Stale Risk Register and Missed Emerging Risks
A midstream energy company with $3.1 billion in assets refreshes its enterprise risk register annually through a consultant who interviews eight senior leaders. The top five risks have not changed in three years: commodity price, pipeline integrity, regulatory, weather, and contractor safety. The register contains no climate transition risk, no operational technology cyber risk, and no risk related to a pending $600 million acquisition. The board risk committee has asked internal audit for assurance on the completeness of risk identification. Management says the process is established and repeatable. The CAE has one risk specialist and a five-week window before the next board meeting. The company operates 4,000 miles of pipeline and 12 compressor stations; a cyber incident at a peer company disrupted operations for six days last quarter.
1. What are the limitations of the current risk identification process, and why is repeatable not sufficient?
Read the worked answer
The process depends on a small, stable interview group and an external consultant, which limits fresh perspectives and may reinforce prior lists. Eight senior leaders are unlikely to surface operational technology cyber risk, climate transition risk, or acquisition integration risk without structured input from engineering, security, legal, and operations. The top five risks remaining unchanged for three years is a warning sign, not proof of stability, especially after a peer cyber incident and a pending acquisition. Repeatable means the process produces the same output; it does not mean the output is complete. A repeatable process can systematically omit emerging risks. The register also lacks a mechanism for external scanning, scenario analysis, or challenge from the board. Completeness assurance therefore requires testing inputs and process design, not just confirming that the annual refresh occurred.
2. Design a focused assurance approach within the five-week window to test completeness.
Read the worked answer
Internal audit should scope a targeted completeness review rather than a full ERM audit. Procedures should include comparing the register to industry and peer risk disclosures, regulatory agendas, and the company’s own incident logs; reviewing board and committee minutes for risks discussed but not registered; interviewing a cross-functional set of 10 to 12 managers beyond the usual eight, including OT security, engineering, legal, HR, and acquisition integration leads; and running a short scenario workshop on OT cyber, climate transition, and acquisition integration. Internal audit should review the acquisition due diligence risk assessment and test whether it feeds the register. Evidence should include interview notes, benchmarking, incident data, and workshop outputs. The report should disclose the limited timeframe and state that the review provides targeted assurance on completeness, not a full opinion on ERM effectiveness.
3. Draft the conclusion and recommendations if gaps are confirmed.
Read the worked answer
If the targeted work confirms gaps, internal audit should conclude that the risk identification process is not comprehensive and does not provide reasonable assurance that principal risks are identified. The report should cite the absence of OT cyber, climate transition, and acquisition risk despite clear indicators, and attribute the gaps to narrow inputs, consultant dependency, and no emerging-risk scanning. Recommendations should include broadening interview and workshop participation, adding an emerging-risk horizon-scanning process with external data, integrating acquisition risk before closing, requiring board challenge of the top-risk list, and assigning owners and refresh cycles for newly identified risks. Internal audit should recommend a follow-up review after the next refresh and should not rely on management’s repeatable label as evidence of completeness. The audit committee should receive the conclusion before the next board meeting.