The fact that the board has started this by asking for more visibility on critical risk may in fact give you something to play with... if they are up for it! If instead going with the typical approach of defining HiPo based on the actual or potential outcome, maybe consider if you could instead define it by what went wrong... by using your critical risks / critical risk controls as the triage metrics you can capture a clearer picture of where, when and how your risk management process broke down in areas of high risk, which should also lead to better detailing of what needs/could be done to strengthen that risk management processes (both in terms of actions, and clear connectives from incident to action for the board to support).Recently our board are asking more visibility on our critical risk... — Mark Kenny-Beveridge
If you are interested in workplace health & safety in New Zealand, then this is the discussion forum for you.