From Workshop Discussion to a Usable Register
A risk workshop is useful only if its discussion can be carried into decisions. Participants may identify many concerns, but a register needs more than a list of topics such as “fraud,” “system issues,” or “late claims.” Each entry should explain what could happen, why it could happen, how it could affect an objective, and how the risk is assessed after existing controls.
This tutorial follows a hypothetical insurer’s claims-payment process, from objective prompts to a small prioritized register. The process is deliberately bounded: it begins when an approved claim is prepared for payment and ends when payment is confirmed and recorded. The example uses an illustrative qualitative scale; its categories and thresholds are not universal and should be agreed for the organization using them.
Set the Objective and Bound the Discussion
Start by stating the objective in operational terms. In this hypothetical case, the objective is: pay valid, approved claims accurately and within ten business days, while protecting policyholder funds and meeting applicable requirements. This gives participants a reference point. A concern belongs in the assessment when it could interfere with that objective, not merely because it is generally important.
The workshop facilitator can then ask prompts tied to the process stages. For example: What could make a payment instruction incorrect? What could prevent a valid payment from being released on time? Where might a file be altered, duplicated, or lost? Which steps depend on a third party or on information being transferred between systems? What existing checks could prevent or detect each event?
Prompts help uncover possibilities; they do not establish that a risk exists at a particular level. Participants should capture the source of each concern, such as a process walkthrough, a hypothetical scenario, or a review of incidents and near misses. If evidence is incomplete, record that limitation rather than implying certainty.
State the outcome at risk and identify the process boundaries. Avoid combining unrelated processes in one entry.
Use process steps, scenarios, handoffs, and known control points to generate specific possibilities.
Check that the event is a possible occurrence, the cause explains why it could occur, and the effect connects it to the objective.
Use the agreed horizon and scales. Consider current controls when assessing residual risk, and note important uncertainty.
Compare residual ratings, document the rationale, and assign an accountable role for the entry or any agreed action.
Write the Risk as a Causal Chain
A topic label is not a complete risk statement. “Bank details” names an area, but does not say what could happen or why it matters. The cause-event-effect structure turns a broad observation into a statement that can be assessed and assigned.
Worked Example: Turning a Workshop Prompt into Risk Statements
In a hypothetical workshop, participants review the claims-payment process and are asked, “What could make an approved payment go to the wrong destination?” They identify two possible weaknesses: bank-account changes can be entered using information received by email, and payment files can be resubmitted when their processing status is unclear. Convert these observations into risk statements and connect them to the objective.
Method. For each observation, separate the underlying condition (cause), the possible occurrence (event), and the consequence (effect). Then check that the consequence could affect the stated objective.
Risk A. Cause: bank-account changes may be entered from email instructions without independent verification. Event: a fraudulent or erroneous account change is accepted and a claim payment is misdirected. Effect: funds may be lost, the claimant may be paid late, and the organization may incur remediation or compliance costs.
The complete statement is: Because bank-account changes may be entered from unverified email instructions, a fraudulent or erroneous change could be accepted and a claim payment misdirected, causing financial loss, delayed service, and possible compliance consequences.
Risk B. Cause: staff may not have a clear confirmation of whether a submitted payment file has completed processing. Event: a file is resubmitted and a claim is paid twice. Effect: funds must be recovered or written off, and payment records may require correction.
The complete statement is: Because processing status may be unclear, a payment file could be resubmitted and a claim paid twice, causing financial loss and reconciliation work. Both statements identify possible events rather than treating “fraud” or “system issues” as events by themselves.
Check. The first statement links its cause to a particular event and then to consequences relevant to the objective. It does not assert that an event has occurred or that a specific loss is certain. A common mistake would be to write “risk of bank-detail fraud”; that omits both the vulnerability and the effect, making consistent assessment and ownership harder.
Use One Stated Rating Basis
For the worked assessment, the workshop uses an annual likelihood horizon. Likelihood categories describe estimated probability of the event within the next year. Impact is the highest relevant consequence category across financial loss, service disruption, and compliance or other material consequences. The thresholds below are hypothetical and are set for this case only.
| Rating | Annual likelihood | Illustrative impact guide |
|---|---|---|
| 1 | Less than 1% | Under $10,000; negligible service or compliance effect |
| 2 | 1% to 5% | $10,000 to under $50,000; limited effect |
| 3 | More than 5% to 20% | $50,000 to under $150,000; material but contained effect |
| 4 | More than 20% to 50% | $150,000 to under $500,000; serious effect or substantial disruption |
| 5 | More than 50% | $500,000 or more; severe effect, prolonged disruption, or major compliance consequence |
Where several impact dimensions apply, the assessor uses the highest category supported by the case, not an average that could hide a severe consequence. The workshop uses the following scoring convention: multiply the integer likelihood rating \(L\) by the integer impact rating \(I\). Scores of 1–4 are labelled low, 5–9 moderate, 10–16 high, and 17–25 severe.
