1. A Register Lists; a Report Reasons
The RAID log holds seven risks with owners, ratings and responses. That is a register, and a register answers one question: what have we written down. This document answers the questions a register cannot.
| Question | The register | This report |
|---|---|---|
| What are the risks? | ✔ Seven, with owners and responses | Not repeated |
| How much are we exposed to? | ✘ Ratings are High/Medium/Low | ✔ $271,700,000, probability × impact |
| Is it getting better or worse? | ✘ A register is a snapshot | ✔ Eight quarters of trend |
| Which risks are actually managed? | ✘ Every entry has a response, which is not the same | ✔ 4 managed, 1 explicitly not |
| What is it missing? | ✘ By construction, a register cannot know | ✔ §6 |
A register with three Highs and four Mediums tells a Committee nothing about whether the program is more exposed than it was last quarter, or whether the largest exposure is the one getting the most attention. Converting to probability and impact is uncomfortable — it forces a number onto a judgment — but it is the only way to compare one risk with another.
The discomfort is the point. Assigning R-01 a 25% probability is a claim somebody can disagree with, which is more useful than “High”, which nobody can.
2. Exposure
| Ref | Risk | Category | Probability | Impact if it happens | Exposure | Share | Kind |
|---|---|---|---|---|---|---|---|
| R-01 | Phase 3 efficacy does not separate sufficiently from approved products in the class | Clinical | 25% | $340,000,000 | $85,000,000 | 31% | value |
| R-06 | Payer coverage at launch is narrower than the business case assumes | Commercial | 45% | $180,000,000 | $81,000,000 | 30% | value |
| R-02 | Gastrointestinal tolerability drives discontinuation above the modelled rate | Clinical | 35% | $210,000,000 | $73,500,000 | 27% | value |
| R-04 | A competitor approval changes the evidentiary bar before filing | Market | 20% | $95,000,000 | $19,000,000 | 7% | value |
| R-05 | Phase 3 enrolment runs behind the planned curve | Clinical | 55% | $9,600,000 | $5,280,000 | 2% | schedule |
| R-03 | Registration-batch manufacture or process validation slips against the NDA date | CMC | 30% | $14,400,000 | $4,320,000 | 2% | schedule |
| R-07 | Pre-approval inspection finds a deficiency at the contract manufacturer | Quality | 15% | $24,000,000 | $3,600,000 | 1% | schedule |
| Total | $271,700,000 | 100% |
Schedule impacts are converted to money at $4,800,000 per month of program slip — roughly one month of run-rate plus the commercial month lost at the far end. That conversion is stated so it can be argued with, and every schedule impact in the table is a whole number of months at that rate, asserted at build time so the arithmetic stays auditable.
R-01 (efficacy does not separate), R-06 (payer coverage narrower than modelled) and R-02 (tolerability drives discontinuation) between them account for $239,500,000. Every operational risk in the register — manufacturing, enrolment, inspection — sums to a small fraction of that.
That distribution is the argument for where program attention should go, and it is almost the opposite of where it naturally goes. Operational risks are visible weekly, have owners in the room, and respond to effort. The commercial risks are quiet, slow, and largely decided by data that does not exist yet.
3. Trend
Exposure fell through 2025 as the program de-risked — Phase 2 read out, the dose was selected, and the probability attached to R-01 came down. It has risen for the last two quarters, and the cause is not new risks. It is R-05 and R-06 both moving up in probability: enrolment is behind curve, and the gross-to-net assumption behind the coverage risk remains un-refreshed.
Exposure falls when risks are retired, and it also falls when the program stops looking. It rises when things get worse, and it also rises when somebody finally quantifies a risk that was previously rated Medium and ignored.
The right question at each inflection is which — and the answer here is that the recent rise is genuine deterioration in two named risks rather than improved honesty about existing ones.
4. Managed, or Merely Recorded
| Ref | Managed? | What the response actually does |
|---|---|---|
| R-01 | Partially — the dose span was widened in Phase 2, and nothing further can be done now. | ⚠ The largest exposure in the register and the least actionable. If the effect size does not separate, the commercial case fails and no program action recovers it. |
| R-06 | Partially — evidence package built alongside Phase 3; payer advisory boards from 2027. | Gate condition GC-03 exists for this. The evidence can be generated; the formulary cycle cannot be accelerated. |
| R-02 | Yes — escalation extended to 20 weeks, discontinuation is a monitored endpoint with DMC review. | The mitigation was a real trade: a slower escalation delays time to maintenance dose in exchange for tolerability. |
| R-04 | No — the program cannot influence a competitor's approval. | ⚠ Recorded and monitored, not managed. Naming it as unmanaged is more useful than listing a mitigation that does not mitigate. |
| R-05 | Yes — reserve site list, obesity clinic partnerships, pre-screening registry. | Two months of slip. ⚠ The highest-probability risk in the register, and the mitigations act on a five-month lag. |
| R-03 | Yes — stability started at the earliest supportable point; QA embedded at the site. | