Mr. Seamus McCarthy:

Exactly, so it certainly arises that organisations will have blind spots. Nearly every organisation will have things that it assumes will always work because they always have worked. Having a good risk register is more an art than a science, and keeping it up to date is a procedural matter. However, the judgments that are made as to what goes on it and what is an appropriate response are a matter that an organisation needs to grapple with. The organisation needs to update it regularly, as the Chairman said. A review once a year would probably not be adequate for a relatively large organisation. One would want perhaps a quarterly review of the register and systems in place that ensure that it is not just something that is happening at the top of an organisation but that it percolates down through the organisation such that everybody is thinking about the areas specific to their aspect of the business and what they would do if certain of those risks materialised. It is, therefore, hard to say "this is an excellent risk register" and "that is a very poor one". It is seen in the outturn.