Who Owns Risk at Northwind Foods?
Northwind Foods (revenue $180M, three plants) has a risk committee that meets quarterly, chaired by the CFO, with the plant managers, the health and safety lead, and the corporate controller. The risk register is maintained by the safety lead and reviewed once a year. The board receives a one-page 'top ten risks' list with no owners and no thresholds. Twice this year, judgment calls went sideways: a plant manager treated a small anhydrous ammonia release as 'contained' and did not escalate it for 26 hours, and a $1.4M boiler replacement proceeded without the risk assessment that policy requires for capital projects over $2M - the project was split into two phases to stay under the threshold. Internal audit flagged both, and the CEO has asked you to advise on governance.
1. Identify the governance weaknesses in this structure and explain why each one matters, using the concept of three lines of defence.
Read the worked answer
The structure confuses ownership with oversight.
- First line: plant managers and the safety lead own and operate controls. Making the safety lead the register owner pulls a first-line operator into a second-line role; the person running ammonia procedures now grades their own controls.
- Second line: a risk function should set the framework, challenge ratings, aggregate, and report. That function effectively does not exist here, so nothing tests whether the register is complete.
- Third line: internal audit found both failures - good - but audit should be finding exceptions to a working system, not substituting for one.
Other failures: the CFO chairs the committee and owns the numbers being reported, so financial risk crowds out operational risk; the register is reviewed annually while the business changes monthly; the board gets a list with no owners, tolerances or trends - information without a decision.
The split boiler project is a control-design failure, not just a discipline problem. A bright-line dollar threshold tells people exactly where to aim. Policy needs a substance-over-form test (aggregate related phases) and no site-level discretion to reclassify.
2. Set out the risk appetite architecture you would recommend: what the board should set, what management should set, and give two concrete threshold examples.
Read the worked answer
Board sets appetite; management sets limits. The board should state how much of what kind of loss it will accept in pursuit of strategy, in language that can be tested. Two workable examples:
- Safety: zero tolerance for ammonia releases above the reportable threshold; any release or near-miss escalated to the CEO within one hour and to the board risk committee within 24 hours.
- Financial: annual aggregate retained operational losses not to exceed $2.5M, and no single event expected to exceed $5M without prior board notification.
Management then translates those into limits a plant manager can actually apply: per-site maximum single-event property and business interruption exposure, project risk screening at a much lower trigger (say $250k), and control performance targets.
Cascade it explicitly: appetite → tolerances → operating limits → KRIs with green/amber/red bands. Each top risk gets a named accountable executive, a tolerance, a KRI and a quarterly trend line. Separate the chair from the CFO's reporting line, ideally with an independent director, and move register ownership to a second-line risk lead who does not run any control being rated.
3. What should happen in response to the ammonia near-miss and the split boiler project? Be specific about escalation triggers and accountability.
Read the worked answer
Ammonia near-miss. Treat it as a process-safety precursor, not an incident that happened to be contained. Actions: (a) a one-hour notification rule to a duty officer, with the trigger defined by observable criteria - any release, any alarm, any odour complaint - not by the manager's judgment; (b) a root-cause investigation that asks why 26 hours passed: ambiguous reporting definitions, fear of blame, or no after-hours channel; (c) a hazard analysis refresh and mechanical integrity check; (d) the lesson fed back to all three plants.
Boiler project. Retrospective risk assessment before commissioning, then fix the policy: aggregate related phases, add a substance-over-form clause, and require risk sign-off from a second-line role rather than the project sponsor.
Accountability should distinguish a good-faith judgment error from deliberate threshold avoidance; the second is a conduct issue and belongs in objectives and consequences, not just retraining. Report both to the board risk committee with corrective actions and dates, so the committee sees the system responding - not only the events.