Harlow Foods Group: A Framework Assembled by Merger

The tool reproduces whatever logic is fed into it. Buying first locks in three incompatible scales, undefined colours and duplicated entries, and then makes them expensive to change because everything has to be migrated. The sequence should be: approach, then common language, then ownership, then appetite, then tooling.

1. Agree the approach and its scope (weeks 1–4). A short risk management policy that states why the group manages risk, which decisions the framework must support, the roles involved and the reporting line. Without this, the next four steps have no authority and no acceptance criteria.

2. Common scales and taxonomy (weeks 3–8). One impact scale with defined bands in money, safety, regulatory and reputation terms, plus descriptors for likelihood. A small risk taxonomy - perhaps ten categories - so that nine cold-chain entries collapse into one risk with one owner and one response. Define what a risk statement looks like, so entries read as cause–event–effect rather than as nouns.

3. Ownership (weeks 6–10). Reassign risk owners to the person who can actually direct the response and authorise spend in that domain - cold-chain to supply chain, not to finance.

4. Appetite made operational (weeks 8–12). Convert the six lines into category thresholds that a site manager can apply.

5. Only then the tool, configured against the agreed scales, with the merged register loaded once.

The heat map can be produced at week 10 from a cleaned register. Delivering it from the current data would put a polished picture of an incoherent position in front of the board - worse than a two-week delay.

Why it is a defect. Ownership implies authority: the owner is accountable for ensuring the risk is assessed, a response is chosen, the response is implemented and the position is reported. A finance director cannot direct cold-chain logistics, cannot instruct a factory manager on allergen controls and cannot authorise a maintenance shut-down. What will actually happen is that the finance director signs off scores prepared by others, becomes a bottleneck for 60 items, and the real decision-makers never see the risk as theirs. The register stays someone else's paperwork - which is precisely how registers become stale.

There is a second, subtler problem: concentrating ownership in one function biases the assessment. Financial impacts will be quantified carefully and safety or regulatory impacts will be estimated roughly, because the owner's frame of reference is financial.

How ownership should be decided. Start from the response, not the org chart. Ask: who can authorise the action that would change this risk, and who bears the consequence if it occurs? That person, at a level senior enough to commit resources, owns it. A cold-chain failure belongs to the operations director; a funding covenant risk to the finance director; a product labelling risk to technical or quality.

Support this with a written matrix mapping risk categories to owning roles, so assignment is not renegotiated each cycle. Separate the risk owner from the risk action owner, who may be more junior and does the work. Cap ownership at a realistic number of items per person - eight to twelve is often the practical ceiling for meaningful engagement - and confirm each assignment in writing.

Why the current statement fails. It contains no category, no threshold and no decision rule. A site manager facing a supplier-switching decision cannot deduce anything from it, so it will be ignored - which the last eight months have already demonstrated.

Building usable guidance. Work category by category, and for each state: the objective being pursued, the level of risk acceptable in pursuit of it, the threshold at which escalation is mandatory, and who may accept risk below that threshold.

For example: Supply continuity - the group will accept single-source supply only where a qualified second source exists or where a documented contingency covers 90 days of demand; any single-source category representing more than 15% of input spend by value requires board approval. Product safety and labelling - no tolerance; any credible pathway to mislabelling is escalated to the technical director within 24 hours regardless of estimated likelihood. Capital projects - expected risk-adjusted return must exceed the cost of capital by a stated margin, with downside tested against a defined stress case.

Note that appetite can differ by category: 'conservative' overall is compatible with taking genuine risk in a category where the group has expertise and can absorb loss.

Testing whether it is used. Three practical tests. First, decision audit: sample ten recent decisions and check whether the appetite statement was cited and whether the outcome was consistent with the stated threshold. Second, escalation evidence: are the defined escalations actually happening, and at the right level? A framework with no escalations in a year is either perfect or unused. Third, owner interviews: ask three risk owners what they would need to escalate and who signs off; if answers diverge, the guidance has not landed. Review the statement annually against these findings.