09 — Scale Risk Deltas
Scale doesn't replace the risks in Sprint 9 §06 — it adds new ones and re-weights existing ones. This file lists the deltas and how each is mitigated. Each row is added to the live register at the QSR that approves the corresponding stage move.
Re-weighted existing risks (Sprint 9 §06 IDs)
| ID | Risk | Delta at S3/S4 | Why | Mitigation update |
|---|---|---|---|---|
| RR-001 | Safeguarding mishandled by a coach | Likelihood ↑ (more coaches, more cohorts) | Volume increases tail-risk frequency | Second DSL FTE; regional safeguarding leads; quarterly tabletop in every region |
| RR-002 | FCA boundary breach | Likelihood ↑ in new jurisdictions | Coaches less familiar with local equivalents | Localised boundary cards (§06); local compliance refresher at accreditation |
| RR-004 | Single-client concentration | Likelihood ↓, Impact ↑ | More clients overall, but Tier 1 deals are bigger | Concentration ceiling: no single client > 25% ARR at S3, > 15% at S4 |
| RR-007 | Coach bench under-supply | Likelihood ↑↑ | Demand outruns accreditation throughput | Bench pipeline target = 1.3× next-quarter capacity need |
| RR-008 | Key-person dependency on founders | Likelihood ↑ then ↓ | Worse during S2→S3 transition, improves after | Succession plan for each founder role by S3; documented at QSR |
| RR-010 | Coach burnout | Likelihood ↑ | Utilisation pressure during S3 hiring lag | Hard ceiling: coach utilisation > 80% triggers automatic bench escalation |
New risks introduced by scale
| New ID | Title | Family | Trigger stage | L | I | Score | Owner |
|---|---|---|---|---|---|---|---|
| RR-101 | First international cohort underperforms, drags regional brand | Reputational | S3 | 3 | 4 | 12 | Country Lead |
| RR-102 | HQ-seconded coaches used beyond bridging window in a region | Delivery | S3 | 3 | 3 | 9 | HoC |
| RR-103 | Regional regulator scope mismatch (e.g. financial guidance boundary) | Regulatory | S3 | 2 | 4 | 8 | Legal + Country Lead |
| RR-104 | Data residency violation (PII crosses an unauthorised border) | Data & Privacy | S3 | 2 | 5 | 10 | DPO |
| RR-105 | Channel partner (Tier B) mis-sells or misrepresents methodology | Reputational | S3 | 3 | 4 | 12 | Partnerships Lead |
| RR-106 | Evidence comparability breaks across regions (different proxies, different methods) | Reputational | S3 | 3 | 4 | 12 | Evidence Lead |
| RR-107 | Multi-tenant dashboard data leak between client tenants | Data & Privacy | S2/S3 | 2 | 5 | 10 | CTO (or Tech Lead) |
| RR-108 | Org bloat: hiring outpaces revenue, runway shortens | Financial | S2→S3 | 3 | 4 | 12 | CEO |
| RR-109 | Founder/Exec succession not in place when needed | Strategic | S3 | 3 | 4 | 12 | Board |
| RR-110 | Quality drift — RAG mix degrades quietly as cohort count grows | Delivery | S3 | 3 | 5 | 15 | HoD |
| RR-111 | M&A or partner reverse-takeover dilutes mission | Strategic | S4 | 2 | 5 | 10 | Board |
| RR-112 | Public misuse of our outcome claims by a partner or media | Reputational | S3 | 3 | 3 | 9 | Comms + Evidence Lead |
Controls added for the new risks
Mapped into the structure of Sprint 9 §07 (Preventive / Detective / Corrective):
- RR-110 (Quality drift) — Detective: weekly RAG dashboard with regional cut; Preventive: regional supervision quotas; Corrective: cohort intervention protocol with HoD on-call within 24h
- RR-104 (Data residency) — Preventive: DPIA per region; Detective: quarterly access-log audit; Corrective: incident runbook (Sprint 9 §08) extended with cross-border breach playbook
- RR-106 (Evidence comparability) — Preventive: global methodology lock + local proxy register; Detective: assurance review (Sprint 8 §07) annually per region; Corrective: published correction policy (Sprint 8 §10)
- RR-108 (Org bloat) — Preventive: capacity model (§03) gates every hire; Detective: monthly runway + utilisation in MBR; Corrective: pre-agreed cost actions if runway < 9 months (Sprint 9 §09)
- RR-109 (Succession) — Preventive: emergency successor named for every Exec role by S3; Detective: annual board succession review; Corrective: interim leadership protocol
How this file is used
- At the QSR that approves moving stage (S2→S3 or S3→S4), this file is the input to updating the live risk register (Sprint 9 §06)
- Every new RR-1xx row gets an owner, a residual score, and at least one mapped control before being marked Open
- Any RR-1xx row that hits High residual blocks the stage move until a mitigation OKR is opened