New Zealand Enterprise Risk Register SOP Example

SOP: Enterprise Risk Register Implementation & Maintenance (NZ Context)

Document ID: TR-OPS-RISK-001
Effective Date: 2024-05-22
Version: 1.2.0
Review Cadence: Annual or upon significant infrastructure change

1. Executive Summary & Purpose

This SOP dictates the methodology for establishing and maintaining a Risk Register within the New Zealand regulatory environment (aligned with AS/NZS ISO 31000:2018). The purpose is to provide a standardized framework for identifying, evaluating, and treating organizational risks to ensure business continuity and compliance with the Health and Safety at Work Act 2015 (HSWA).

2. Scope & Prerequisites

• Scope: Applicable to all departments within Template Registry. Covers operational, financial, technical, and regulatory risk vectors.
• Software Requirements: Enterprise-grade GRC platform (e.g., Archer, LogicGate) or standardized MS Excel/SharePoint template with version control.
• Prerequisites: Completed "Contextual Risk Assessment" workshop and access to the Corporate Risk Appetite Statement.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase 1: Identification & Categorization

• Conduct a stakeholder session to define internal/external risk factors.
• Map risks against NZ-specific compliance benchmarks (e.g., Privacy Act 2020, HSWA 2015).
• Assign a unique Risk ID (e.g., RISK-2024-001) to each entry.

Phase 2: Quantitative/Qualitative Analysis

• Assign Inherent Risk score: Likelihood (1-5) x Consequence (1-5).
• Document existing controls (Preventative vs. Detective).
• Calculate Residual Risk score post-control mitigation.

Phase 3: Mitigation & Monitoring

• Assign a Risk Owner (Must be a specific individual, not a department).
• Define the "Treatment Strategy": Mitigate, Transfer, Accept, or Avoid.
• Establish a "Next Review Date" trigger based on residual risk rating.

5. Quality Assurance & Pro-Tips

Quality Metrics

• Residual Risk vs. Appetite: Any residual risk scoring >15 must trigger an immediate Executive Board review.
• Control Validation: Every control must have an associated owner who performs a quarterly audit of control effectiveness.

Julian Vance’s Pro-Tips

• The "So What?" Test: If a risk description does not clearly define the impact on business outcomes, it is too vague. Refine until the consequence is measurable in NZD or operational downtime.
• Avoid "Ghost Controls": Never list a policy as a control unless there is evidence of enforcement. Policies are not controls; enforcement is.
• Focus on Likelihood: In NZ, environmental (seismic) and supply chain (geographic isolation) risks should be explicitly documented.

6. Frequently Asked Questions

Q: How do we differentiate between an "Issue" and a "Risk"?

• A: A risk is a potential event that may happen; an issue is a risk that has already manifested. Move all manifested risks immediately to the Issue Register and transition to an Incident Response workflow.

Q: What is the recommended frequency for reviewing high-risk items?

• A: High-risk items (Score > 12) must be reviewed monthly. Medium risks (Score 6-12) quarterly. Low risks (Score < 6) biannually.

Authorized by:
Julian Vance
Chief Architect, Template Registry