Normalizing a Hospital Risk Register Under Funding Pressure
Mercy Valley Health is a 12-hospital network with 18,000 staff and a 5x5 risk register containing 33 high risks. Scores are entered by any risk owner without a calibration guide; there are no treatment owners, due dates, or documented compensating controls. Nine high risks involve unsupported Windows Server 2012 systems running radiology PACS at three hospitals. The CISO has two risk analysts, spreadsheets, and no GRC tool. Cyber insurance renews in 90 days and the underwriter requires evidence of risk treatment for the top risks. A regulator has opened an inquiry after a radiology vendor breach exposed scheduling data. The board wants a top-10 risk list and a funding request at the next meeting. The CIO has offered $1.2 million for remediation, but the CISO believes at least $3 million is needed. The CFO wants to know which risks can be accepted rather than funded.
1. Assess the quality of the risk register and describe how you would normalize scoring and ownership before presenting a top-10 list.
Read the worked answer
Diagnosis. The register is a list, not a risk management tool: uncalibrated 5x5 scores, no owners, no due dates, no compensating controls, and no link to assets or controls. A top-10 list built from it would be arbitrary.
Normalization. First define scoring anchors for likelihood and impact with concrete examples: impact 5 means patient safety event or regulatory enforcement; likelihood 5 means active exploitation or recurring incident. Re-score the 33 high risks in a calibration session with clinical, IT, and compliance representatives. Separate inherent and residual risk; document existing controls and their evidence. Assign one accountable owner per risk, not a committee. Add treatment type, due date, and status. Consolidate duplicate PACS risks by hospital and system. Then rank by residual risk, regulatory exposure, and patient impact. Present the top 10 with confidence levels and data gaps. The board should see why a risk moved, not just its score. This process can be done in 30 days with spreadsheets if the CISO limits scope to the high risks and uses a consistent template.
2. Given the $1.2 million offer and the $3 million estimate, recommend a treatment and acceptance plan for the nine PACS risks and the other high risks.
Read the worked answer
Funding gap. The $1.2 million offer cannot cover all 33 high risks; the CISO's $3 million estimate may also be a wish list. Separate mandatory remediation from risk acceptance.
PACS. Treat the nine PACS risks as a cluster. Immediate: network segmentation, restrict inbound and outbound traffic, enhanced monitoring, vendor support escalation, and documented compensating controls. Fund replacement or migration for the three most exposed hospitals first. Accept residual risk only for hospitals with documented segmentation and monitoring, signed by the CIO and CISO, with a board-approved deadline. Do not accept risk on systems that cannot be segmented.
Other high risks. Fund low-cost, high-reduction controls first: identity hygiene, backup restoration testing, patch automation, and vendor access controls. Defer or accept risks where the cost of treatment exceeds the expected loss and the risk is within appetite. The CFO should see a tiered plan: $1.2 million covers must-do controls; the additional $1.8 million is phased over two quarters with a decision gate. The judgment is to buy down the most severe residual risk first, not to spread the budget evenly.
3. Draft the risk acceptance authority and the evidence you would give the insurer and regulator.
Read the worked answer
Acceptance authority. Set tiers: business owners may accept low risks; CISO accepts medium risks within appetite; CIO and CISO jointly accept high risks with compensating controls; board risk committee accepts any risk that could affect patient safety, regulatory standing, or a material financial threshold. No verbal acceptances. Every acceptance has an expiry, a trigger for review, and a named owner.
Insurer evidence. Provide the normalized register, top-10 residual risks, treatment plan and dates, compensating controls for PACS, incident history, and proof of board oversight. Underwriters care about whether risk is known and managed, not whether it is zero.
Regulator evidence. Provide the inquiry response chronology, containment steps, vendor contract and oversight evidence, and remediation commitments. Be careful not to overstate controls; inconsistency between the insurance submission and the regulator response creates a new risk. The CISO should reconcile both submissions through legal counsel before sending.