Risk Appetite After the Merger
Meridian Health Systems has just closed the acquisition of a 900-bed regional hospital. The combined group now runs two risk registers: the parent's 1,150-entry register scored on a 5×5 matrix and the hospital's 640-entry register scored on a 4×4 matrix. A spot check shows 71% of hospital entries have not been reviewed in 180 days, and the same ransomware scenario is rated 'low' in one register and 'high' in the other because one uses inherent risk and the other residual risk. The audit committee has asked for a single heat map and a 'top 10' list in six weeks. The CRO wants to preserve every entry for traceability; the CIO wants to collapse everything into a dozen themes. Business unit leaders say they cannot spare more than two hours each for workshops. A prior consultant's taxonomy was abandoned after nine months.
1. Design the six-week approach to produce a defensible consolidated heat map. What do you do first, what do you refuse to do, and how do you handle conflicting scores for the same scenario?
Read the worked answer
First, treat this as a data reconciliation and calibration exercise, not a scoring exercise. In week 1, freeze both registers, assign a single accountable owner per business unit, and document the two scales, definitions, and whether each score is inherent or residual. Do not average a 4×4 score with a 5×5 score or compare them directly; that creates false precision. Instead, run 90-minute calibration workshops with each business unit, using the same five scenario prompts (ransomware, regulatory breach, third-party outage, clinical safety, privacy), and rescore to a common 5×5 residual basis with written rationale. Deduplicate by risk event and root cause, not by wording. Keep the source entry IDs as a crosswalk so the CRO's traceability concern is met. In weeks 2–4, validate the top 20–30 enterprise risks with tabletop evidence and KRIs; in weeks 5–6, produce the heat map with confidence bands and a separate 'not yet assessed' section. Refuse to publish a single number without the crosswalk and assumptions.
2. The audit committee insists on exactly 10 risks; the CRO wants all 1,790 entries visible. How should the final reporting product be structured and governed?
Read the worked answer
The board needs a decision product, not a data dump. Structure the pack in three layers: (1) a one-page top 10 enterprise risks, each with owner, residual rating, trend, appetite position, and one early-warning indicator; (2) a thematic heat map of 12–15 risk themes that maps to the full register; (3) an appendix or data room with all 1,790 entries and the crosswalk. Governance: the audit committee approves the taxonomy and aggregation rules, the CRO owns the register, and internal audit provides independent assurance over the process, not the individual scores. Explain that 'top 10' is a communication convention, not a claim that only ten risks exist. If a business unit insists its risk is missing, the test is whether it rolls into a theme and whether its residual score exceeds the agreed threshold. Publish the threshold and the escalation rule so the list is reproducible. This satisfies the board's request without letting the CRO's full traceability requirement paralyze reporting.
3. The parent's appetite statement says 'zero tolerance for regulatory noncompliance'; the hospital's practice accepts 'moderate' compliance risk. How do you reconcile this in the consolidated framework?
Read the worked answer
Reconcile at the level of appetite, not wording. 'Zero tolerance' is usually a statement of tolerance for knowingly accepting noncompliance, not a claim that no control will ever fail. Convene the parent CRO, hospital compliance officer, and general counsel to define: (a) which obligations are non-negotiable (licensing, mandatory reporting, patient safety); (b) what constitutes an exception and who may approve it; (c) the time-bound remediation expectation; and (d) the metric that shows drift. Replace 'moderate acceptance' with specific thresholds, for example no unremediated high-risk finding older than 60 days without a board-approved exception. Document the reconciliation as a single appetite statement with examples. If the hospital's prior practice tolerated exceptions informally, do not simply import it; require retrospective disclosure of open exceptions for 12 months. The heat map should show appetite breaches separately from inherent risk so the board can see both exposure and tolerance. This turns a semantic conflict into an auditable rule set.