This multiplication is a chosen ranking rule, not a probability or an estimate of expected dollars. It produces an index within the agreed matrix: for instance, if likelihood is rated 3 and impact is rated 4, the score is \(3\times4=12\). The rule is useful for consistent sorting because both ratings affect the result, but it does not make the category intervals equal in size or prove that a score of 12 represents twice the risk of a score of 6. Where scores tie, assessors should compare the underlying event, impact dimensions, evidence, and urgency rather than infer a precise ordering from the arithmetic alone.
Rate Controls and Residual Exposure
Worked Example: Rating a Bank-Change Risk
For the hypothetical bank-change risk, the workshop estimates an annual event probability of 30% before controls. A payment misdirection could produce a loss of $220,000 and a serious service consequence. Current controls include a supervisor review of selected changes and a daily exception report; however, the review is not independent in every case and the report is not guaranteed to identify a valid-looking change. On the basis of the workshop’s evidence and assumptions, the estimated annual probability after current controls is 12%. Estimate inherent and residual ratings.
Method. Map each stated probability to the annual likelihood scale, assign impact using the highest supported dimension, and apply the stated matrix score. Do not treat the control’s presence as proof that the risk is eliminated.
Inherent likelihood. The estimated probability is 30%. Since 30% is more than 20% and no more than 50%, \(L=4\).
Inherent impact. A possible loss of $220,000 falls in the $150,000 to under $500,000 band, so \(I=4\). The serious service consequence does not increase the rating above 4 on the stated assumptions. Thus the inherent score is \(4\times4=16\), which is high.
Residual likelihood. The stated probability after current controls is 12%. Since 12% is more than 5% and no more than 20%, the residual likelihood rating is \(L=3\).
Residual impact. The controls described review and detection; the case gives no basis to conclude that they would reduce the amount lost if a misdirection occurred. Retain \(I=4\). The residual score is \(3\times4=12\), which is high.
Check and common mistake. The score falls from 16 to 12 because the stated control effect changes the likelihood category, not the impact category. A common error is to rate the residual impact as 3 simply because controls exist, or to deduct one point from both ratings without evidence. The check is that every rating change has a stated link to a control and a plausible effect on occurrence or consequence.
The rating rationale is as important as the score. A register should preserve the probability estimate or evidence behind a category, key assumptions about exposure, the controls considered, and any material uncertainty. Qualitative categories do not imply that an assessor knows the exact probability. If evidence is limited, state that explicitly and avoid presenting the rating as a precise forecast.
Build and Prioritize the Register
A compact register turns the workshop result into an accountable record. For this case, the workshop has assessed three risks. The entries below are hypothetical; the roles and amounts are illustrative. The priority order uses residual scores, while retaining inherent ratings to show how much exposure current controls are believed to address.
Worked Example: Prioritizing a Three-Risk Register
A workshop has the following case assumptions. For the duplicate-payment risk, estimated annual probability is 12% before controls and 4% after a current file-status check; possible loss is $80,000. For a payment-interface outage, estimated annual probability is 4% both before and after current controls; possible financial impact is $600,000 before controls, while an existing manual fallback limits the assessed residual impact to $300,000. The bank-change risk has the ratings established in the previous worked calculation. Rank the entries by residual score and show the rating arithmetic.
Method. Convert each probability and impact to categories using the same annual scale. Apply \(L\times I\), then rank by residual score. Record why any residual category differs from its inherent category.
Bank-change risk. Inherent \(L=4\), \(I=4\), score \(4\times4=16\). Residual \(L=3\), \(I=4\), score \(3\times4=12\). The current reviews support a lower likelihood estimate, but not a lower loss severity.
Duplicate-payment risk. Before controls, 12% is category \(L=3\); $80,000 is category \(I=3\). Its inherent score is \(3\times3=9\), moderate. After the current status check, 4% is category \(L=2\). The stated case provides no reduction to the possible $80,000 impact, which remains \(I=3\). Its residual score is \(2\times3=6\), moderate.
