The Report That Told the Board Everything Was Fine
A software company's risk function reports to the board audit committee twice a year. The report is a 30-page document listing 25 risks with heat-map scores, a RAG status for each, and a narrative for the top five. At the last meeting, 22 of 25 risks were green. The committee spent 40 minutes on the pack, asked two questions, and approved it. Six weeks later, a major cloud provider outage took the company's flagship product offline for nine hours, breaching service-level agreements with three enterprise customers. The outage risk had been rated green because the provider had a 99.99% uptime record. The risk owner says the provider's record was the evidence. The chair of the audit committee is now asking why the board was not warned. The risk function has one full-time analyst and reports to the CFO, who also owns three of the risks on the register.
1. Diagnose why the reporting process failed to give the board an early warning. Consider content, cadence, and independence.
Read the worked answer
The failure is in the reporting system, not in any single report.
Content:
- Green meant 'no recent event', not 'well controlled.' The cloud outage risk was green because the provider had a 99.99% uptime record - a historical frequency measure applied to a low-frequency, high-consequence dependency. The same error as scoring likelihood from observed frequency. A green status should reflect control effectiveness and residual exposure, not a clean history.
- Heat maps compress judgement. A 25-risk heat map with 22 greens conveys 'nothing to see here.' It hides concentration: the company's dependence on a single cloud provider is a structural exposure that a per-risk RAG cannot show.
- No forward-looking content. The pack described the register, not emerging risks, near-misses, or changes since the last meeting. There was nothing to prompt a question.
Cadence:
- Twice a year is too infrequent for a fast-moving technology dependency. Between meetings, the board had no visibility of changes. A quarterly cycle with an event-driven escalation route would have allowed the provider issue to surface when it arose.
Independence:
- The risk function reports to the CFO, who owns three risks on the register. The person who owns risks controls the report that assesses them. That is a structural conflict: it is hard for a one-person function to rate its own boss's risks amber.
- A single analyst with no peer review has no challenge mechanism.
Committee behaviour: 40 minutes and two questions for a 30-page pack signals the pack was not designed for scrutiny. Length is not the same as information.
2. Recommend changes to the reporting process that would have surfaced the cloud dependency risk before the outage.
Read the worked answer
1. Change what green means. Define RAG against explicit criteria: green = control tested and effective, residual exposure within tolerance, and no unmitigated concentration. Require the risk owner to state the evidence and its limitations. For the cloud risk, the 99.99% record would be recorded as 'historical frequency only; no assessment of concentration or recovery capability' - which is not green.
2. Add a concentration and dependency view. A separate section listing single points of failure and critical third parties, regardless of their historical reliability. This is the view that would have shown the flagship product depended on one provider with no tested failover.
3. Report change, not just status. Each pack should show what has changed since the last meeting: new risks, score movements, incidents and near-misses, and emerging issues. A static 22-green pack gives the board nothing to react to.
4. Shorten the pack and deepen the scrutiny. Replace the 25-risk list with a two-page summary of the top exposures by severity and concentration, plus an appendix. Reserve meeting time for challenge, not reading.
5. Increase cadence and add escalation. Quarterly reporting, plus a standing route for any risk owner to escalate an emerging issue between meetings without waiting for the cycle.
6. Fix independence. The risk function should not report to an owner of risks on the register. Move reporting to the audit committee chair or the CEO, and require the CFO's three risks to be reviewed by someone else. Add external or peer challenge to the risk function's assessments.
7. Test the assumption. Require that any risk rated green on the basis of a supplier's or provider's track record is supported by evidence of the company's own resilience - failover tested, recovery time measured, contractual protections in place.