A week after the budget review. Graham chairs the internal risk committee, and Aisha takes the minutes for the first time. Two items go on the risk register: the cut-off control weakness and the Ferrand rebate cliff. Every risk needs a rating, an owner and a date, and every sentence goes into the record.
Good morning. This is the risk committee, and we have two items today: the control weakness from the audit, and the Ferrand rebate. Aisha is taking the minutes.
Good morning. I sent the pre-read on Monday, so everyone should have it.
Then we'll take the papers as read. Nobody presents the pre-read back to me. We use the time for questions.
In a committee, the papers are sent before the meeting, and everyone is expected to read them. "We'll take the papers as read" means nobody repeats them aloud. The meeting is for questions and decisions, not for presenting.
First, the minutes of the last meeting. Any corrections?
One. The last minutes say the insurance renewal for the Warsaw warehouse is "under discussion". It isn't under discussion anymore. It was agreed in December. Could we record that?
Aisha, please note that as a correction. Agreed, not under discussion.
Noted. The minutes are approved with one correction.
Nadia changes two words in the old minutes. It looks small, but minutes are the official record: "under discussion" and "agreed" mean different things to anyone who reads them later, including the auditors.
Before we start, a reminder of how I'd like this to run. Short sentences. If you want something in the minutes, say "for the minutes", and Aisha will write it exactly as you say it.
And if I'm not sure what to write, I'll ask.
Good. Please do. A minute that guesses is worse than no minute.
This phrase tells the person taking notes that the next sentence should be recorded word for word. It is useful whenever an exact wording matters: a decision, a date or an owner.
Item one. Nadia.
The cut-off control. The auditors have rated it a significant deficiency. The paper proposes that we add it to the register as a risk: credit notes recorded in the wrong period.
Can I ask about the wording? It has already happened. Isn't that an issue, not a risk?
It's both. The error this year is an issue, and it's closed: we corrected it before the accounts were signed. The risk is that it happens again.
That's the right distinction. An issue is something that has happened. A risk is something that might. For the minutes: the issue is closed; the risk is open.
An issue has already happened and needs fixing. A risk might happen and needs managing. Many registers mix them up. Separating them lets the committee close what is finished and keep watching what is not.
"The issue is closed; the risk is open." Got it.
Rating. What does the paper say?
Likelihood high, impact medium. That's before any actions.
Why high?
Because it happened two years in a row. Six credit notes the year before, eleven this year. Without a control, I'd expect it again.
And why only medium for impact?
This year it was a hundred and sixty-eight thousand on profit. That's above materiality, but we found it ourselves, before the accounts were signed.
We found it because you were looking, not because a control caught it. If nobody had looked, it would be in the accounts. I'd rate the impact high.
Graham does not argue with Nadia's numbers. He challenges the reason behind her rating: finding the error depended on people, not on a control. A good challenge points at the logic, not at the person.
That's fair. High and high, then.
That's the highest rating on the register.
It's the honest rating, today. Rate the risk as it is now, not as it will be when the actions are done. That's what the second rating is for.
Risk registers usually show two ratings. The first is the risk as it is, before any new actions. The second is the risk after the actions are done. Mixing them makes a risk look smaller than it is today.
Actions. For each one I want an owner, a date, and what "done" looks like.
Three actions. First, a quarterly review of credit notes. It happens in the first week of each quarter and looks at the quarter just ended. The first one is in April.
Owner?
Aisha.
Aisha, are you happy to own it?
Yes. Could the minutes say that I own the review and Nadia signs it off? I'd like it to be clear who checks my work.
Good question. Yes. For the minutes: Aisha owns the review; Nadia signs it off.
Aisha accepts the action, then asks for one more line in the record: who reviews her work. It protects her, and it protects the control. An owner without a reviewer is the same gap the audit found.
Second, for anything above five thousand, payables now check that the document matches its label before they record it. That started last month, so that one's done.
Done means tested. Has anyone tested it?
Not yet. Fair point. Aisha can test ten of them in the April review.
Then it's in progress, not done. Write it that way.
A new control is not finished when it starts. It is finished when someone has checked that it works. Writing "in progress" instead of "done" costs nothing now and avoids an awkward question from the auditors later.
Third, the system warning for credit notes. A decision by the half-year. IT's estimate is twenty-five thousand.
