Correlated Risk Register¶
Document — instantiates Common-Mode Failure Analysis
Records shared exposures, affected redundant paths, severity, mitigation owner, test evidence, and residual risk acceptance.
Analyses find common-mode exposures; a Correlated Risk Register is what keeps them from being forgotten. It is the living ledger of the review — one row per correlated exposure, capturing which redundant paths that exposure couples together, how bad the joint loss would be, who owns the response, what evidence exists that the response works, and, crucially, an explicit line for the residual risk the organization has decided to accept rather than eliminate. Its defining property is that it is an accountable artifact, not an analytical one: it does not discover coupling, it records, assigns, and re-reviews it so that a shared cause found in one workshop is still owned and tracked a year later. Without it, common-mode analysis degrades into a one-time slide deck that decays the moment the meeting ends.
Example¶
A property-catastrophe insurer writes policies across many regions and product lines, and its resilience rests on the belief that these exposures are diversified — a hurricane here, a wildfire there, none of them hitting the whole book at once. The Correlated Risk Register is where that belief is made accountable. One row reads: coastal wind and inland flood both surge during a single major landfalling storm; the coupled paths are three ostensibly separate product lines; severity is a modeled aggregate loss; the owner is the accumulation manager; the evidence is a stress run; and the residual line states plainly how much correlated exposure remains after reinsurance, and who signed off on carrying it.
The register's value shows the following quarter. A new product is added, and because the register exists, the reviewer checks whether it lands in an already-crowded correlation row rather than genuinely diversifying the book. The exposure that a static "we're diversified" narrative would have missed is caught because a named person owns a row that must be re-reviewed. The document turns a comforting story about diversification into a tracked, dated, ownable accounting of correlation — the practice underwriters call accumulation control.[n1]
How it works¶
The register is a schema plus a discipline for keeping it alive:
- One row per correlated exposure. Each shared cause that couples two or more redundant paths gets its own entry, so exposures are tracked individually rather than blurred into a total.
- Capture the accountability fields. For each row: the coupled paths, the severity of the joint loss, the mitigation owner, the current status, the test or analysis evidence, and the explicitly accepted residual.
- Force the residual decision. Every high-severity row must resolve to an owned mitigation or a signed acceptance of residual risk — never an anonymous open warning.
- Re-review on a cadence and on change. Rows are revisited on schedule and whenever the system changes, so new couplings are caught and stale ones retired.
Tuning parameters¶
- Field schema — how much each row records. Richer schemas capture more but raise the upkeep cost that kills registers.
- Severity scale — qualitative bands versus quantified joint-loss estimates. Quantification sharpens prioritization but demands modeling the register itself does not perform.
- Review cadence — how often rows are revisited and by whom. Frequent review keeps the register honest but competes for scarce attention.
- Residual-acceptance authority — how senior a sign-off a residual-risk line requires. Higher authority forces real deliberation but slows closure.
- Evidence stringency — whether a "mitigated" row demands a passed independence test or accepts a plan on paper. Stricter evidence prevents paper closure but requires the tests to actually run.
When it helps, and when it misleads¶
Its strength is persistence and accountability: it converts scattered findings into named, dated, owned obligations, and it is the natural home for the one honest sentence every common-mode analysis needs — this much correlated risk remains and we have chosen to carry it. It is the antidote to findings that evaporate after the review.
Its failure mode is register theater: rows exist, owners are listed, statuses read "in progress" forever, and nothing in the real system changes — the document substitutes for the mitigation it was meant to track. A related misuse is treating a filled register as evidence of independence, when a row marked "mitigated" may rest on a plan that was never tested. The guarding discipline is to tie "mitigated" to real evidence (a passed probe, a completed diversification) and to audit whether register status ever diverges from system reality; the register is a memory aid, not a mitigation.
How it implements the components¶
correlated_exposure_register— it is this component: the structured, per-exposure record of which paths are coupled and how severely.mitigation_plan— each row carries the response, its owner, and its status, turning findings into tracked commitments.residual_common_mode_risk_statement— it forces every unresolved exposure into an explicit, signed acceptance of the remaining risk.
It stores findings but does not generate them: it does not build the shared_dependency_map (that is Credential and Infrastructure Dependency Audit), the common_failure_mode_map (that is Common-Cause FMEA), or run the independence_validation_probe whose result it records (that is Backup Independence Test).
Related¶
- Instantiates: Common-Mode Failure Analysis — this register is the accountable memory that keeps the analysis alive between reviews.
- Consumes: Common-Cause FMEA and Backup Independence Test — their findings and test evidence populate its rows.
- Sibling mechanisms: Backup Independence Test · Common-Cause FMEA · Credential and Infrastructure Dependency Audit · Diverse Vendor Review · Fault Tree with Common-Cause Branching · Supply-Chain Dependency Review · Tabletop Cascade Exercise
Editorial Notes¶
Form Classification¶
Form family: Record, Log & Register
Rationale: Correlated Risk Register operates as a durable record, ledger, register, or trace whose value depends on preserving actual state or history because it records shared exposures, affected redundant paths, severity, mitigation owner, test evidence, and residual risk acceptance.
Independent corroboration: The frozen evidence defines Correlated Risk Register as 'Records shared exposures, affected redundant paths, severity, mitigation owner, test evidence, and residual risk acceptance', so its operative form is Record, Log & Register.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Economics & Finance
Origin pattern: Single lineage
Present-day reach: Specialized
Rationale: Insurance and financial risk management cohered explicit accumulation registers for exposures that can fail together under one event or dependency.
Related originating lineages:
- Accounting & Auditing — Enterprise and audit risk registers supplied controlled ownership, scoring, and review of recorded exposures.
- Engineering & Design — Reliability and safety engineering supplied common-cause and dependency analysis for coupled failures.
- Organizational & Management Science — Portfolio governance supplied cross-owner aggregation and escalation of shared exposures.
Review resolution: Lloyd's exposure-management framework centers accumulation, aggregation, and correlated catastrophe exposure, establishing the financial-risk lineage; engineering and governance provide portable companion techniques.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
Notes¶
[n1] Accumulation control (or aggregation management) is the insurance practice of tracking how nominally separate policies concentrate into a single loss event, so that a book that looks diversified line-by-line is not secretly exposed to one catastrophe. It is the domain's name for maintaining exactly this kind of correlated-exposure ledger. ↩