Operational Risk Register

Owner: Quality & Risk (Quality & Risk Director). Layer: Operating doc (reports/; preserved by the Archivist). The org’s living inventory of operational and process risk — the risk that processes fail, are inconsistently followed, or produce substandard outputs. Maintained per SOP-086. This is the Q&R-owned register that the COO cross-cutting log feeds (reports/phase0-reviews/coo-cross-cutting-log.md:37).

Scope (operational/process only). Adjacent risk types are owned elsewhere and are not in this register: security/privacy threat (Security & Privacy — Principal until seated) · strategic / product-bet (Innovation / CPTO) · delivery on a specific project (PMO) · archive integrity sweep (Archivist). A risk that belongs elsewhere is routed, not logged here.

How to read this

Likelihood / Impact: Low / Medium / High.
Severity: the composite priority — Critical (blocking; remediate before the next gate) · High (remediate next sprint) · Medium (this quarter) · Low (opportunistic). Set per SOP-086.
Owner: the Lead accountable for the mitigation, not for logging the risk (that is Q&R). Q&R assures; the named owner remediates.
Status: Open · Mitigating · Accepted · Closed. New rows and status changes follow SOP-086. New risks surfaced to Q&R (e.g. from the COO log) are reported and logged, not silently edited away.

Risk posture (overall)

ELEVATED — one live external-compliance exposure (R-001) open into Wave 3. Two High operational risks (R-001 Slack ToS; R-003 reconciler fan-in blind spot) are open; the program-integrity risks (R-002, R-004) are mitigated by working controls (the scripted gate + the four-test sample) but not closed. No Critical open. Recompute on any new High/Critical (SOP-086 §posture).

The register

ID	Risk (the event that could occur)	Likelihood	Impact	Severity	Mitigation	Owner	Status	Source / review
R-001	Live Slack ToS compliance breach. The `app_uninstalled` deletion failure is silently swallowed (`intranet/src/pages/api/slack/events.ts:303-305`); the `channel_category`/`archived_at` migrations and the deletion-fallback job are unbuilt, so on uninstall, mirrored workspace messages may not be deleted as ADR-0017 requires — a live external-compliance exposure.	Medium	High	High	Deletion cron stays DISABLED until the migrations + fallback job ship (COO log H2 ACCEPT). Q&R confirms the cron remains disabled at each wave checkpoint; remediation in the Wave-3 Operations/Security lane.	Engineering (build) + Operations + Security (remediation owner-of-record to be named, CC-2)	Open (accepted, mitigated by disabled cron)	COO log H2 (`coo-cross-cutting-log.md:15`); ADR-0017. Review: each Wave-3 checkpoint.
R-002	Documentation theater — volume over value. 41 agents author ~200 artifacts; a doc set can read well, satisfy a checkbox, and still fail to let a stranger do the job (R1) — and every agent self-attests its own slots/DoD (R11).	Medium	High	High	Working control: the four-test stratified sample (SOP-087) + the scripted reconciliation gate (Operations) are the only sign-off proofs; Director approval is recorded but not independent. Restated canon rejected as a defect. Sample executability target ≥90% (currently 100% on Wave 1/2 samples).	Q&R (sample) + Operations (gate) + COO (program)	Mitigating	Master plan §1.3, §11 R1/R11; Wave-1/2 samples. Review: each wave + Phase 2 exit.
R-003	Headline integrity gate has a fan-in blind spot. A silently deleted fan-in producer edge does not turn the reconciler RED — a placeholder-producer sink (`scripts/handoff-reconcile.mjs:249-252`) absorbs zero producers as legitimately as many. The §10 headline GREEN can therefore hide a vanished real producer.	Medium	High	High	Compensating control needed: a CI/producer-presence assertion that every declared sink trigger has ≥1 live producer (proposed to Process Engineer, CC-1). Until then, Q&R does not defer to GREEN — the four-test interlocking trace checks named seams by hand (Wave-2 §3).	Process Engineer (reconciler fix) · Q&R (assure + compensating trace)	Open	Wave-2 sample §6 (`2026-06-01-wave2-qr-sample.md:285-287`); `interface-contract-spec.md` §3.1.1 R1. Review: when CI complement lands.
R-004	Cadence automation is a no-op (AR-003). Every scheduled control — the staleness sweep, the reconciliation re-run, and Q&R’s standing audit cadence — depends on a human remembering at the wave checkpoint; the automation that would fire them does not exist. A single forgotten checkpoint silently skips multiple controls across multiple registers.	Medium	Medium	Medium	Until AR-003 is wired, the PMO runs the manual sweep + reconciliation at each wave checkpoint and records the result in `tracker.md` (master plan §11 R6, §12); Q&R’s own cadence is manually run per `reports/audit-schedule.md`. Flag to Principal (Process Engineer) to wire AR-003.	Process Engineer (flag to Principal) · PMO (interim runner) · Q&R (own cadence)	Mitigating	Master plan §11 R6, §12; CC-3. Review: each wave checkpoint.
R-005	AI-usage ledger seam incomplete (residual). The token-count source feed crosses three units (Finance ⨉ Data & Analytics ⨉ AI Systems); the edge is registered (`usage data ready`) and the Wave-2 producers (SOP-062/065/067) now declare it into the Finance sink (SOP-028) — but the runtime feed is not yet instrumented end-to-end, so the ledger cannot yet record real AI-usage cost.	Low	Medium	Low	Producing units documented in Wave 2; edge reconciles `matched (fan-in)` (Wave-2 §3). Residual = runtime instrumentation, tracked by D&A/AI Systems delivery, not a documentation gap. Q&R confirms the seam stays interlocked.	CPTO (coordinates D&A + AI Systems) + Finance	Mitigating	COO log H4 (`coo-cross-cutting-log.md:17`); Wave-2 sample §3. Review: when runtime feed lands.
R-006	Gate green is assurance-traced, not machine-attested. Q&R’s execution environment exposes file tools but no shell, so the reconciliation/KM-index gates are logic-traced by Q&R rather than executed. A trace is weaker proof than a literal run; an undetected script regression could pass a trace.	Low	Medium	Low	Q&R discloses the limit and shows the trace every time (charter Operating rule 7); Operations/PMO paste literal stdout (incl. a RED break-test) into the wave checkpoint record to machine-attest the headline metric (Wave-1 §3, RK-3).	Operations + PMO (machine-attest) · Q&R (disclose + trace)	Mitigating	Wave-1 sample §3 (`2026-06-01-wave1-qr-sample.md:180-186`); CC-4. Review: each wave checkpoint.

