The Risk Register Nobody Trusts
Halcyon Foods ($310M revenue) runs two owned plants, leases a warehouse from a company owned by the CEO's brother, and outsources 30% of production to a single co-packer whose only qualified cooking line failed for nine days last quarter. A new direct-to-consumer channel now supplies 18% of revenue and suffered a breach of 40,000 customer records that reached Legal three weeks after IT discovered it. The risk register is a 22-line spreadsheet the CFO updates before the insurance renewal; nearly every line is a property or general liability exposure tied to a policy. Safety logs incidents, IT logs tickets, Quality logs holds, and nothing is consolidated. The board devotes 15 minutes a year to risk and there is no written risk appetite. Last month the audit committee asked what could put the company out of business, and nobody could answer with evidence.
1. Identify the exposures the current register most likely omits or understates, and explain the process failures that produce the omissions rather than just listing risks.
Read the worked answer
What is missing
- Dependency and concentration exposures, not just events: 30% of production through one co-packer with one qualified cooking line, a nine-day outage, and no qualified alternate. Contingent business interruption and supply-chain concentration appear nowhere in 22 lines.
- Cyber and privacy: 40,000 records triggers breach-notification clocks, payment-card obligations and reputational exposure, and the DTC channel depends on uptime. An IT ticket log is not an exposure inventory.
- Product contamination and recall: co-packing raises who decides and who pays for a recall, and DTC makes a recall a consumer-facing event, not a wholesale one.
- Related-party governance: a lease from the CEO's brother creates conflict, termination and indemnity exposure that a policy-driven spreadsheet never captures.
- Contractual and key-person: co-packer indemnities and quality warranties; dependence on family executives.
Why the process misses them
- The register is built backwards from insurance policies, so anything without a policy line has no home.
- Each function logs only its own events, so nobody sees that a recall plus a co-packer outage plus DTC dependence is one correlated scenario, which is far worse than three separate ones.
- Near-misses are not captured as evidence, so likelihood is never recalibrated from experience.
- With no risk appetite there is no materiality test, so nothing is ever escalated as business-threatening.
The diagnosis is a taxonomy, ownership and appetite problem, not a missing-list problem. Adding 15 rows to the spreadsheet would change nothing.
2. Propose a 12-month implementation sequence and state what you would measure to show the program is actually working.
Read the worked answer
Sequence and why
- Months 1-2: common taxonomy plus a board-level risk appetite draft. Appetite must come first because without a materiality threshold, inventory becomes an argument about opinions rather than a prioritisation exercise.
- Months 2-4: rebuild the register from exposures, not policies. Process mapping and interviews, one accountable owner per material risk, and 24 months of incident and near-miss history pulled in to recalibrate likelihood.
- Months 4-6: scenario workshops on the correlated cases (recall during a co-packer outage; breach at quarter-end). Quantify the top six with ranges, not points, so the board sees uncertainty.
- Months 6-9: escalation rules and reporting. Named authority, a 24-hour notification clock to Legal/Compliance, a KRI dashboard, quarterly board pack.
- Months 9-12: align the insurance renewal to the register and test the whole thing with a tabletop exercise.
Measures that prove it works
- Percentage of material risks with a named owner and a tested escalation trigger.
- Near-miss reports per 100 employees (rising is good, falling is a warning).
- Median hours from incident to Legal/Compliance notification.
- Share of insurance limits traceable to a quantified exposure, and count of material risks with no policy response but an active control plan.
- The acid test: the board can answer the out-of-business question with two scenarios and numbers, and can explain what they decided not to fund.
3. The audit committee asks whether the nine-day co-packer outage and the three-week breach delay are risks that belong in the register. How do you answer, and what do you do with each event?
Read the worked answer
Answer with a distinction, then use both events as data.
- A risk is an uncertain future outcome with a likelihood and an impact. An incident or near-miss is a realised event; it is evidence about likelihood and about control effectiveness, not a risk itself.
- The nine-day outage was a free full-scale rehearsal. It produced real numbers: days of cover, customer tolerance, alternate capacity, revenue at risk per day. Use those to size contingent BI severity without waiting for a loss, and let it drive a decision (dual-qualify an alternate co-packer, add contractual notice and capacity warranties).
- The three-week delay is a control failure in escalation, not a coverage question. The remedy is a defined reporting clock, a named decision-maker and a tested path, not an extra line in the register.
Practically: keep one register for uncertain outcomes with owners and a separate incident/near-miss log that feeds it. Merge nothing. Then state the honest limit: two events give you narrative, not a frequency distribution, so the outage recalibrates the range and triggers a control decision, but it does not justify a 3% probability estimate. Say that out loud to the committee, because the temptation is to manufacture precision from a single event.