judgement. If the honest rating triggers a capital add-on, that is the system working. Record the CRO's request and your response.
2. The CRO asks you to keep the rating 'pending reassessment' rather than downgrade it. How do you respond?
Read the worked answer
Decline, and explain why in writing.
- 'Pending reassessment' is not a rating; it is a placeholder that leaves the committee with no risk position while implying the old one still stands. That is more misleading than a downgrade, because it looks diligent while deferring the truth.
- Present two things to the committee: the current best estimate (downgraded, with the vulnerabilities) and a plan and timeline to complete full reassessment. Transparency plus a credible plan is defensible; a frozen rating is not.
- If the CRO insists, escalate to the board risk committee chair or the CRO's line - the risk function's independence is the point.
Record: the request, your refusal, the evidence, and the escalation. This protects you and the firm if the regulator later asks why the rating moved (or didn't).
Judgement point: the exam tests whether you distinguish managing the message from misstating the risk. The former is legitimate; the latter is a governance failure you must not sign.