MH
Governance · Operating-Model Risk Register

Structural risks in how the organization is designed.

Distinct from open tensions: these are systemic operating-model exposures — unowned accountability, concentrated authority, governance ambiguity, missing interfaces, and capability gaps.

Total risks
8
Critical
3
High
3
Trending worse
3

Likelihood × Impact

5×5 exposure heatmap.

54321
1
1
1
1
1
1
1
1
12345
← Likelihood →Impact ↑
Critical
High
Moderate
Low
Risk register
Sorted by severity
  • 20Critical
    rk-001Accountability· Risk × Trading
    No single accountable owner for limit-breach decisions
    Worsening
    Root cause
    RACI shows three plausible approvers; charter silent on breaches > $50M.
    Mitigation
    Name CRO as Accountable; codify Risk Committee as escalation only.
    Owner M. HadidL4 · I5Linked tensions 2
  • 20Critical
    rk-004Interface· Customer
    Unowned handoff: Onboarding → Activation
    Worsening
    Root cause
    Weeks 2–6 of customer lifecycle have no named accountable role.
    Mitigation
    Assign Activation Lead; define handoff contract with SLA.
    Owner K. BrennanL5 · I4Linked tensions 1
  • 16Critical
    rk-002Concentration· Engineering
    Key-person concentration in Platform Architecture
    Stable
    Root cause
    One Principal Architect holds 7 of 9 cross-domain design authorities.
    Mitigation
    Distribute authority across domain leads; introduce deputy role.
    Owner L. TanakaL4 · I4Linked tensions 1
  • 15High
    rk-003Governance· Cross-functional
    Governance forum overlap dilutes decisions
    Worsening
    Root cause
    47% topic overlap across 4 forums; same decisions re-litigated.
    Mitigation
    Consolidate to 2 forums with distinct charters and quorum rules.
    Owner L. TanakaL5 · I3Linked tensions 3
  • 12High
    rk-005Capability· Risk
    Capability gap: Quantitative Risk Modeling
    Stable
    Root cause
    Required capability scored 2/5 maturity vs. target 4/5.
    Mitigation
    Hire 2 senior quants; rotate 1 engineer for 6-month uplift.
    Owner M. HadidL3 · I4
  • 12High
    rk-007Decision Rights· Technology × Operations
    Ambiguous decision rights on API contract changes
    Stable
    Root cause
    Producer/consumer arbitration undefined; defaults to escalation.
    Mitigation
    Platform Architect named Accountable; Architecture Council Informed only.
    Owner L. TanakaL4 · I3Linked tensions 2
  • 9Moderate
    rk-006Lifecycle· Integration
    PMI pod past lifecycle sunset with no transition
    Improving
    Root cause
    Pod entered Harvest stage in Q1; no sunset/absorb plan filed.
    Mitigation
    Schedule sunset review; redistribute 11 members to receiving verticals.
    Owner S. WhitakerL3 · I3
  • 6Moderate
    rk-008Interface· Finance × All
    Shared-services dependency without SLA
    Improving
    Root cause
    9 verticals depend on Finance close cycle; no service contract.
    Mitigation
    Publish service catalog with response-time commitments.
    Owner K. BrennanL3 · I2