Taxonomy Collapse: One Risk Register Entry Hiding Three Distinct Risks
A utility company has 310 risk register entries. An internal audit review found that 38% of entries are phrased as consequences rather than risks, for example 'regulatory fine for late outage reporting'. A further cluster of 22 entries in the customer operations unit are all titled variants of 'poor customer service'. The risk taxonomy has four level-one categories: safety, operational, compliance, and financial. During a workshop, a facilitator records 'call center system outage' as a single risk. In discussion it becomes clear three distinct things are being conflated: system availability, accuracy of the outage information given to customers, and the timeliness of regulatory notification. The risk function must decide whether to split entries, how to map them to the taxonomy, and how to handle the 22 duplicate customer service entries before the next reporting cycle.
1. Explain why 'regulatory fine for late outage reporting' is a deficient risk statement and rewrite it in a form consistent with a sound risk taxonomy.
Read the worked answer
The statement names a consequence (a fine) as though it were the risk. That conflates cause, event, and impact into one phrase, which makes it impossible to assess likelihood and impact separately, impossible to identify which controls matter, and impossible to tell whether two entries are duplicates.
A sound structure separates them: cause, event, consequence. The rewritten statement would be: 'Failure to submit outage notifications within the regulatory deadline, due to manual handoffs between operations and compliance, leading to regulatory penalty, reputational damage, and remediation cost.' That version supports assessment because likelihood attaches to the event (late notification) and impact attaches to the consequences (penalty, reputation). It also makes the relevant controls obvious: deadline tracking, handoff procedures, escalation.
The general rule to apply across the 38% of deficient entries is that a risk statement should describe an uncertain future event and its drivers, not a booked outcome. Consequences belong in the impact rating, not the risk title.
2. The facilitator recorded 'call center system outage' as one risk. Recommend how to decompose it and how to map the components to the four-category taxonomy, noting any mapping tension.
Read the worked answer
Decompose into three risks because each has different drivers, controls, and owners. First, system availability: the call center platform becomes unavailable, driven by infrastructure failure or cyber event, owned by IT. Second, information accuracy: customers receive incorrect outage or restoration information, driven by data feed errors or untrained agents, owned by customer operations. Third, regulatory notification timeliness: the regulator is not notified within the required window, driven by unclear ownership and manual handoffs, owned by compliance.
Mapping tension exists. Availability maps to operational, information accuracy arguably maps to operational with a reputational overlay, and notification timeliness maps to compliance. But a single outage event can trigger all three simultaneously, so the taxonomy must permit one event to generate multiple register entries without double-counting the same impact in aggregation. The practical fix is to tag entries with a shared event identifier so reporting can show either the event view or the risk view. Keeping them as one entry guarantees that the compliance risk is under-controlled because the IT owner will not own the regulatory deadline.
3. Recommend a treatment for the 22 overlapping 'poor customer service' entries.
Read the worked answer
Duplication at this scale destroys the value of the register: it inflates apparent risk counts, fragments ownership, and makes trend reporting meaningless. Recommend a consolidation workshop with the customer operations leadership, not a desk-based merge by the risk function, because only the business can say which entries describe genuinely different exposures.
The method: group the 22 by underlying driver and event. Likely outcomes are three to five genuine risks, for example complaint handling timeliness, vulnerable customer treatment, and billing accuracy. Retain one entry per genuine risk with a clear owner, archive the rest with a cross-reference so history is not lost, and record the consolidation decision. Set a taxonomy rule that new entries require a check against existing entries before creation. Present the consolidation as improving decision usefulness for the business, not as tidying for the risk function's benefit - otherwise the unit will simply recreate the duplicates.