Risk Assessment That Scores Impact Only

Granite Peak's register does not meet Clause 6.1. ISO 37301 requires a process to identify, analyse and evaluate compliance risks, with defined criteria, and to determine and implement treatment. A 120-line register scored only on impact is a ranking of legal consequences, not a risk assessment. Likelihood, control effectiveness and risk ownership are missing, so the top-ten list cannot distinguish a remote but severe licensing breach from a frequent, moderate subcontractor bribery risk. The exclusion of near-misses and the bribery allegation because they are 'incidents, not risks' reverses the learning loop: incidents are evidence of risk and should feed the assessment. There is no treatment plan and no review trigger for a new province, even though changed legal requirements and new activities are exactly the kind of change Clause 6.1 and Clause 6.3 expect the organization to consider. The result is a register that satisfies a document request but does not support prioritisation, resource allocation or the compliance objectives required by Clause 6.2.

A lightweight process can still be defensible. Define simple scales for likelihood (rare to almost certain) and impact (negligible to severe), with written descriptions, and a risk matrix that produces priority levels. Use the obligation register as input, but assess risks by activity - for example, subcontractor procurement, public tender pricing, worker safety on site, licensing in a new province - not by quoting legal clauses. Run two-hour workshops with the project directors and procurement lead; the compliance manager facilitates and records. For each risk, capture the risk owner, existing controls, control effectiveness (weak, adequate, strong), inherent and residual rating, and treatment action with a due date. Keep it in a controlled spreadsheet with version history. Include incidents and near-misses as a standing agenda item. Review quarterly, and trigger a focused review whenever a new province, new subcontractor category or significant tender appears. Record the criteria and the rationale for ratings so an auditor can follow the logic. The absence of software is not a gap; the absence of criteria and ownership is.

The bid team's request should be refused, but with a practical alternative. Clause 6.1 requires the organization to assess compliance risks, and Clause 8.1 requires operations to be planned and controlled; a tender deadline does not suspend either. Entering a new province changes licensing, local-content, labour and anti-bribery obligations, so a focused assessment can be completed in days, not weeks: identify the specific licences and registrations required, local ownership or subcontracting rules, payment and gift practices, and any residency or environmental requirements. The output should be a short risk memo with go/no-go conditions and owners. If a risk cannot be mitigated before bid submission, the decision to accept it should be escalated to top management, documented, and reflected in the bid price or conditions. The compliance manager should not sign off a 'skip'; that would create a record of knowingly bypassing the CMS. A staged approach - rapid assessment now, full review if the bid succeeds - is defensible and keeps the tender moving.