Portfolio Risk Management

Building Enterprise Portfolio Risk Governance

Co-establishing an evidence-led risk function that gives leaders a consistent view of material exposure, response ownership and escalation across a diverse operating portfolio.

Role: Senior Risk Manager — Projects & Operations
Enterprise scope: 8 portfolios and approx. 10 permanent assets
Annual operating environment: 60+ annual events
First-year activity: 150+ priority risks assessed and 130+ response actions

The Context

A portfolio spanning permanent assets, projects and fast-moving events needed a common way to identify, compare and escalate risk. Risk information existed across operational teams and source registers, but leadership required a more consistent portfolio-level view connecting evidence, exposure, ownership and action.

My Role

As Senior Risk Manager — Projects & Operations, I helped establish and operationalize the portfolio risk-management function. Working with Alvarez & Marsal, leadership, business units and control functions, I translated an ISO 31000-aligned framework into practical registers, assessment rules, review routines, response tracking and executive reporting.

Why a Portfolio Framework Was Needed

Project, asset, event, HSE, quality and incident information originated in different operational sources.
Individual risks could not be compared reliably without a shared taxonomy and rating logic.
Leadership needed to distinguish local issues from material portfolio exposures.
Risk responses required clear owners, due dates, review cadence and escalation pathways.
Decisions needed traceable evidence rather than narrative reporting alone.

The Framework

Standardized risk taxonomy with 8 Level-1 categories and 39 Level-2 subcategories.
Level-1 categories: Strategic; Reputational; Financial; Operational; Third-party; Cyber Security & Technology; Compliance; and Health, Safety & Security.
Inherent and residual assessment using likelihood and impact against an approved 5×5 heat-map logic.
Defined treatment expectations, ownership, due dates, monitoring and escalation according to materiality.
Evidence traceability back to project risks, incidents, HSE and quality sources.
A focused portfolio selection rule: not every operational issue becomes a portfolio risk; only material exposures with sufficient evidence patterns are elevated.

The Approach

Consolidated evidence from operational risk registers, incidents, HSE and quality findings.
Normalized categories and subcategories so exposures could be compared across portfolios.
Assessed inherent exposure and residual exposure after existing controls.
Identified priority risks based on rating, recurring evidence, reach across assets or programs, and potential effect on objectives.
Assigned or facilitated response ownership, action plans and due dates with the relevant business and control teams.
Reviewed higher-priority exposure weekly and consolidated portfolio risk monthly for leadership attention and escalation.
Used Excel for controlled risk-register logic, evidence traceability and assessment detail, and Power BI for heat maps, trends, concentration, response status and exception-led executive views.

Operating Cadence

Weekly high-risk review: changes in exposure; overdue or blocked actions; new evidence; decisions required; immediate escalation.

Monthly portfolio review: cross-portfolio concentrations; movement in inherent and residual risk; response progress; emerging themes; budget or leadership decisions.

Decision Support, Not Risk Administration

The purpose of the function is to manage uncertainty in a way leaders can act on. Consolidated visibility makes it possible to see where exposure is concentrating, which responses are progressing, where intervention is needed earlier and which trade-offs deserve leadership attention — rather than maintaining a register for its own sake.

Outcome

Created a repeatable enterprise view of material risk across 8 portfolios, approximately 10 permanent assets and 60+ annual events.
Assessed more than 150 priority risks and facilitated or monitored more than 130 response actions during the first year of the function.
Strengthened visibility of ownership, response status, overdue actions and escalation requirements.
Enabled leadership to move from fragmented risk information toward evidence-led prioritization and earlier intervention.
Supported preventive decisions and targeted budget allocation in areas including specialist HSE advisory support, pricing accuracy and critical-asset maintenance.

What This Demonstrates

Enterprise risk-function building
ISO 31000-aligned methodology translated into operations
Portfolio taxonomy and materiality assessment
Evidence-led executive reporting
Inherent and residual risk evaluation
Risk-response governance and escalation
Power BI and Excel decision support
Preventive action and budget enablement

The experience of connecting performance evidence, risk exposure and executive decisions also informed the development of Get CertaQ, my quantitative decision-support model currently in development.

Explore Get CertaQ