Regional Freight Carrier's Register and a Flood-Prone Route
Northline Freight, a 450-employee regional logistics firm, maintains a 60-line risk register. Entries include 'pandemic', 'cyber attack', 'fuel price volatility' and 'driver shortage'. Each entry has a 1–5 likelihood and impact score, but the scales are undefined; the same score of 12 is used for a cyber incident and for depot canteen closure. All risks are owned by the health and safety manager, who also chairs the quarterly risk meeting. The board-approved risk appetite says the company is 'risk averse' but sets no thresholds or escalation rules. Risk reviews occur annually, except after incidents. Operations managers say the register is 'the risk team's document'. A new contract would route 30% of fleet through a flood-prone corridor; the register has no entry for route-level disruption. The CEO asks whether the register demonstrates ISO 31000 conformity.
1. Which fundamental principles of ISO 31000 are most clearly compromised, and why does that matter for the new contract decision?
Read the worked answer
The weakest principles are integration, customization, best available information, dynamic review and inclusive consultation.
- Integration: operations managers see the register as the risk team's document, so risk information is not embedded in route planning, procurement or contract decisions.
- Customization: a generic 1–5 scale with undefined meanings cannot distinguish a canteen closure from a cyber incident, so scores are not comparable.
- Best available information: there is no route-level assessment of flood exposure, seasonal data or supplier contingency, although a material contract is being considered.
- Dynamic: annual review is too slow for fuel, weather and contract changes.
- Inclusive: the health and safety manager owns all risks and chairs the meeting; drivers, planners and finance are not involved.
For the contract decision, the register gives false comfort. A high score may be based on undefined criteria, and the flood corridor risk is absent. ISO 31000 would require the risk process to be tailored to the decision, use relevant and current information, and involve those who understand route operations. The CEO should not treat the register as evidence of conformity; it is a list, not an integrated risk management process.
2. Is the missing route-level disruption entry primarily a failure of risk identification or of establishing scope, context and criteria? Explain.
Read the worked answer
It is primarily a context failure, with identification failure as a consequence. Under ISO 31000, the process starts by defining scope, external and internal context, and risk criteria. For the new contract, the relevant scope is the route, the operating environment, seasonal flood data, customer commitments and the objectives affected - cost, delivery time, driver safety and reputation. If that context is never established, the risk workshop has no prompt to ask about route-level disruption and no criteria for deciding whether flood exposure is acceptable.
Risk identification then fails because the team is not looking at the right object. A generic register entry for 'weather' does not identify a specific corridor, trigger point or consequence. The remedy is not simply to add a line called 'flooding'. The team should define the contract's objectives and context, identify events and uncertainties linked to those objectives, and set criteria for likelihood, impact severity and acceptance. Only then can identification and analysis be meaningful.
3. How should the 'risk averse' appetite statement be changed so that it supports decisions such as the new contract?
Read the worked answer
'Risk averse' is a posture, not an operational appetite. ISO 31000 expects risk criteria to be established and used consistently. Northline should express appetite by risk category and objective, for example: maximum acceptable delivery failure rate on contracted routes; maximum uninsured loss per incident; tolerance for safety incidents (normally zero for serious harm); and limits on concentration of fleet in a single corridor during flood season.
The statement should also define who may accept which level of residual risk, what triggers escalation to the board, and what evidence is required. For the contract, the decision-makers need a threshold such as: 'No more than 10% of fleet capacity may be exposed to a single flood corridor without a documented contingency and insurance review.' If the proposed 30% exposure breaches that threshold, the decision must escalate. Appetite statements should be reviewed and linked to objectives, not left as an adjective.