Programme Risk Register
ASF Surveyor Training Programme — Operational Risk Management Framework
Aligned with ISQua EEA STP 4th Edition (2021) Standard 1, Criterion 1.3
ISQua EEA STP Criterion Reference
1.3 Exact criterion text (ISQua EEA STP 4th Ed., 2021): “The organisation has a risk management process that identifies, assesses and manages risks associated with the surveyor training programme.”
MET ASF maintains a formal, documented Risk Register reviewed at least annually and after any significant programme change. The Register follows a standard risk matrix methodology (likelihood × impact) consistent with ISO 31000:2018 and NHS England Risk Management guidelines.
Risk Management Methodology
ASF’s risk management process for the Surveyor Training Programme adopts the standard 5×5 likelihood-impact matrix endorsed by ISO 31000:2018 (Risk management — Guidelines). Each identified risk is assigned:
- Likelihood score (1–5): Rare → Unlikely → Possible → Likely → Almost Certain
- Impact score (1–5): Negligible → Minor → Moderate → Major → Critical
- Inherent risk score = Likelihood × Impact (range: 1–25)
- Residual risk score after application of controls
- Risk owner responsible for monitoring and control execution
- Review date — mandatory annual review; ad hoc after incidents
Programme Risk Register — Active Risks
| Risk ID | Risk Description | Category | Likelihood | Impact | Inherent Score | Controls in Place | Residual Score | Owner | Next Review |
|---|---|---|---|---|---|---|---|---|---|
| R-01 | Insufficient recruitment of qualified surveyor candidates, leading to programme under-enrolment | Strategic | 2 — Unlikely | 4 — Major | 8 — Medium | Targeted outreach partnerships with hospital professional associations; bursary scheme; annual review of eligibility criteria | 4 — Low | Programme Director | Jan 2027 |
| R-02 | Trainer unavailability (illness, resignation) disrupting scheduled training cohorts | Operational | 3 — Possible | 3 — Moderate | 9 — Medium | Minimum 2 qualified trainers per module; standby trainer list maintained; at least 4 weeks notice policy; module delivery can pivot to online format | 3 — Low | Training Coordinator | Jan 2027 |
| R-03 | Assessment tools lacking psychometric validity, leading to incorrect pass/fail decisions and ISQua non-compliance (criterion 4.7–4.9) | Quality / Compliance | 2 — Unlikely | 5 — Critical | 10 — High | Annual external psychometric review; Angoff standard-setting workshop before each new cohort; OSCEs reviewed by independent clinical panel; item bank maintained by qualified assessment specialist | 4 — Low | Assessment Lead | Jun 2027 |
| R-04 | Data breach or unauthorised access to trainee personal data (GDPR violation) | Legal / Compliance | 2 — Unlikely | 5 — Critical | 10 — High | Role-based access control (RBAC) on LMS; encrypted data at rest and in transit (TLS 1.3); quarterly GDPR compliance audit; Data Protection Officer appointed; breach notification procedure per GDPR Art. 33–34 (72-hour window) | 4 — Low | Data Protection Officer | Jun 2027 |
| R-05 | ISQua accreditation review identifies major non-conformances, risking loss of EEA STP accreditation status | Reputational / Strategic | 2 — Unlikely | 5 — Critical | 10 — High | Annual internal compliance audit against all 32 ISQua EEA STP criteria; gap-closure plan maintained and updated; ISQua Compliance Statement published and publicly accessible; self-assessment completed 6 months before external review | 2 — Low | Quality Director | Jun 2027 |
| R-06 | Inadequate competency development of trainees due to insufficient mentorship hours or mentor quality | Quality | 2 — Unlikely | 4 — Major | 8 — Medium | Minimum 10 supervised survey hours; structured mentor performance review (see Mentor & Trainer Performance Review Policy); mentor qualification criteria enforced; trainee satisfaction survey post-mentorship phase | 3 — Low | Training Coordinator | Jan 2027 |
| R-07 | Financial sustainability risk: programme revenue insufficient to cover delivery costs | Financial | 2 — Unlikely | 4 — Major | 8 — Medium | Annual programme budget review by Finance Committee; fee review linked to CPI; minimum cohort size threshold (n=6) before each cohort is confirmed; sponsorship agreements with partner organisations | 4 — Low | Finance Director | Jan 2027 |
| R-08 | Digital platform failure (LMS outage) disrupting e-learning delivery and examination scheduling | IT / Operational | 2 — Unlikely | 3 — Moderate | 6 — Low | SLA with LMS provider guaranteeing 99.5% uptime; backup examination platform (ProctorU) on standby; offline PDF module library maintained; IT incident response procedure (<4-hour recovery target) | 2 — Low | IT Manager | Jan 2027 |
| R-09 | Conflict of interest in surveyor assessments compromising assessment integrity and accreditation credibility | Ethical / Quality | 2 — Unlikely | 4 — Major | 8 — Medium | Mandatory conflict-of-interest declaration before each assignment; independent review panel for disputed decisions; ASF Code of Ethics; annual ethics training module for all surveyors | 3 — Low | Ethics Officer | Jan 2027 |
| R-10 | Non-compliance with French labour law on training obligations (Plan de développement des compétences) | Legal / Compliance | 2 — Unlikely | 4 — Major | 8 — Medium | Annual legal review by external counsel; compliance with Loi n°2018-771 du 5 septembre 2018 (Plan de développement des compétences); OPCO funding declarations submitted by 31 December each year | 3 — Low | HR Director | Dec 2026 |
Risk Governance Structure
Oversight Responsibilities
- Board of Directors: Approves risk appetite statement; reviews critical (score ≥15) and high (score 10–14) risks quarterly
- Quality Director: Owns the Risk Register; coordinates annual review; escalates new high/critical risks to Board within 10 working days of identification
- Programme Director: Primary risk owner for strategic and operational programme risks; reports to Quality Director monthly
- Data Protection Officer: Sole owner of GDPR-related risks; independently reports to Board on data protection matters per GDPR Art. 38
Review Cycle
- Annual full review: Every January; completed before spring cohort launch
- Ad hoc review triggers: Any significant incident (near-miss, complaint, audit finding); organisational restructuring; new legislation; major change to programme structure
- Interim monitoring: High and critical risks reviewed at quarterly Board meetings
References & Regulatory Basis
ISO 31000:2018 — Risk management — Guidelines. International Organisation for Standardisation, Geneva. §6.4 Risk assessment process.
NHS England Risk Management Framework (2023) — Provides the 5×5 risk scoring matrix adopted as sector standard in healthcare accreditation contexts.
GDPR — Regulation (EU) 2016/679 — Art. 32 (security of processing), Art. 33–34 (breach notification), Art. 38 (DPO function). Official Journal of the EU, 4 May 2016.
Loi n°2018-771 du 5 septembre 2018 (Loi “Avenir professionnel”) — Art. L.6315-1 et seq. Code du travail — obligation de formation et Plan de développement des compétences.
HAS (Haute Autorité de Santé, 2017) — Guide d’aide à la gestion des risques dans les organisations de santé. has-sante.fr