Two Risks, One Score: Funding Decisions at a Regional Insurer
A regional property-casualty insurer maintains a 5x5 likelihood-impact matrix and a risk register of 63 entries. Two risks both score 16. Risk A is ransomware on the policy administration platform: likelihood 4, impact 4, 14,000 policies affected, control maturity assessed 2 of 5, and the platform has no tested offline backup. Risk B is a flawed reserving model: likelihood 4, impact 4, slow onset over two quarters, control maturity 4 of 5, with independent model validation completed last year. A third entry scores 12 but represents the same vendor concentration replicated across 40 business units. The board risk appetite permits no more than three risks above the 12 threshold; the mitigation budget is $2.0 million and the CRO must recommend funding at Friday's risk committee. The CFO argues both 16-rated risks must be funded equally because the matrix treats them identically. The CISO notes Risk A has a credible 90-day path to material loss.
1. Rank Risk A, Risk B, and the aggregated vendor-concentration entry for funding. Justify the ranking using factors beyond the raw matrix score.
Read the worked answer
Start by recognizing that equal scores do not mean equal urgency. Three factors break the tie: velocity, control confidence, and aggregation.
Risk A should rank first. Its path to loss is short (90 days), the control maturity is only 2 of 5, and the absence of a tested offline backup means the primary recovery assumption is unproven. High velocity plus low control confidence raises the effective severity above the nominal 16.
The vendor-concentration entry should rank second even though it scores 12. The raw score hides correlation: the same vendor failure appears in 40 business units, so a single event could produce losses that aggregate well beyond one unit's threshold. If even a modest fraction of those units depend on the vendor for a critical process, the portfolio-level exposure may exceed the appetite threshold. Aggregation is a portfolio view, not a register view.
Risk B should rank third for immediate capital, not because it is unimportant. Independent validation last year and control maturity of 4 of 5 give higher confidence, and the slow onset provides time for monitoring and model-risk review. A lower-velocity risk can be managed with limits, validation, and KRIs while higher-velocity exposure is reduced.
The recommendation should state the ranking explicitly and note that it consumes two of the three permitted above-threshold slots only if remediation is not funded. The committee should see the reasoning, not just the order.
2. The CFO asks why the insurer cannot simply fund both 16-rated risks at the requested levels. Formulate the response and identify what evidence would change your recommendation.
Read the worked answer
The response should separate three constraints: money, execution capacity, and appetite headroom.
Money: the budget is $2.0 million, and requests likely exceed it once the vendor-concentration remediation is included. Funding both 16s at requested levels would crowd out the aggregation issue that the matrix understates.
Execution capacity: controls fail when too many Projects compete for the same engineers, change windows, and vendor management resources. A tested backup capability and a reserving-model remediation both require scarce platform and quantitative staff. Simultaneous funding can increase delivery risk.
Appetite headroom: the board permits no more than three risks above 12. If funded mitigations do not bring residual exposure below the threshold within a stated period, the CRO needs a formal acceptance or a different treatment plan. Money alone does not resolve appetite.
Evidence that would change the recommendation: a successful offline restore test for Risk A with documented recovery time, which would raise control confidence; model-validation findings showing a material reserving error, which would raise Risk B's velocity; or vendor data showing that fewer than a critical number of business units depend on the concentration, which would lower aggregation. Each piece of evidence should be tied to the factor it changes, not treated as a generic update.
3. Recommend two changes to the risk evaluation method so future committees are not misled by equal scores.
Read the worked answer
First, add a velocity dimension and a control-confidence dimension to the evaluation record. A 5x5 matrix collapses time-to-impact and assurance into a single number. A risk that can materialize in 90 days with untested controls should not be presented identically to a slow-onset risk with recent independent validation. The matrix can remain for communication, but the decision record should show velocity, control maturity, and evidence of control testing.
Second, evaluate aggregation and correlation explicitly. The register treats 40 business-unit entries as 40 separate risks; the committee needs a portfolio view that asks whether one event or one vendor could trigger many entries at once. A simple correlation flag and an aggregated exposure estimate would have surfaced the 12-rated item earlier.
A supporting change is to record the rationale for each ranking and the evidence that would move it. That makes later committee decisions auditable and prevents a future analyst from rerunning the matrix and reaching a different conclusion without explanation. The test of the method is not whether it produces a tidy number, but whether it forces the committee to confront velocity, assurance, and concentration before allocating scarce funds.