Why Your Compliance Risk Register Scores Everything Medium

1. The Symptom: A Register Where Nothing Stands Out

Open a compliance risk register at a mid-size Indian employer and count the colours. In many of them, nine rows in ten are Medium. The EPF ECR due on the 15th is Medium. The factory licence renewal is Medium. A contractor who may or may not be remitting provident fund for deployed workers is Medium. The register looks complete and says nothing, because a ranking in which everything ties cannot tell anyone where to start.

This is not laziness. It is a predictable result of how registers are built, and it is fixable.

2. Four Reasons Scores Drift to the Middle

The scale has no anchors. If "3" is not defined, it means "probably fine, probably not urgent" to everyone. People choose 3 because it feels safe to be wrong at 3.

Owners score their own work. A Compliance Manager who files the returns will rate them lower risk than an outsider would, and will rate the obligations she cannot control (contractors, state amendments) as middling because she has no data on them.

Impact is measured in rupees. A one-month delay in one site's EPF deposit is a small interest figure, so it scores low. The Act, though, carries exposure beyond interest for repeated default, and an inspector looks at the pattern. Rupee-based impact hides prosecution and licence exposure.

Nobody tests the scores. A control that has never been checked is credited as working. When every control gets credit, every residual score lands in the middle.

3. A Five-Minute Test of Your Own Register

Pull your register and answer four questions.

• What share of rows carries the same band? Over 60% in one band means the scale is not separating anything.
• How many rows with prosecution exposure for the occupier or employer score below 4 on impact?
• For each Low or Medium row, can the owner show an artefact, with a date, proving the control ran in the last three months?
• When did a person other than the owner last challenge a score?

Registers that fail two or more of these are usually generous across the board. The generosity is invisible until a notice arrives.

4. Fixes That Work

Write one-line anchors for every number. Likelihood 1 is an automated, tested control with recent evidence. Likelihood 5 is no control or repeated failure. Impact 4 is prosecution exposure for the occupier, employer or officers. Impact 5 is a licence suspension or a stoppage of operations.

Put a floor under statutory impact. Any obligation with prosecution exposure never scores below 4. This one rule pulls licences, contractor liability and repeat filing defaults out of the middle.

Make control credit conditional on evidence. A signed checker approval or a dated portal acknowledgement earns the credit. A process described in a document does not.

Introduce a second reader. Have someone outside the owner's team review every row scored 2 or below on a prosecution-exposure obligation. Quarterly is enough.

Show the maximum, not the average, by site. If a plant has nine Green rows and one Red CLRA row, the plant is Red for CLRA. An average hides the exact row that causes the notice.

5. What to Do Next

Re-score only your top thirty obligations first, the ones tied to licences, contractors and monthly filings. If the distribution changes noticeably once anchors and the impact floor are applied, you have found the generosity. A full walk-through of the fields, scales and key risk indicators is in our guide to the compliance risk register for Indian companies, and a free compliance audit from Iztty will give you a scored baseline across your Acts and states to compare against your own.