Three boards, three truths
A defence engineering firm is refitting a naval vessel under a fixed-price contract. A sole-source supplier of specialist castings has had two quality failures in 18 months. At the project board (eight months to delivery), the supplier risk is rated 15% probability, £2m impact, response 'accept and monitor'. At the programme board (three-year horizon, four vessels), the same supplier is rated a strategic threat and the board wants to fund a second source at £600k. At the corporate board (ten-year horizon, government relationships), the discussion is about reputational damage and loss of the Ministry of Defence as a customer. Each board believes its own rating is correct and accuses the others of inconsistency. The firm's risk approach defines one five-point probability scale and one impact scale in pounds, and states that risks should be 'aggregated to the top'.
1. Why do the three boards reach different conclusions about the same supplier, and is any of them wrong?
Read the worked answer
They are assessing against different objectives. The project board's objective is delivering one vessel on time and within a fixed price over eight months. For that objective, supplier failure is a cost and schedule event in a short window, and 15% may be a fair estimate. The programme board's objective is continuity across four vessels over three years; the same supplier is a strategic dependency, and the consequence includes future delivery, not just this hull. The corporate board's objective includes reputation and the long-term relationship with the Ministry of Defence, so the consequence set is different again.
Time horizon changes probability. A 15% chance of failure in an eight-month window is not inconsistent with a much higher chance over three years. The same cause produces different event probabilities depending on the exposure period.
Impact scales hide the difference. A single impact scale in pounds cannot capture reputational or contractual consequences, so the corporate board's concerns are invisible in the rating - which is why it appears to be talking about something else.
Is anyone wrong? Not necessarily. Each is answering a different question. The error is the assumption that there must be one 'true' rating, and the absence of a stated perspective on each assessment. A rating without its objective, perspective and time horizon is not comparable.
2. What should the risk approach contain so that these perspectives can be reconciled without forcing a single rating?
Read the worked answer
Define the perspectives. Name the levels at which risk is assessed (project, programme, corporate/strategic) and the objectives each serves, so that every assessment is labelled with its perspective.
Require context on every assessment. Each entry should state the objective affected, the time horizon, the consequence categories used, and the appetite it is judged against. This makes disagreement explainable rather than personal.
Keep scales consistent but multi-dimensional. Use the same probability scale everywhere so that comparisons are possible, but allow impact to be expressed in the categories that matter at that level (cost, schedule, reputation, regulatory, safety) rather than forcing everything into pounds.
Link the same cause across levels. Give the shared cause (sole-source castings) a common reference so that the project and programme entries are visibly related and aggregation is traceable rather than accidental.
Define escalation and resolution. State that a risk exceeding the lower level's appetite is escalated, and who resolves a disagreement - for example the portfolio board. Require that differing ratings be explained, not averaged.
Separate cause, event and effect. The cause is the same; the events and effects differ by level. This stops double counting and shows why the ratings legitimately differ.
3. What are the dangers of simply adding the project-level and programme-level exposures to produce a corporate figure?
Read the worked answer
It assumes independence. If the supplier fails, the current vessel and future vessels are affected at the same time. The events are correlated, so expected values cannot simply be summed; adding them treats them as separate coin tosses.
It double counts the shared cause. The project's £2m and the programme's exposure both arise from the same sole-source dependency. Adding them counts the same vulnerability twice and can overstate the total, while a naive sum can equally understate cascading effects such as contractual penalties, delay claims and loss of the customer.
It cannot carry non-financial consequences. Reputational and relationship damage are not in the pounds scale, so the corporate board's real concern disappears from the number.
It creates false precision and diffuse ownership. A single aggregated figure looks authoritative but no one owns it, and it cannot be used to choose between the £600k second source and accepting the risk.
Better practice. Aggregate by cause or dependency, use scenario and range-based analysis, present the position against each level's objectives, and give the corporate board a cross-level view of shared dependencies. The useful question is not 'what is the total exposure?' but 'which dependencies could affect more than one objective at once, and what are we doing about them?'