One view of risk across many units
Every business unit faces operational risks: a key supplier failing, a process error, a system outage, a shortage of skilled staff. When each unit tracks its own risks in its own way, leaders see only fragments. One unit’s “serious” may be another’s “minor”, and the same underlying problem may appear in several places without anyone noticing.
A central risk function tries to fix this by collecting risks from all units into a common structure. The structure is usually called a risk register, and at organization level it is often described as one of the enterprise risk registers. The purpose is not paperwork for its own sake. It is to let decision-makers compare, prioritize and act.
This article is general information. It is not risk, legal or financial advice, and any real program should be shaped with qualified professionals.
What a risk register contains
A register is essentially a structured list. For each risk, entries commonly include:
- a short, plain description of what could go wrong and why
- the unit or process affected
- an assessment of how likely it is and how much it would matter
- existing controls that reduce it
- a named owner responsible for monitoring it
- planned actions and a date for the next review
The key discipline is using the same fields and the same scales everywhere. Without that, the central view is just a pile of incompatible lists.
Identifying risks
A central team rarely finds risks on its own. Most of the knowledge sits with people doing the work. Common methods include workshops with unit leaders, reviews of past incidents and near misses, conversations with process owners, and looking at the results of audits and checks. Asking “what would stop us delivering this process next month?” often surfaces more than a formal questionnaire.
The central function adds value by spotting patterns. If three units depend on the same supplier, or the same ageing system, the shared exposure is clearer from the center than from any single site.
Scoring risks
Most organizations use a simple scoring method so risks can be ranked. A typical approach rates likelihood and impact on a small scale, for example 1 to 5, and multiplies them.
As an illustration only, imagine two risks:
- Risk A, a late delivery from a supplier, is rated likelihood 4 and impact 2, giving a score of 8.
- Risk B, a failure of a shared ordering system, is rated likelihood 2 and impact 5, giving a score of 10.
Risk B ranks higher even though it is less likely, because its effect would be larger. The numbers are invented for illustration and carry no real-world meaning.
Scores are judgments, not measurements. Two reasonable people can rate the same risk differently, and a score of 10 does not mean the risk is exactly twice as serious as a 5. Scoring helps start a conversation about priorities. It should not be treated as precise.
Monitoring over time
A register that is written once and filed away loses value quickly. Risks change as the business, suppliers, technology and people change. Effective monitoring usually includes:
- regular reviews, with each owner confirming whether the risk has changed
- attention to leading and lagging indicators, such as the number of overdue maintenance tasks or the count of past incidents, which give hints about whether exposure is rising
- escalation rules that say when a unit-level risk must be raised to senior leaders
- a record of decisions, including risks that were knowingly accepted
Performance review meetings and a simple operations dashboard can carry some of this information to leadership, provided the measures are defined clearly.
Decisions about what to do
Identifying a risk is only the start. Common responses include reducing it with additional controls, transferring part of it (for example, through insurance or contract terms), avoiding the activity, or accepting it consciously. Which response is sensible depends on the cost, the organization’s tolerance and its obligations, and these are decisions for management with professional advice. Central teams support the conversation, but accountability for a risk usually stays with whoever can actually act on it.
The new risks centralization creates
Centralizing operations reduces some risks and creates others. A balanced risk view should list both.
- Concentration risk. When many units rely on one shared process, platform or supplier, a single failure can affect all of them at once. This is the familiar problem of single points of failure, and it often appears as a high-impact entry on a central register.
- Reduced local awareness. A distant team may miss warning signs that local staff would notice. If local people do not feel heard, they may stop reporting.
- Slower response. Routing every risk decision through the center can delay action on problems that need a quick local answer.
- Uniform assumptions. A single method can hide real differences between units, so an average score may mask a serious local exposure.
- Dependence on key people. A small central team holding much of the knowledge becomes a risk of its own.
Keeping the model healthy
A few habits tend to keep a central risk function useful. Keep the register short enough to be read; a long list of minor items hides the important ones. Make owners accountable but support them. Test whether the identified controls actually work, not just whether they exist. Invite challenge from the units, and review the process itself from time to time, including whether the scales still make sense.
Some organizations choose a hybrid arrangement, in which units own and manage their risks day to day and the center sets common methods, consolidates the results and watches for shared exposures. This often keeps local knowledge close to the work while still giving leaders a combined view.
No method eliminates uncertainty. A register helps an organization think and act more deliberately about risk, but it cannot predict what will happen, and the quality of its content depends on the honesty and effort of the people who contribute to it.