A Risk Register Nobody Owns: Planning Failures at a Specialty Chemicals Manufacturer
Halden Polymer manufactures specialty coatings at three plants and ships to 22 countries. It began building an SeMS after a customer audit concluded it had 'no structured security risk process'. A cross-functional workshop produced a register of 112 entries scored on a 1-5 likelihood by 1-5 impact grid, but each plant ran its own workshop with its own interpretation of the scales, and no methodology was ever written down. The highest-scoring entry, 'unauthorised access to the OT network causing production shutdown' (score 25), was recorded as 'accepted' by the plant HSE manager with no justification, no owner and no review date. The legal register was last updated in 2021 and lists only the local fire code; it omits dangerous-goods transport rules, export-control and sanctions screening, and the customs authorisations the company depends on. The only security objective adopted is 'zero security incidents', reported quarterly to the executive committee.
1. Evaluate Halden Polymer's risk assessment process against the planning requirements of ISO 28000. What must change?
Read the worked answer
The output is a list, not a risk assessment. The standard requires a defined and documented process with criteria and methodology, applied consistently and repeatably, so that two competent teams looking at the same situation reach comparable conclusions. Halden has the opposite: three plants, three sets of scale interpretations, therefore scores that cannot be compared or aggregated.
The substantive gaps are:
- No assets or consequences. Entries are event labels, not analyses. There is no identification of what is being protected (goods, information, personnel, infrastructure, reputation) or what the consequence would be.
- No threat, vulnerability or existing-control analysis. Without this, the score cannot show whether a control is needed or already sufficient.
- No supply-chain dimension. For an exporter shipping to 22 countries, upstream and downstream dependencies (freight forwarders, customs brokers, distributors) are where much of the security risk sits.
- No ownership or review cycle. A register with no named risk owners and no planned reassessment interval will decay, which is exactly what happened after 2021.
Recommended fix: write a one-page methodology with anchored scales (defining what a 3 in impact means, in money, downtime and harm), consolidate into a single central register with owners, reassess at defined intervals and on change (new lane, new carrier, new plant system), and link each significant risk to its treatment and to a security objective. Calibrate by having the three plants rescore a common sample and comparing results.
2. Is the plant HSE manager's acceptance of the OT intrusion risk acceptable under the SeMS? Justify your answer.
Read the worked answer
No, on four separate grounds.
Authority. Risk acceptance must operate inside criteria established and approved at top-management level. Those criteria should define what score or category may be accepted, by whom, for how long and under what conditions. Unless the HSE manager has been given that delegated authority in writing, the 'acceptance' is an unauthorised decision. A score of 25 on a 5x5 grid - the maximum - is precisely the kind of risk that criteria should reserve to the executive level.
Documentation. Acceptance requires a recorded justification: why treatment is not reasonably practicable, what residual risk remains, who bears it, and when the decision will be reviewed. 'Accepted' with no owner and no date is not a decision, it is an omission.
Competence and scope. The risk is an information and operational-technology risk with production and safety consequences. An HSE manager is unlikely to hold the technical competence to judge the effectiveness of segmentation, remote-access controls or vendor management, and the risk crosses plant boundaries.
Consistency with treatment. Acceptance should follow an evaluation of treatment options, not replace it. Practical low-cost measures (network segmentation, multi-factor authentication on remote access, third-party access review) would likely reduce the score materially before acceptance is even considered.
What to do: define acceptance criteria at executive level, escalate the entry to the executive committee, document the decision and its justification, and set a review date. An auditor finding an undocumented, unauthorised acceptance of a maximum-score risk would raise a nonconformity against risk treatment, and possibly against top-management commitment.
3. Critique the security objective and the legal register, and explain how both should be reworked.
Read the worked answer
The objective. 'Zero security incidents' fails as an objective for three reasons. It is an outcome, not something the organisation can act on directly; it has no baseline, owner, timeframe or measure of progress; and it is actively harmful, because the only way to guarantee zero recorded incidents is to stop recording them. An objective that punishes reporting will produce silence, not security.
Objectives should be derived from the significant risks and from compliance obligations, and should be specific, measurable, achievable, relevant and time-bound. For Halden, examples would be: 'all 22 destination-country shipments screened against sanctions lists before booking, 100% from 1 April'; 'remote-access paths to OT segmented and inventoried at all three plants by 30 September'; 'every carrier handling dangerous goods re-verified against ADR requirements by Q4'. Each needs a named owner, a resource, a monitoring method and a review point.
The legal register. A register that lists only the fire code is not a register of applicable requirements for this organisation. It should capture legal requirements bearing on security (dangerous-goods transport, export control and sanctions, customs and authorised economic operator conditions, data protection, employment screening limits) and 'other requirements' the organisation adopts (customer security schedules, industry standards, insurer conditions).
The process matters as much as the list: identify, have access to, update when changes occur, and periodically evaluate compliance. A register updated once and forgotten is evidence that the compliance evaluation process does not exist. Both gaps - the objective and the register - will surface at certification as planning nonconformities, because they are inputs the rest of the system cannot function without.