Aggregation Across Silos
A global manufacturer runs ERM by business unit. Each unit reports its top ten risks on a five-by-five heat map. Corporate risk aggregates the maps by counting how many units rate a risk 'red.' The CFO notices that three units each report a 'cyber' risk as medium, but the incidents described are the same shared ERP platform, and a single outage would hit all three simultaneously. Separately, two units report 'supplier failure' as low because each has a backup supplier-but the backup is the same firm for both. The audit committee asks whether the enterprise risk profile is being measured correctly. The risk team has no common risk taxonomy across units and no way to model correlation. The CFO wants a defensible answer before the next board meeting in six weeks.
1. Explain why counting red ratings across units misstates enterprise risk, using the cyber and supplier examples.
Read the worked answer
Counting reds treats each unit's rating as an independent observation and implicitly assumes risks add like separate items. But enterprise risk depends on correlation and shared dependencies, not just the sum of unit-level severities. In the cyber case, the same ERP platform means the three 'medium' events are not independent-they are one event with a common cause. If each unit rates medium because a single-unit outage is medium, the enterprise exposure is closer to a single high-severity event affecting all three at once, with correlated recovery. In the supplier case, two units each rate low because a backup exists, but the backup is the same firm; the backup provides no diversification, so the enterprise has a single point of failure rated low twice. Counting reds would show zero red for both, understating the enterprise profile. The correct framing separates frequency/severity at the unit level from concentration and common-cause dependence at the enterprise level. A defensible metric must identify shared assets, shared third parties, and shared processes, then assess the enterprise-level event, not average the unit ratings.
2. Recommend a practical method to surface concentration and common-cause risk within six weeks, given no common taxonomy and no correlation model.
Read the worked answer
Given the constraints, do not attempt a statistical correlation model. Use a dependency mapping approach. First, build a minimal common taxonomy of perhaps 15–20 enterprise risk categories so unit risks can be mapped to a shared label; this is achievable in two weeks with workshops. Second, run a shared-dependency inventory: for each unit's top risks, ask what asset, third party, system, or process the risk depends on, and tag those dependencies. Third, cluster by dependency-any dependency appearing in two or more units is flagged as a concentration. Fourth, for each cluster, hold a short joint assessment with the affected units to rate the enterprise event once, rather than summing unit ratings. Fifth, present results as a concentration heat map plus a short list of single points of failure. This is qualitative but defensible and auditable: it shows the board where independence assumptions break. It also creates the taxonomy and dependency data needed for a future quantitative model, so the six-week deliverable is a foundation, not a throwaway.
3. The CFO asks whether the enterprise risk profile is 'being measured correctly.' Frame the answer for the audit committee.
Read the worked answer
The honest answer is that the current method measures unit-level severity but not enterprise-level dependence, so it is directionally useful but not a correct enterprise measure. For the audit committee, frame it in three parts. What works: unit reporting creates ownership and surfaces local issues; the heat maps are a reasonable starting inventory. What is missing: aggregation assumes independence, so shared platforms and shared suppliers are invisible; the enterprise profile understates common-cause events. What changes: adopt a common taxonomy, map shared dependencies, and rate enterprise-level events once per cluster. Be explicit that this is a methodological correction, not a control failure-no one did anything wrong; the design simply aggregated the wrong quantity. Avoid overclaiming precision: a qualitative concentration map is more defensible than a false-precision score. Recommend an internal audit review of the revised method and a commitment to revisit once dependency data exists. This gives the committee a clear, bounded answer and a credible path, which is what a judgement-focused committee expects.