Board Risk Reporting at MetroLink Infrastructure Agency

The failures are comparability, accountability, timeliness, and gaming. Different likelihood scales mean the heat map is not a common language. Twenty-two of 40 high risks without owners means no one is accountable for treatment or reporting. A 19-day average lag means the board sees history, not current exposure. The cutoff rule allowed two escalated risks to disappear from the pack, which is a governance gap, not an administrative detail. 'Amber-plus' is an unsanctioned label used to avoid the consequences of 'red'.

The dashboard should use one approved 5x5 matrix with written likelihood and consequence definitions. Each reported risk should show: ID, owner, cause-event-consequence, current score, target score, trend, key controls, assurance status, next review date, and decision requested. The page should include the top 10 risks by score, every risk above board appetite, every risk with no owner, and every newly escalated risk regardless of cutoff. Red should mean appetite breach, not blame. A short narrative should explain changes since last quarter. The risk function should quality-assure scores before the pack, and the board should see the raw project exceptions in an annex. This keeps the one-page view decision-focused without hiding detail.

The escalation rule should be trigger-based, not calendar-based. Escalate within 48 hours of identification if any of the following applies: the risk exceeds board appetite; it has no named owner; a key control has failed or has no assurance; it is a safety, regulatory, or reputational risk above the defined threshold; it has moved two or more levels in a month; or the project cannot fund the treatment. The board pack cutoff should not suppress escalation: late items should go into an exception annex or be raised as an urgent chair's item. The board should minute the decision and the accepted residual risk.

'amber-plus' should be prohibited because it breaks the scoring scale and hides accountability. Project directors should be told that red triggers support and scrutiny, not automatic blame, and that early escalation will be rewarded. The risk function should audit owner assignment monthly and report the number of risks without owners. The chair should ask three questions of every red risk: what would change the assessment, who owns the next action, and what is the trigger for re-escalation. This addresses the fear behind the language while restoring a single reporting standard.

The supplier insolvency risk should be reported at the next board as an explicit exception. The report should state what was known, when it was known, why it missed the cutoff, the current exposure, actions already taken, and the decision needed. This is not about blaming the cutoff; it is about restoring trust and testing whether the escalation rule failed. The board should ask whether the supplier is critical, what contingency or novation options exist, and whether other late risks were also omitted.

For tunnelling settlement, a single score is misleading. Present the monitored settlement range, trigger levels, uncertainty, properties or assets at risk, current controls, and contingency plan. Show what would change the assessment and who owns the next action. The board should see a range and a trigger, not a false precision. Minute the accepted residual risk and the review date. This approach gives the board decision-useful information and reduces the incentive to hide bad news behind labels or late submission.