Meridian Bank: Why the Monthly Review Sees Nothing

Five distinct failures, each with its own evidence.

1. Review has become confirmation, not challenge. 62% of entries unchanged across four quarters is not stability; it is absence of review. Real risk positions move - controls slip, projects advance, incidents occur. With 237 items in a two-hour meeting, roughly 30 seconds each, the committee is physically incapable of doing more than scanning. Volume has defeated purpose.

2. Assessment is disconnected from events. Nine of fourteen incidents sat under low-rated risks or were not on the register. That is a signal that the original likelihood estimates were not grounded - probably workshop judgements never tested against loss data, near misses or audit findings. The register is not learning from what actually happens, so it cannot improve.

3. Ownership is set below authority. Owners two grades below spend authority cannot implement responses; they can only escalate. If escalation is not routine, responses stall and the register fills with risks nobody can treat.

4. Actions are not being managed. 118 open actions with 41% overdue, and the pack hides due dates, means the committee cannot see slippage. Hiding the metric does not remove the problem; it removes the chance of correcting it.

5. Reporting is designed for comfort. A pack showing scores but not movement, overdue actions, incident linkage or proximity gives a static picture. It cannot answer the question the committee is actually asked: what has changed and what needs a decision?

Underlying all five is that review is being run as an assurance ritual over a large inventory, rather than as a decision forum over a small number of live uncertainties.

Change what is reviewed. Cut the standing agenda to 15–20 top and emerging risks, selected by impact, proximity and trend rather than by score alone. The remaining register is reviewed by exception: the committee sees only items that have moved beyond a defined threshold, breached a trigger, or have an overdue action. Every item still has an owner and a review date; most are not seen in the meeting.

Change what is presented. Each agenda item gets a one-page format: what has changed since last cycle, the evidence for the current likelihood, the response and its delivery status, proximity, and a specific ask - approve, fund, accept, escalate. Items with no change and no new evidence are reported as a count, not discussed.

Build a link to events. Every incident and near miss must be mapped to a register entry or explicitly recorded as an unregistered risk, with a standing test at each meeting: which incidents this month had no risk entry, and why? That single discipline converts the register from a static list into something that learns.

Fix the action regime. Show all overdue actions with owner, days overdue and revised date. Any action overdue beyond a defined limit escalates automatically. Cap action age; an action open for two cycles without progress needs a decision, not another date.

Fix ownership. Reassign each top risk to a role with spend authority for its likely response, or give the existing owner a defined delegated limit. Otherwise the committee is asking people to manage what they cannot control.

Run a standing challenge slot. Each meeting, take one high-rated risk and ask the owner to justify the likelihood with evidence. Rotating scrutiny changes preparation behaviour across the whole register.

The argument has a kernel of truth. A risk whose controls are operating, whose environment is stable and whose position has been independently verified may legitimately not move. Reporting no change can be honest.

But it cannot be treated as assurance on its own, for three reasons. It is unfalsifiable: 'unchanged' is consistent both with effective management and with nobody looking. It is uninformative: the committee cannot tell whether the underlying conditions were tested. And here it is contradicted by outcome data - nine of fourteen incidents emerging from low-rated or unregistered risks proves the register is not tracking reality, which makes widespread no-change evidence of inattention rather than stability.

The distinction worth pressing is between no change because evidence was reviewed and no change because nothing happened. Only the first is assurance.

What to measure instead.

• Review quality: proportion of entries with evidence recorded this cycle - incidents, audit findings, control tests, external events.
• Predictive performance: incidents and near misses that map to low-rated or unregistered risks, tracked as a trend. This is the sharpest test of whether the register foresees anything.
• Movement and responsiveness: number of risks whose score or response changed following new evidence; time from trigger to reassessment.
• Action health: percentage overdue, average age, number of actions closed without evidence of completion.
• Ownership effectiveness: proportion of top risks owned at a level with authority to act.
• Proximity and trend: how many top risks are within one quarter of materialising, to check the committee is looking forward rather than backward.

Report these alongside the register, so stability must be earned rather than assumed.