That date is already in Alan's letter, so it can't move. Owner?
Me.
And the rating after the actions?
Likelihood low, impact high. The impact doesn't change. The controls only make it less likely.
Nadia explains why only one of the two scores goes down. Controls make an error less likely to happen; they don't make it cheaper when it does. Saying this out loud stops a committee from expecting too much from its actions.
Agreed. Aisha, read item one back to us.
The cut-off risk is added to the register. Before actions, high and high. After actions, low and high. Three actions. The quarterly review: owner Aisha, first in April, signed off by Nadia. The label check: in progress, tested in April. The system warning: decision by the half-year, owner Nadia.
That's exactly it. Item one is closed.
At the end of each item, the person taking minutes reads the decision back. Everyone hears the exact wording once, while they can still correct it. It takes thirty seconds and saves an email chain later.
Item two. Matteo.
The Ferrand rebate. The budget includes sixty thousand at tier two, based on four point one million of purchases. Tier two starts at four. If volume falls by three per cent, we lose all of it.
The cliff. Rating?
Likelihood medium, impact low. Sixty thousand is below materiality.
It's below materiality for the accounts. But it's more than a third of the change in this year's budget. I wouldn't call that low.
Matteo measures the impact against materiality, the auditors' scale. Nadia measures it against the budget, the scale the committee cares about. When people disagree about a rating, they are often using different scales without saying so.
Then medium. I'd rather discuss a medium risk than ignore a low one.
Medium and medium. Fine.
What tells us early if it's going wrong?
Two things. Our purchases from Ferrand at the end of each quarter, against a straight line to four million. And the customer contract review in the summer.
Who's watching the contract review? That isn't in our numbers.
Sales. I've asked them to tell me the day they hear anything, not at the end of the quarter.
Good. A warning is only useful if it reaches the owner in time. And the trigger? At what number do you tell me?
Below one million in any quarter. The first quarter is on track for one point one, so we're above it for now.
For the minutes: if purchases are below one million at any quarter-end, Matteo tells me that week.
"Keep an eye on it" is not an action. Graham asks for a trigger: a specific number that tells the owner when to act, and a deadline for telling him. A trigger turns a worry into something that can be checked.
Should I also note the order timing from the budget review? Moving an order from January into December to reach the tier?
Yes, good catch. For the minutes: any order moved between years to reach a rebate tier needs my approval in advance.
Aisha remembers a decision from a different meeting and asks if it belongs here. Taking minutes is not only writing: it means noticing what is missing. A good question from the minute-taker is a sign that she is following the logic, not just the words.
Item two. The Ferrand rebate is added to the register, medium and medium. Trigger: below one million at a quarter-end, and Matteo tells Graham that week. Any order moved between years to reach the tier is approved by Graham in advance.
Item two is closed.
Any other business?
One thing. The euro. In the budget, a five per cent move is about seventy thousand. Should it be on the register?
Nadia, what's our threshold for the register?
Fifty thousand of possible impact.
Then it's above the threshold, and it belongs on the register. But we won't rate it today without a paper. Bring it next time, properly.
Graham agrees with the point but refuses to rate a risk on the spot. Committees decide on papers that everyone has read, not on ideas raised in the last five minutes. "Bring it next time" is a yes to the topic, not a no.
I'll write the paper for the next meeting.
For the minutes: euro exposure to be added to the register at the next meeting, paper from Matteo. Aisha, when will the minutes go out?
Within two working days. A draft to you first.
A draft to me tomorrow, please. The audit committee meets next week, and they'll read these minutes before anything else in the pack.
Then the first item should say what we did, not only what we found.
Agreed. Add one line: identified by management, and corrected before the accounts were signed. It's what Alan wrote too.
These minutes will be read by people who were not in the room. Nadia makes sure the record shows what the team did, not only what went wrong, using the same words the auditor has already accepted.
I'll add it. Every sentence in there should be one we're happy to hear read aloud.
That's my line, but you're right. Thank you, all. Aisha, good minutes are invisible. Nobody notices them until they're wrong.
Then I'll try to stay invisible.
Graham praises the minutes indirectly, with a dry joke, and Aisha answers in the same tone. A short moment of humour at the end of a formal meeting is normal in British offices, and it shows the newest person is now part of the team.