When the Risk Register Becomes Fiction
A logistics group maintains a risk register with 210 entries. The CRO has noticed: 160 entries have not changed rating in 3 years; 38 are marked 'mitigated' with no evidence attached; 12 are duplicates of each other under slightly different names; and the top 10 risks by rating have not been discussed at a board meeting in 18 months. Meanwhile, a warehouse fire in the period caused a 9-day operational outage that was not on the register at all - the nearest entry was 'property damage' rated low because insurance was assumed to cover it. The CFO defends the register: 'It's comprehensive - 210 risks is thorough.' The audit committee chair asks whether the register is fit for purpose.
1. Evaluate the register's fitness for purpose. What does the evidence say about whether it is functioning as a risk management tool?
Read the worked answer
The evidence points to a register that is comprehensive in form and inert in function.
- 160 unchanged ratings over 3 years is implausible for a live business. Ratings that never move usually mean nobody is re-assessing; the register records history, not current exposure.
- 38 'mitigated' with no evidence means the register asserts control effectiveness it cannot demonstrate. An unevidenced 'mitigated' is worse than 'open' because it suppresses attention.
- 12 duplicates show no quality control; the count of 210 is inflated and misleading.
- Top 10 undiscussed for 18 months is the decisive fact: the register is not feeding the body that governs risk. A register the board never sees is a filing exercise.
- The warehouse fire was absent. The register missed a realised, material event because 'insurance' was treated as eliminating the risk rather than transferring part of it. Insurance covers financial loss, not the 9-day outage, customer attrition, or recovery effort.
The CFO's '210 is thorough' is the wrong metric. Fitness for purpose is measured by whether the register drives decisions, captures realised and emerging risks, and is evidenced - not by entry count. On this evidence it is not fit for purpose.
2. Propose how to rebuild the register so it earns its place. What would you keep, cut, and add?
Read the worked answer
Cut: the 12 duplicates; the 38 unevidenced 'mitigated' entries (downgrade to open until evidence exists); and the long tail of entries that no one owns or acts on. A register of 40-60 live, owned risks beats 210 inert ones.
Keep and fix: every entry needs a named owner, a current rating with a review date, and an evidence link for any mitigation claim. Ratings must be re-assessed on a cycle and on trigger events.
Add:
- A realised-events review - the warehouse fire should have generated a new entry covering business interruption and recovery capability, with insurance treated as a mitigant to financial loss only, not to operational continuity.
- A top-risk board cycle - the top 10 reviewed at every board or risk committee meeting, with movement explained.
- Emerging-risk scanning with an explicit 'not yet on the register' discussion.
Process changes: owner attestation each cycle; a rule that 'mitigated' requires evidence or is recorded as open; and a quarterly register-quality review by the second line.
Audit committee message: the register is currently a record, not a tool. Rebuilding it around ownership, evidence, and board visibility - with realised events feeding back in - is the minimum to make it fit for purpose. Entry count is not the measure; decisions influenced are.