Vantage Credit Union: An 84-Risk Register the Board Cannot Use
Vantage Credit Union ($2.3B assets) has an 84-item risk register in which every risk is rated 'high' or 'medium'; one line covers 'third-party risk.' KRIs are reviewed monthly and consist of past-due loan ratios and prior-month fraud losses. Last quarter, a payment processor outage stopped debit transactions for nine hours; the register's third-party line was unchanged afterwards. The board risk committee receives a 60-page pack of heat maps with no narrative, and spends its hour on loan losses. The CRO wants a redesigned reporting approach before the next board cycle.
1. Diagnose the register and KRI design. What specifically makes them fail as decision tools?
Read the worked answer
The register has no ranking power. When 84 of 84 risks are high or medium, the rating carries no information. Ratings drift upward because nobody is rewarded for lowering one, and the committee cannot tell which risks would actually stop the business.
It collapses structure. 'Third-party risk' as a single line hides dozens of vendors with different criticality, different data access and different substitutability. The nine-hour outage should have changed something on that line - criticality, concentration, control test results - and did not, which tells you the line is a label rather than an exposure.
The KRIs are lagging. Past-due ratios and prior-month fraud losses confirm what already happened. Nothing in the set would have moved before, or even during, a nine-hour payment outage.
No connection to strategy or appetite. There is no statement of how much disruption to member-facing services is acceptable, so there is no way to judge whether nine hours was tolerable or a breach.
Reporting formats offloads interpretation. Sixty pages of heat maps asks directors to do the analysis in the meeting. That is why the hour goes to loan losses - the only content with a familiar story attached.
2. Rebuild third-party risk into something measurable: propose a structure and three KRIs with thresholds, including at least one leading indicator.
Read the worked answer
Structure before metrics. Inventory vendors, then tier them by criticality: tier 1 = member-facing service with no workaround inside two hours; tier 2 = internal service with a workaround; tier 3 = everything else. For each tier-1 vendor record the function supported, substitutability, data sensitivity, contract exit terms, last control attestation, and the share of that function the vendor holds.
Three KRIs:
- Exit-plan coverage (leading): percentage of tier-1 vendors with an exit or substitution plan tested in the last 12 months. Target 100%; amber below 90%; red below 75%.
- Concentration: share of any critical function delivered by the largest single provider. Green below 50%; amber 50–65%; red above 65%.
- Restoration performance: mean time to restore for tier-1 outages, and the count of outages breaching the contractual service level. Set the threshold against the appetite the board has actually approved, not against last year's average.
Add a leading control indicator: open critical findings past their remediation date at tier-1 vendors. That number moves before customers notice anything, which is the property the current KRI set lacks. Each KRI needs an owner, a data source, a review cadence and a defined escalation when it goes red.
3. Redesign what goes to the board. What do you cut, what do you add, and how do you make the nine-hour outage a board-level lesson?
Read the worked answer
Cut the 60-page heat map pack to 8–12 pages. Directors do not need every risk; they need the handful where a decision is required.
Add:
- Top 6–8 risks only, each with an owner, the appetite or tolerance it is measured against, current status, and a trend arrow.
- What changed since last meeting and why - a short narrative. Movement is the signal; a static red box is not.
- Appetite utilization: where the organization sits against the limits the board set, not just whether a risk is 'high.'
- Decisions requested, listed explicitly at the front, so the hour is spent on judgment rather than orientation.
- A standing operational-events item for anything above a defined threshold, so incidents reach the board without waiting for a quarterly cycle.
The outage as a lesson: require a report within five business days - root cause, member impact, contractual remedies and service credits, whether other tier-1 vendors share the same dependency, and the specific change made to the register. Then show the committee the register entry that changed. The lesson is not the outage; it is that the framework should be demonstrably different afterwards. A risk function that cannot show a change from a nine-hour payment failure will lose the board's confidence at the next incident.