Control-gap registry

Open gaps between a stated control and actual practice, with severity and the owner who must close them. Sourced from Q&R audit reports / four-test samples. Closed items are kept (struck-through status), not deleted — the record shows the gap existed.

Gap ID	Stated control	Actual gap	Severity	Owner	Status	Source
G-W1-1	Knowledge entries are falsifiable (named files/numbers that foot).	KM entry `2026-06-01-km-two-index-discipline-and-write-race.md` asserts “3 dated entries … all 3 listed”; directory holds 5 — a stale hard number inside the anti-theater program.	Medium	Documentarian	Open (route: next SOP-024 curation pass)	Wave-1 sample F-1
G-W1-2	Compound counterparties resolve to the real producer.	Reconciler resolves `hiring Unit Lead / Principal` to Principal-exempt by first-pattern-wins, masking a possible Lead seam in a later wave.	Low	Process Engineer	Open	Wave-1 sample F-2
G-W2-1	Charter/operating-model trigger tables match the canonical registry.	CPTO operating-model still labels 5 triggers `(proposed)`/angle-bracket; 3 are registered, 1 folded, 1 unregistered — the prose contradicts the registry.	Medium	CPTO	Open	Wave-2 sample M-1
G-W2-2	DR charter handoff table matches the registry.	Design Research charter labels `gate evidence ready` / `research brief issued` / `raw synthesis delivered` “(proposed) … stubs until registered”; all three are now registered.	Medium	Design Research Director	Open	Wave-2 sample M-2
G-W2-3	Agent definitions state the live stack.	`.claude/agents/engineering-director.md` says “Astro 5”; live stack is Astro 6 (`intranet/package.json`, `CLAUDE.md`). Already routed to HR (def edits are HR’s lane).	Medium	Human Resources	Open	Wave-2 sample M-3
G-W2-4	Interface-Contract blocks group Inputs then Outputs.	SOP-069 interleaves inputs/outputs (order-insensitive to the reconciler, so no gate impact — legibility only).	Low	Product Manager	Open	Wave-2 sample L-1

Note on G-2 (my own prior finding). The Wave-0/1 finding that “stratified sample” was asserted without a defined frame/size/stratification is CLOSED by the publication of SOP-087 (the four-test stratified-sample procedure). It is recorded here as closed-on-publication, not carried open.

Risks owned elsewhere (routed, not in this register)

For traceability — so a reader does not assume an omission:

Slack ToS security/privacy dimension → Security & Privacy (Principal until seated). R-001 here is the operational/compliance-process dimension only.
Strategic bet risk (which ventures to pursue) → Innovation / CPTO.
Delivery risk on a specific project plan → PMO (Q&R audits the PMO process).
Archive integrity drift → Archivist (the archive-manifest.sh sweep; Q&R audits whether it is run, not the checksums).

Maintenance

This register is maintained per SOP-086 (open / update / close / recompute posture). New risks reach Q&R via the COO cross-cutting log, an internal audit, or a four-test sample. Q&R logs and reports them; it does not author the mitigations (those route to the named owner). On every Critical/High open or escalation, Q&R notifies the Principal/COO and the affected Lead. Final register hands to the Archivist for preservation (artifact approved).

See also: docs/units/quality-risk/charter.md · SOP-085 / SOP-086 / SOP-087 · reports/audit-schedule.md · reports/phase0-reviews/coo-cross-cutting-log.md · master plan docs/documentation-program/README.md §11.