The Register Where Everything Is Medium

A 78% concentration in one band means the scale has stopped discriminating. Three mechanisms usually produce this. Assessors are calibrated differently or not at all, so one owner's 'medium' is another's 'high'. The scale anchors are undefined - 'medium impact' means nothing until it is expressed in money, regulatory consequence, customer harm or downtime. And entries typically mix inherent and residual scoring without evidence of control effectiveness, so a risk with a mature control and one with no control score identically.

The practical consequence is that the register cannot rank, so it cannot allocate budget, so executives make decisions from anecdotes and the loudest voice. Audit's criticism is fair.

A replacement approach should be layered rather than uniformly sophisticated:

• Define anchors numerically. Impact bands in currency and in regulatory terms (for example, reportable breach, licence condition, outage beyond a defined duration); likelihood bands in expected frequency per year. Publish them and require assessors to cite which anchor applies.
• Separate inherent and residual. Residual scores require a stated control and an evidence reference; a control that has never been tested does not reduce the score.
• Calibrate in facilitated sessions. Asset owners score in workshops against worked examples, and the security function challenges outliers. Calibration is the single highest-yield change and costs no licences.
• Force differentiation. Rank, don't just rate: require a top-20 list by explicit criteria and refuse ties. A register where half the entries cannot be ordered is not being used.
• Analyse the top 15-20 quantitatively using scenario or loss-distribution methods, so the capital plan can compare security investment with expected loss. The long tail can stay qualitative.
• Attach accountability. Every entry above the appetite threshold gets a named business owner, a treatment decision (mitigate, transfer, avoid, accept), a date, and a residual figure the owner has signed.

The phishing case illustrates the payoff. Scored as likelihood-times-impact it is medium; assessed with control evidence it reveals a disabled mail rule and a two-year training gap, which is a specific, fundable defect rather than a colour on a grid.

Likelihood and impact describe steady-state expected loss. They systematically under-rank risks that are fast, hard to see, or correlated, which is precisely the class that produces the incidents boards remember. Additional criteria:

• Velocity: how quickly harm materialises once the event starts. Ransomware or credential takeover moves in hours; a slow policy drift moves over years. High velocity demands readiness investment regardless of annualised likelihood.
• Detectability: whether existing monitoring would notice. A control gap you cannot see is worse than one you can.
• Control maturity and evidence: has the relevant control been tested in the last 12 months?
• Threat activity and targeting: whether the technique is currently common against this sector, informed by threat intelligence rather than assumption.
• Aggregation and correlation: whether the risk shares a dependency with others - one core vendor, one identity provider, one network path. Concentration is a risk in itself.
• Regulatory and reputational sensitivity: some events are low-cost to fix but disproportionate in consequence once notified.
• Trajectory: whether exposure is increasing, for example through migration or acquisition.

Under these criteria the phishing event ranks far higher than its likely 'medium' score. Velocity is high - compromise to fraudulent payment can be minutes. Detectability was poor until the SOC's behavioural rule fired, and the mail control that would have helped had been silently disabled, which is a change-management failure. The event also reveals aggregation: the same identity estate gives access to the treasury function and to the branch network. As a register entry it should be restated as 'credential compromise leading to unauthorised payment instruction' with a financial impact band, not as 'phishing'.

Present the result as a ranked table with the criteria shown, so the board can see why a low-likelihood, high-velocity item sits above a high-likelihood nuisance item. Include, alongside each risk, the current residual position, the proposed treatment and its cost, and the consequence of not funding it - that is what makes a top-ten list a decision document rather than a summary.

Start by making the third-party population manageable. Tier vendors by inherent risk - data sensitivity, system access, transaction criticality, substitutability - and accept that only a small number merit deep annual review. A flat 'review all vendors' programme with no staff is why the 2022 reviews stopped.

For the three critical vendors, obtain the minimum evidence set now: current SOC 2 Type II with a bridge letter covering the gap since the report period, the vendor's most recent penetration test summary under NDA, their incident history for the last 12 months, and confirmation of their subprocessors. A stale report plus a bridge letter and a direct conversation is not equivalent to a fresh audit, but it is auditable and far better than nothing. Where evidence remains unavailable, document the compensating controls on your side: restricted network paths, no standing vendor accounts, session recording for vendor access, enhanced monitoring, and data minimisation at the integration.

Use the commercial lever. The core banking renewal in 14 months is the strongest instrument available: build security schedules into the negotiation - notification timelines, right to audit, subprocessor flow-down, evidence delivery obligations, exit and data-return terms, and escrow. Contract terms are cheaper to obtain than assurance effort and last longer.

Treat concentration separately from vendor assurance. A single supplier for the core platform is a business continuity exposure that no questionnaire will resolve; require an exit plan and tested data-extraction capability as part of renewal.

Finally, report what cannot be assured. A short paper to the audit committee listing the three vendors, evidence obtained, gaps, compensating controls, and a named executive accepting residual risk converts an audit finding into a governed position. That is a realistic outcome for a team with no new headcount, and it is more defensible than a partially completed review programme.