Yusef is a new procurement manager at FRD Incorporated. He is looking through the Risk Assessments for his department and notices that the cause of the risk is not identified. Why might this be?

The most probable reason for omitting the cause of a risk is rooted in organisational culture. In an organisation that fosters a 'no-blame' or 'just' culture, the primary focus of risk management is on identifying, analysing, and mitigating the risk itself, rather than assigning fault to an individual or department. Explicitly identifying a 'cause' can lead to finger-pointing and a fear of reprisal, which discourages the open and honest reporting of risks. By omitting this field, the organisation encourages a more proactive and collaborative approach to managing risk, focusing on systemic improvements rather than individual blame.

A. this is a mistake - all risk assessments should specify the cause of the risk. He should raise this with his manager: This is a prescriptive statement. While identifying the cause is best practice, its omission could be a deliberate cultural choice, not necessarily a mistake.
B. the organisation has a high risk appetite: Risk appetite relates to the amount of risk an organisation is willing to accept in pursuit of its objectives, not the methodology used for documenting risks.
D. the organisation has completed the risk assessments incorrectly: Similar to option A, this assumes there is only one correct way to complete a risk assessment. The format can be adapted to suit the organisation's culture and objectives.

1. Chartered Institute of Procurement & Supply (CIPS). (2018). Managing Supply Chain Risk (L5M2). Profex Publishing.

The official CIPS study guide for L5M2 discusses the importance of organisational culture in risk management. It contrasts a 'blame culture' with a 'just culture' where learning from failures is prioritised over punishing individuals. The deliberate design of risk management processes

including documentation

to support this culture is a key theme. (Relevant concepts are discussed in Learning Outcome 2: Understand how to mitigate identified risks in the supply chain).

2. Reason

J. (1997). Managing the Risks of Organizational Accidents. Ashgate.

This foundational academic text on organisational safety and risk culture distinguishes between active failures and latent conditions. It argues for a systems-based approach rather than a person-based (blame) approach. A 'just culture' is described as one that balances accountability with learning

which can influence how risk information

including causes

is recorded and communicated (Chapter 8: 'Engineering a Safety Culture').

3. Hopkin

P. (2018). Fundamentals of Risk Management: Understanding

Evaluating and Implementing Effective Risk Management (5th ed.). Kogan Page.

This text explains that the design of a risk register and the risk management framework should be tailored to the organisation's specific context

including its culture. It notes that a focus on a 'no-blame' environment is crucial for effective risk identification and reporting

which can influence the level of detail recorded about risk causes (Part 2: 'Risk Management Framework and Culture').