The Risk Register Nobody Reads
You lead compliance for a 1,200-employee insurer. Last year's risk assessment was a 90-question survey sent to 40 managers; 12 responded. The resulting register lists 60 risks, all rated "medium," and has not been updated in 11 months. In that period the company entered two new states, launched a mobile claims app, and had one regulator inquiry about claims timeliness. The board's audit committee has asked for a "risk heat map" at the next meeting in five weeks. Your CEO wants the register to stay stable so results look consistent year over year.
1. Diagnose the weaknesses in the current risk assessment approach and explain why the CEO's request is problematic.
Read the worked answer
The approach fails on several dimensions. A 30% response rate from a self-selected group produces unreliable data. Sixty risks all rated medium signals rating inflation and an inability to prioritize; a register where everything is medium is functionally unranked. The 11-month staleness means the assessment does not reflect two new-state entries, a new product, or a regulatory inquiry, all of which change the risk profile. The survey design also captures perception rather than likelihood and impact evidence.
The CEO's stability request is problematic because it treats the register as a communications artifact rather than a decision tool. Freezing ratings to look consistent misrepresents risk to the audit committee and could be characterized as misleading governance reporting. Consistency should come from methodology, not from unchanged conclusions.
2. Design a defensible path to a credible heat map in five weeks, including how to handle the CEO.
Read the worked answer
Rebuild with a focused, evidence-based method: (1) narrow to the 15-20 risks that matter, drawing on the new-state regulatory requirements, the app's data privacy exposure, and the claims-timeliness inquiry; (2) score likelihood and impact on defined 1-5 scales with written criteria so ratings are reproducible; (3) validate with structured interviews of the executives who own each risk rather than a broad survey; (4) assign owners and document the evidence behind each score.
On the CEO: explain that a heat map showing movement is a sign of a functioning program, not instability, and that an unchanged register after major business changes invites audit-committee skepticism. Offer a stable methodology with transparent change annotations so year-over-year comparison is possible. If the CEO still resists, escalate to the audit committee chair, since the committee is the body relying on the information.