Risk registers and heat maps

By now Alderwick has four legal matters, each with its own chance and cost. A risk register puts them in one table, scored the same way, so that the biggest can be seen first and nothing is forgotten. It is the working tool of every compliance team, and it is often what a board actually asks to see.

A useful register row has:

• a name that says what could happen;
• a chance and an impact (from Modules 2 and 3);
• an owner, one named person;
• a fix, what it costs, and what it does to the chance (or the impact);
• the residual risk that remains after the fix.

Multiply chance by impact to get the expected loss of each risk, and sort the list. It tells you where, on average, the money is at risk. It does not tell you which risk comes first, or which would hurt most if it did happen, and a rare, severe risk can have a small expected loss but still deserve a separate look: could the client survive it?

Every fix costs something. Its net benefit is the expected loss it removes minus what it costs:

net benefit = (chance before − chance after) × impact − cost of the fix

Moving Alderwick’s payments to letters of credit cuts that risk from 30 to 10 per cent on a $50,000 impact, which removes $10,000 of expected loss for a $12,000 cost: a net loss of $2,000, so on averages alone it is not worth doing. It might still be worth doing if the client cannot bear the bad outcome, which is a different test. State which test you are applying.

A heat map puts each risk in a grid, with chance across and impact up. Red is high on both. It is quick to read, so it is popular in board papers. It also hides things:

• Two risks in the same cell can differ by a factor of three in cost.
• A risk just under a band edge looks safer than one just over it.
• The colours imply a ranking that the underlying figures may not support.

The rule: never show the map without the numbers beside it, as the lab does.

• The few largest risks, not all of them, with the figures.
• The proposed fixes, their cost, and what remains afterwards.
• What the board is asked to decide.
• The register itself, in an appendix, kept up to date. Chances and impacts change as facts and fixes change.

• Scoring risks on a 1 to 5 scale with no figures behind the scores.
• No owner, so nobody is responsible for the fix.
• Treating a fix as free, or as removing the risk entirely.
• Forgetting that a fix may create a new risk.
• Writing the register once and never updating it.