Interface-outage risk. A 4% probability is category \(L=2\) both before and after controls. The possible $600,000 impact is category \(I=5\), so the inherent score is \(2\times5=10\), high. With the manual fallback, the assessed $300,000 residual impact is category \(I=4\). Its residual score is \(2\times4=8\), moderate. The case supports a lower impact, not a lower event likelihood.
Priority order. The residual scores are 12 for bank changes, 8 for interface outage, and 6 for duplicate payment. The resulting order is bank changes, interface outage, then duplicate payment. The numerical ranking is a starting point for discussion: the interface outage remains important because its potential impact is large, even though its residual score is below the bank-change score.
Check and common mistake. The inherent and residual scores are calculated from their own likelihood and impact categories. A common mistake is to use the bank-change inherent score of 16 to order residual priorities, or to reduce the interface-outage likelihood because the fallback limits consequences. Neither follows from the stated assumptions. The ranking is checked by recomputing each product: \(3\times4=12\), \(2\times4=8\), and \(2\times3=6\).
| Risk statement (short form) | Inherent \(L,I,\) score | Residual \(L,I,\) score | Illustrative owner | Residual priority |
|---|---|---|---|---|
| Unverified bank changes could misdirect claim payments, causing loss and delayed service. | 4, 4, 16 | 3, 4, 12 | Claims operations manager | 1 |
| An interface outage could delay payments and create substantial financial and service consequences. | 2, 5, 10 | 2, 4, 8 | Payment operations manager | 2 |
| Unclear file status could lead to a resubmission and duplicate claim payment. | 3, 3, 9 | 2, 3, 6 | Claims processing manager | 3 |
A useful register entry also records the objective affected, the cause-event-effect statement, the assessment rationale, current controls, material uncertainty, and any agreed action or accountable role. Keep proposed actions separate from the description of current controls; otherwise, readers may mistake an intended improvement for protection already operating.
Common Traps and Practical Checks
- Starting with a label. “Fraud,” “technology,” or “third-party risk” does not identify a particular event or objective effect. Write a causal statement that can be assessed.
- Changing the horizon mid-assessment. An annual likelihood category cannot be compared consistently with a rating based on a five-year possibility. State and use one horizon.
- Scoring controls by their existence. A written procedure does not automatically reduce likelihood or impact. Consider its relevance, design, and evidence of operation.
- Using planned actions in residual ratings. Residual means after current controls. Reassess after a planned action is implemented and its operation is supported by evidence.
- Treating matrix scores as dollars or expected loss. The score is an ordinal prioritization aid under the chosen convention, not an actuarial loss estimate.
- Hiding uncertainty. State when a rating relies on judgment, sparse incident data, or assumptions about exposure. A recorded limitation is more useful than unwarranted precision.
Check Your Understanding
Use the hypothetical likelihood and impact categories stated in this tutorial. Each question asks for a rating or a concise risk-register judgment.
- A payment-file error has an estimated annual probability of 18% before controls and could cause a $120,000 loss. Current validation reduces the estimated probability to 3%, but does not change the possible loss. Find the inherent and residual scores. (Answer: Inherent \(L=3\), \(I=3\), score 9; residual \(L=2\), \(I=3\), score 6.)
- A data-transfer fault is estimated to have a 2% annual probability. Its possible loss is $40,000, but the same event could delay 80 claimants for four business days. If the workshop assesses that service consequence as category 3, what impact rating should be recorded? (Answer: \(I=3\), the highest supported dimension; the $40,000 financial amount alone is category 2.)
- A control is planned but has not yet been implemented. A risk currently has \(L=4\) and \(I=3\), and the planned control is expected to reduce likelihood to category 2. What is the current residual score, and what score could be considered only after implementation if the expected effect is confirmed? (Answer: Current residual score \(4\times3=12\); after implementation and confirmation, the illustrative score would be \(2\times3=6\).)
- Two residual risks both score 8. Risk A is \(L=2,I=4\); Risk B is \(L=4,I=2\). Is either automatically the higher priority under the stated multiplication rule, and what should the workshop compare next? (Answer: Neither; both score 8. Compare the event, impact dimensions, evidence, uncertainty, and urgency before choosing an order.)
- A hypothetical outage has a 4% annual probability and a possible $700,000 loss before controls. A tested manual fallback is assessed to limit the residual loss to $450,000, without changing event probability. Calculate both scores and explain which rating changes. (Answer: Inherent \(L=2,I=5\), score 10; residual \(L=2,I=4\), score 8. Impact changes; likelihood does not.)