Appendix F. Risk Register and Scenario Stress-test Outline

Risk register entry template (copy per risk)

• ID: ______
  
  
• Risk family: ☐ Strategic ☐ Operational ☐ Regulatory/Compliance ☐ Reputational
  
  
• Risk statement (cause → effect → mechanism): “If ______, then ______, because ______.”
  
  
• Owner (single role): ______
  
  
• Stage: ☐ Pre-launch ☐ 0–90 days ☐ Scale
  
  
• Likelihood: ☐ L ☐ M ☐ H (evidence note: ____________)
  
  
• Impact ratings:
  
  
  • Cash: ☐ L ☐ M ☐ H
    
    
  • Compliance: ☐ L ☐ M ☐ H
    
    
  • Trust: ☐ L ☐ M ☐ H
    
    
  • Timeline: ☐ L ☐ M ☐ H
    
    
• Leading indicators (metric/signal + cadence + source): ____________________
  
  
• Trigger threshold (activates response): ____________________
  
  
• Mitigations:
  
  
  • Prevent: ____________________
    
    
  • Detect: ____________________
    
    
  • Respond: ____________________
    
    
  • Recover: ____________________
    
    
• Status: ☐ Open ☐ Mitigating ☐ Contained ☐ Closed
  
  
• Trend since last review: ☐ Improving ☐ Stable ☐ Worsening
  
  
• Stop-loss link (if applicable): ____________________
  
  
• Residual risk after mitigation: ____________________
  
  

Stop-loss trigger mini-list (copy into steering agenda)

• Integrity: credible bribery/sanctions exposure or deliberate control bypass → pause and investigate immediately
  
  
• Economics: net price below floor or negative unit contribution beyond ramp window → reset scope and pricing
  
  
• Cash: DSO/working capital pushes burn beyond funded runway → freeze discretionary spend; tighten terms
  
  
• Service: repeated SLA breaches → onboarding pause until stability returns
  
  

Scenario stress-test outline (copy per shock)

• Shock event: ____________________
  
  
• Assumptions impacted (choose): cycle time / net price / DSO / approvals / capacity / FX / vendor performance
  
  
• Early warning signals: ____________________
  
  
• Modeled impact:
  
  
  • Timeline slip: ____ weeks
    
    
  • Margin or cash delta: $____
    
    
  • Service impact: ____________________
    
    
• Pre-approved response (pick one or more): scope narrow / hiring pause / onboarding freeze / vendor switch / credit tighten
  
  
• Communications plan (owners):
  
  
  • Customer message owner: ______
    
    
  • Partner message owner: ______
    
    
  • Regulator message owner: ______
    
    
• Residual risk after response: ____________________
  
  
• Exit or pivot trigger: ____________________
  
  

Closure rule: close only when the control is embedded in workflow, evidence exists, and recurrence would be detected quickly.