Halden Logistics: risk appetite after a subsidiary cyber incident
Halden Logistics is a family-owned group with 900 employees and €310 million revenue. Eighteen months ago it acquired Brenner Freight, a smaller forwarder, and left Brenner's systems and board untouched. Brenner never appeared on the group risk register. Last month ransomware at Brenner stopped invoicing and customs filings for five days; the group lost €2.3 million in cash and missed two customer service-level commitments. The group board had approved a risk appetite statement saying it had 'low tolerance for operational disruption'. The board paper on the incident, prepared by the group CFO, says the incident was 'contained and not material'. The chief risk officer has resigned, citing lack of authority. The audit committee meets quarterly and has 40 minutes for risk. A non-executive director asks whether the group's risk appetite was ever meaningful. The family shareholder wants no external scrutiny and says the incident is 'an IT problem'.
1. Assess whether Halden's risk appetite statement was operable and whether the board's oversight of acquisition risk was adequate.
Read the worked answer
Risk appetite. 'Low tolerance for operational disruption' is a sentiment, not an operable appetite. It does not define which operations, what level of disruption, over what period, or who decides when tolerance is breached. There are no metrics, thresholds, escalation rules or owners. It cannot guide a decision on a five-day invoicing outage or tell the board whether €2.3 million is material. ISO 37000 expects the governing body to set risk appetite and integrate risk oversight into governance; an aspirational phrase does not meet that expectation.
Acquisition oversight. Leaving Brenner's systems and board untouched for 18 months, without adding it to the group risk register, is a clear oversight gap. Acquisition risk includes integration risk, cyber risk, compliance risk and key-person risk. The board should have required a post-acquisition integration plan, a risk assessment and regular reporting. The absence of Brenner from the risk register means the board could not see the exposure it had acquired.
Conclusion. The appetite was not operable and the oversight was inadequate. The non-executive director's question is well founded. The incident is not simply an IT failure; it exposed a governance gap between the board's stated tolerance and the information and controls it had in place.
2. What decision rights and escalation thresholds should the board establish for cyber and operational risk, and why?
Read the worked answer
Decision rights. The board should retain approval of the group risk appetite, the risk taxonomy, material acquisitions and any risk acceptance above a defined threshold. The audit or risk committee should oversee the risk framework and receive escalation. The chief risk officer should have direct access to the board, a group-wide mandate covering subsidiaries, and authority to require remediation. Business unit leaders should own risks within their units, with subsidiary boards accountable for local controls and reporting.
Escalation thresholds. Define thresholds in advance: any incident with a cash impact above €250,000; any outage affecting customer invoicing or customs filings for more than four hours; any regulatory notification; any data breach involving personal data; any ransomware affecting a critical system; and any incident likely to breach a customer service-level commitment. These should trigger notification to the group CRO and CFO within 24 hours and to the board risk committee within 48 hours. A materiality definition should combine financial, operational, legal and reputational factors, not just cash.
Why. Without thresholds, management decides what the board hears, and 'contained' becomes a judgement made by the same people responsible for the failure. Clear decision rights also prevent the CRO from being bypassed. The thresholds should be tested annually with a tabletop exercise and reviewed after every major incident. The board should minute its risk appetite and the thresholds so that accountability is visible.
3. Was this a governance failure? Recommend the board's response, including how to handle the CRO vacancy and the family shareholder's wish for no external scrutiny.
Read the worked answer
Was it a governance failure? Yes, at least in part. The board approved an inoperable appetite, failed to bring an acquired business into group risk oversight, and received a board paper that framed a €2.3 million incident as 'not material' without evidence. Those are governance failures, even if the ransomware itself was an operational event. The CRO's resignation citing lack of authority is a serious indicator that the risk function could not operate effectively.
Response. Commission an independent review of the incident and the acquisition integration, reporting to the board or its audit committee, not to the CFO alone. Correct the risk register and risk taxonomy immediately. Require a remediation plan with owners and dates. Review the board paper's materiality judgement and the information flow to the board. Consider whether customers, insurers and regulators need notification. Document the board's decisions.
CRO vacancy. Appoint an interim CRO with a direct reporting line to the board risk committee and a clear mandate across subsidiaries. Do not leave the role vacant or downgrade it. The board should approve the job specification and ensure the permanent appointee has group-wide authority.
Family shareholder. The desire for no external scrutiny cannot override the board's duties to customers, regulators and lenders. External review is proportionate after a material incident and is likely to be required by insurers or regulators. The board should explain that scrutiny protects the family's long-term value by restoring customer trust and reducing regulatory risk. The incident should not be dismissed as 'an IT problem'; it is a risk governance problem with an IT manifestation.