The register that never changes
A water utility is 14 months into a 22-month, £9.2m programme to replace its 20-year-old customer billing platform. The risk register holds 74 risks. At the monthly 90-minute risk review, the programme manager walks the top 20 by score and the rest are 'carried forward'. Sixty per cent of all risks are rated high, and 48 of the 74 have a response of 'monitor'. Risk owners are delivery leads who have no budget or scheduling authority; when asked to act, they say they are waiting for the programme board. Three risks materialised as issues last quarter - a data-migration delay, the loss of two supplier engineers, and a late regulatory sign-off - and each was added to the register only after it had happened. The organisation's risk approach requires full reassessment annually and defines no triggers or escalation thresholds. The audit committee has asked why the register is 'all red and no different' from six months ago.
1. Using the MoR risk management process, diagnose which steps are weakest in this programme. For each weak step, cite the evidence in the case and explain why it matters.
Read the worked answer
Process frame. MoR's process runs identify → assess → plan → implement, surrounded by embed and review. The case gives evidence against at least four steps.
Identify is reactive, not proactive. Three risks were added only after they had happened. That means no horizon scanning, no defined trigger events, no discipline of asking 'what could affect this milestone?'. The register records history rather than uncertainty.
Assess is not calibrated. 60% of 74 risks are 'high' and the profile has not moved in six months. With one annual reassessment and no triggers, ratings are set once and never challenged. A scale on which most things are high cannot discriminate, so it cannot support prioritisation or appetite decisions.
Plan is not producing responses. 48 of 74 responses are 'monitor'. Monitoring is not a response; it is the absence of one. There is no evidence of explicit avoid/reduce/transfer/accept decisions, contingency, or fallback positions.
Implement cannot work. Owners are delivery leads without budget or schedule authority, and no escalation thresholds exist. Even a good response could not be executed, and there is no action tracking.
Review is reporting, not decision-making. The meeting walks the top 20 by score. That is a data review; no decisions are recorded. The audit committee's observation is the symptom of a process that is not being used to change plans.
2. The programme director proposes keeping the three materialised risks on the register as 'high' until they are closed. Evaluate this proposal.
Read the worked answer
A risk that has occurred is no longer a risk. MoR distinguishes risk (an uncertain future event that would affect objectives) from an issue (something that has happened and must now be managed). Once probability becomes 100%, the item belongs in an issue log with an owner and a resolution plan, not on the risk register.
Why keeping it as 'high' is harmful. It inflates the register, distorts the risk profile reported upward, and hides the genuine forward-looking risks that the programme should be managing. It also confuses the audit committee: a register that contains certainties cannot be used to compare uncertainty or to set appetite.
What should happen instead. Transfer each item to an issue log and manage it through issue resolution. Then ask what new uncertainty the issue creates - for example, the data-migration delay may create a risk of parallel-running costs or delayed cutover; the regulatory sign-off delay may create a risk to a fixed go-live date. Those secondary risks are legitimately register items and should be assessed and owned. Link them to the issue for traceability, and feed the event into lessons learned for the identify step.
The underlying gap. If the organisation's approach has no risk/issue distinction, that is a defect in the approach, not just in this programme's behaviour.
3. Recommend three specific changes that would turn the monthly review into a decision-making forum rather than a reporting ritual. Explain the reasoning behind each.
Read the worked answer
1. Replace the 'top 20 by score' agenda with a decision agenda. Only bring risks where a decision is needed: a response to approve, an appetite breach, a rating change, an escalation, or a closure. Reasoning: the current meeting rewards data recitation and gives no time to the risks where action is genuinely contested. A decision agenda forces owners to arrive with options and costs, and produces a record of what changed.
2. Give owners authority or move ownership up. Either delegate budget and schedule authority to the delivery leads, or reassign ownership to someone who has it, and define explicit escalation thresholds (for example, any risk above a financial threshold, or any risk affecting the regulatory milestone). Reasoning: 48 'monitor' responses are a rational response from people who cannot act. Changing the wording of responses without changing authority will not help.
3. Move from annual reassessment to event-driven reassessment. Reassess at stage gates and on defined triggers such as supplier change, regulatory change or milestone slip, using a calibrated scale with clearly defined levels. Reasoning: static assessment is why the register looks identical every six months. Add a quality rule that every 'high' risk must have a named response with an action, a date and an owner, and measure whether the register changed any decision.