Northgate Health: Funding the Right Response With Fourteen Weeks Left

Quantify both risks first. R-01 expected value is 0.25 × £800,000 = £200,000. R-02 expected value is 0.40 × £300,000 = £120,000; total exposure £320,000, against £150,000 of contingency and no prospect of more.

Test R-02's response. Cross-training costs £45,000 and leaves 0.10 × £300,000 = £30,000 of expected loss, so the post-response exposure is £75,000 against £120,000 - a net benefit of £45,000. On expected value alone it looks fundable. The next task shows why it is not deliverable in the time available.

Test R-01's response. The validation tool costs £120,000 and reduces expected loss from £200,000 to 0.05 × £800,000 = £40,000, a gross benefit of £160,000 and a net benefit of £40,000. Modest - but expected value is the wrong sole test here. The £800,000 impact is more than five times the remaining contingency, and it triggers a regulatory notification affecting 1.8 million records. A loss of that size is not absorbable within the programme; it would escalate to board and regulator. That tail, and the reputational consequence, justify buying protection that is only marginally positive on expected value.

Allocation. Fund the tool at £120,000. Hold the remaining £30,000 for exit management with the departing engineer - paid documentation sprints, parallel shadowing and a handover payment - rather than the £45,000 cross-training, which cannot complete. Before committing, spend a small sum (within the £30,000) sampling 500 legacy records to test the 25% assumption; if the sample shows materially higher corruption rates, the case for the tool strengthens and the board should be told the original figure was unevidenced.

The arithmetic is not the problem - feasibility is. Three tests show the plan fails.

Proximity. The engineer leaves in six weeks; the response needs ten. Proximity measures how soon a risk may materialise relative to how long the response takes to become effective. Here the response lands four weeks after the event it is meant to prevent, so its modelled 10% residual likelihood is fictional. A response that cannot be delivered before the risk window opens is not a response at all.

Probability of the mitigating action succeeding. Cross-training presumes a willing, available engineer for ten weeks. Someone serving notice has other priorities and, depending on contract, may be unavailable for the final weeks. The 10% figure assumes a successful transfer; it does not model partial transfer.

The response treats a symptom. The underlying risk is single-point knowledge concentration. Cross-training is the durable answer but not within this window.

What replaces it. Split into immediate and structural responses. Immediately: negotiate a short extension or a paid handover arrangement, and use it for documentation sprints recorded and reviewed daily, plus pairing a second engineer on live schema work so knowledge transfers by doing rather than by course. Identify any contractor in the market with legacy-schema experience as a contingency hire, priced now. Structurally: remove the single point of failure before the next migration by making schema knowledge a documented asset with a named secondary holder.

Report R-02 to the board with a revised residual likelihood reflecting partial transfer - not the 10% from the original plan - so the reported position is honest rather than optimistic.

Secondary risks are new risks created by the response itself.

From the validation tool: a dependency on a vendor product with its own support lifecycle, and the risk that teams treat 'validated' as 'correct' and reduce manual checking of transformation logic. There is also an implementation risk - £120,000 spent and the tool not integrated before cut-over, leaving both the cost and the original exposure.

From the exit-management spend: the departing engineer may accept payment but disengage, so the handover delivers documents of low value; or the shadowing pulls a second engineer off critical-path work in the final weeks, delaying the migration.

From the sampling exercise: a sample that comes back clean may create false comfort if the sample was not random or was drawn from the simplest tables.

Residual risks are what remains after the response. R-01 retains a 5% likelihood of £800,000 with a hard regulatory consequence. R-02 retains a materially higher likelihood than 10% because transfer will be partial.

Recording and monitoring. Enter each secondary risk as its own register line with its own owner, not as a footnote to the parent risk - a secondary risk that is not separately owned will not be managed. For R-01, monitor tool integration milestones weekly and define a go/no-go checkpoint at week 10, with a documented fallback to phased cut-over if integration slips. For R-02, monitor handover deliverables weekly against a checklist and track whether the secondary engineer can independently complete a schema change.

Finally, report R-01 and R-02 together to the board with post-response exposure, so the £150,000 is visibly matched to the exposures it reduces.