Four things to know about the new UK National Risk Register
The UK Government recently published an update to the National Risk Register (NRR), the first since 2020. This is a key pillar of the UK Government Resilience Framework and seeks to provide transparency and drive improvements in “whole of society” resilience across the UK.
Most media coverage of the NRR focused on specific risks; the likelihood of disruption to energy supplies and impacts of a new pandemic made good headlines, and all organisations should consider how they would be impacted by and respond to each of the risks in the register.
More broadly though, the NRR and UK Governance Resilience Framework outline the expectation that the private sector will make a significant contribution to “whole of society” resilience in the UK. Key transferable principles from the NRR are set out below.
Key takeaways
1. Clear ownership of risks & risk management
Attempts at risk management across complex systems, such as national government, can result in paralysis. The NRR attempts to address this by identifying a Lead Department accountable for preparedness and response activity across national and local government and other relevant stakeholders. The result, in theory, is a dynamic assessment that drives activity to mitigate and respond to individual risks.
This approach should be replicated in the private sector. There is no point in a company risk register if it does not drive action to mitigate, prepare for or respond to specific risks. Making individuals or functions accountable for this by implementing a risk management framework with clear roles and responsibilities is a good place to start.
2. Proportionate planning based on plausible assumptions
Risk assessment is a blend of art and science. Detailed scenario-specific planning for each risk can identify a range of possible impacts/likelihoods but, as above, this can often be cumbersome to manage on an ongoing basis. The NRR’s prioritisation matrix addresses this by identifying a ‘reasonable worst-case scenario’ (RWCS) for each risk. This approach enables preparation to focus on the highest-priority scenarios. Best-practice crisis response operates on the principle of ‘prudent overreaction’, and applying this same logic to preparedness activity is sensible.
3. Differentiation between “chronic” and “acute” risks
A new element of the latest NRR is the distinction between ‘acute’ and ‘chronic’ risks. The NRR identifies several long-term ‘chronic’ risks – for example, climate change and risks from Artificial Intelligence – and makes clear that these risks should be managed through ongoing policy work, rather than crisis and emergency planning structures.
Any effective risk assessment needs similar clarity on the objectives and parameters. Once again, this helps to simplify the process and prevent overwhelming teams with information.
4. Communicating risk and impacts
In the NRR and Resilience Framework, the UK Government explicitly identifies the need for effective, transparent and accessible communications about risk. In particular the importance of considering vulnerable individuals and communicating to minimise harm. This reflects a similar focus in recent sector-based resilience requirements (e.g. FCA Operational Resilience PS21/3).
Effective communications planning should identify appropriate channels, communications owners and template materials for different stakeholder groups, as well as the timings of any communication cascade. Communication planning should be clear on the expected impacts of a situation and focus on informing stakeholders of specific actions that they can take to reduce the impact of the situation.
Get in touch: For support to better understand, prepare for and respond to the significant threats facing your organisation, contact FTI’s EMEA Crisis team at [email protected].
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates or its other professionals.
FTI Consulting, Inc., including its subsidiaries and affiliates, is a consulting firm and is not a certified public accounting firm or a law firm.
