Two Risk Matrices, One Board Dashboard
Meridian Logistics has grown by acquisition. Its corporate risk register uses a 5x5 matrix in which likelihood 3 means 'expected roughly once in three years'; the port-operations unit acquired 14 months ago still uses a 4x4 matrix in which likelihood 3 means 'expected more than once a year'. Both registers feed a single board dashboard. Ransomware against the warehouse management system scores 9 under the corporate matrix and 8 under the port matrix, so the board treats the two as equivalent and asks for one decision. The board's stated acceptance threshold is 'score of 12 or below'. An internal review finds 43 of 110 open entries above 12; none has a treatment plan, and every entry names the IT Security Manager as risk owner. The CISO must present a remediation plan to the audit committee in three weeks, and the CIO has frozen new security spending until the register is defensible.
1. The board dashboard presents the two scores as equivalent. Explain what is actually wrong with that, and what the CISO should do about the scoring method before any treatment decisions are made.
Read the worked answer
What is wrong
- The two matrices define the same number differently. Likelihood 3 in one unit means roughly once in three years; in the other it means more than once a year. The scores measure different things, so a 9 and an 8 cannot be ranked, added or averaged into one board view.
- Composite scores from ordinal scales are not cardinal quantities. A 9 is not 'one unit worse' than an 8, and 3x3 is not 'twice as bad' as 3x2. Aggregating them into a league table invites false precision.
- Scope and threat catalogues also differ between units, so even entries scored on the same matrix may not be comparable.
What to do
- Define one enterprise risk criteria set, as required by the risk assessment clause of ISO/IEC 27001: consistent criteria, applied consistently, producing comparable results.
- Anchor likelihood bands to explicit frequency and a defined time horizon, and impact bands to monetary loss, regulatory exposure and service disruption thresholds that the board already understands.
- Re-score all 110 entries against the new criteria in a calibration workshop with both units, using 8-10 anchor scenarios to keep assessors aligned. Do not rescale the old numbers arithmetically; the old numbers carry no information.
- Present the register to the audit committee as 'in re-baselining', with the new method, the calibration evidence and a completion date. Defending incomparable numbers is worse than admitting the methodology is being rebuilt.
Why it matters
Every downstream decision - budget, treatment priority, acceptance - inherits the error. Fixing the scale is cheaper and faster than fixing the consequences of a register nobody can defend.
2. Every entry names the IT Security Manager as risk owner. Is that acceptable? Explain who should own these risks and what the consequences of the current practice are.
Read the worked answer
No, it is not acceptable in substance.
A risk owner is the person or entity with accountability and authority to manage a risk. Two elements matter: accountability and authority. The IT Security Manager has neither for warehouse operations, claims processing or capital expenditure.
Consequences of the current practice
- Nobody is actually accountable. When treatment stalls, there is no one whose performance is affected.
- Acceptance becomes implicit drift. The security manager cannot accept residual business risk on behalf of the business, so an unowned risk silently becomes an accepted risk with no informed decision behind it.
- Investment is deflected. A security manager requests budget for someone else's risk and loses the argument to operational priorities.
- Audit finding. Assessors will ask for evidence that risk owners were identified and that acceptance was authorised; a single name repeated across the register demonstrates neither.
Who should own them
Name the person accountable for the business process or asset that carries the risk - the operations director for the warehouse system, the claims director for the claims platform - with the security function acting as assessor, adviser and challenger. The security manager can legitimately own security-function risks such as detection coverage or tooling obsolescence. For the port unit, ownership must be re-established against the post-merger structure rather than inherited from the acquired entity.
Where a business owner declines treatment, record that decision with rationale, residual risk, compensating controls and a review date, and have it signed at a level with the authority to bear the loss.
3. 43 of 110 entries sit above the acceptance threshold with no treatment plan. What is the defensible way to clear that backlog, and what must be documented?
Read the worked answer
Sequence
- Re-score first. Under corrected criteria some entries will fall below 12 and some will rise. Re-scoring before planning stops effort being spent on entries that were never significant.
- Triage what remains by genuine exposure - data sensitivity, threat realism, existing compensating controls - not by list position or by whoever complained loudest.
- For each residual entry, have the correct business risk owner choose one of the four treatment options: modify, retain, avoid, share. Each option needs a rationale.
- Group entries by shared treatment. One MFA or one segmentation programme may close fifteen entries, which is how a frozen budget still buys progress. Take the top five to the board and say plainly which ones you are asking them to accept.
What must be documented for each entry
- Risk description, asset and process affected, and the assessment against the agreed criteria.
- Named risk owner with the authority to accept.
- Chosen treatment option and why the alternatives were rejected.
- Controls to be applied, mapped to ISO/IEC 27002 control references, with owner and due date.
- Residual risk after treatment, and its formal acceptance by the owner with a review date.
- Where treatment is deferred, the compensating controls in place until then.
A point the exam likes
Retaining a risk is legitimate. Retaining it by default, with no decision, no date and no signature, is not - that is the absence of a process, not a treatment option. The spending freeze is itself a risk decision that belongs in the register, with the risks the freeze creates recorded and accepted.