The 340-line hazard register: is this risk management?
Metro Transit Authority (MTA) has a 340-line 'corporate risk register' maintained by two ERM staff. Each line records a hazard, a likelihood score and a consequence score on a 5x5 matrix, and a treatment owner. The register has not changed materially in three years except for score adjustments. In the last year MTA missed its on-time performance target by 9%, lost two key maintenance contractors, and suffered a cyber incident that delayed payroll by four days; none of those appeared on the register before they occurred. The audit committee finding reads 'risk management ineffective' and asks the new Chief Risk Officer to add a risk appetite statement and close the finding within one quarter. The CRO has executive sponsorship from the CFO only, and business units view the register as a compliance chore.
1. Using the ISO 31000 principles, explain why adding a risk appetite statement will not close the audit finding. Name the principles being breached and the evidence in the scenario for each.
Read the worked answer
The finding is about effectiveness - whether the process changes decisions and surfaces uncertainty before it crystallises - not about missing documentation. An appetite statement is a document; the auditor's evidence base would not move.
Evidence against the principles:
- Integrated: the register runs parallel to planning, capital allocation and contract management. Proof: the contractor losses and the payroll cyber incident were never on it, so no decision it informed prevented them.
- Dynamic and iterative: three years of score adjustments while the operating environment changed (on-time performance fell 9%).
- Best available information: no leading indicators, no linkage to incident or near-miss data; scores recycle expert opinion.
- Structured and comprehensive: a hazard list is systematically incomplete because it is not built from objectives. MTA's objectives include reliability and payroll continuity; neither drives an entry.
- Customised: a generic 5x5 does not reflect transit operations.
- Inclusive: only two ERM staff and nominated owners touch it; business units are not consulted, which is why they treat it as a chore.
- Human and cultural factors: that perception is itself a risk to the framework and must be managed, not ignored.
Definitional point: risk is the effect of uncertainty on objectives, positive or negative. A hazard list captures only adverse events and cannot inform choices about objectives. Adding appetite without objective linkage produces a hollow statement that fails on the same principle as the register.
2. The CRO has only CFO sponsorship and two staff. Propose three sequenced steps to convert the register into an objective-based process, and name the principle each step serves.
Read the worked answer
Sequence matters: build credibility on decisions that already happen rather than launch a programme.
- Attach risk to live decision points (integrated; best available information). Map the recurring decisions - capital board, budget round, contractor renewals, service planning - and produce a two-page risk brief for the next occurrence of each of the top three, using data MTA already holds (on-time performance trend, contractor concentration, payroll system dependency). No new scoring, no new tooling. This gives the audit committee something it can verify: a decision that was different because of risk.
- Objective mapping with volunteer units (structured and comprehensive; inclusive). Facilitate three business units to state objectives, the uncertainties that could deflect them (threats and opportunities), existing controls, and the manager accountable for each. This establishes real risk owners and creates the content from which the enterprise register is later filtered.
- Rebuild the register as an output, not the process (dynamic; customised). Retire or archive the 340 lines; replace with the enterprise-level set plus trigger-based indicators that force review when thresholds are crossed, and recruit six to eight part-time risk champions in the units so updates come from the business.
Caveat to state to the CRO: single-sponsor support is a framework risk. Clause 5.2 leadership and commitment belongs to the governing body, not one executive. If the CFO leaves, the framework goes with them; the audit committee must be pushed to own the framework and set the appetite, or step 3 will not hold.
3. The CFO proposes buying an enterprise GRC platform to fix the problem. Evaluate the proposal.
Read the worked answer
The proposal inverts cause and effect. The weakness is process design - no objective linkage, no owners with authority, no review triggers - and a platform will simply scale a hazard list faster and give it a more professional appearance.
A tool cannot supply criteria, accountability or decision linkage; those must be designed first. Migrating 340 low-value lines into a new system would also make the register harder to retire.
A defensible position for the CRO:
- Defer purchase until the process is stable enough to specify requirements: what the board, audit committee and regulators need to see, at what frequency, with what data lineage.
- Spend the equivalent budget on facilitation capacity and one analyst, which is where the deficit actually sits (Clause 5.4.4 allocating resources).
- When the time comes, pilot in one unit and test whether the tool reduces effort for risk owners. If it increases their administrative load, it will reproduce the compliance-chore dynamic in a costlier form.
Note the risk in the proposal itself: buying software is a visible action that feels like progress and can satisfy the audit committee superficially, which is exactly the failure mode the finding describes.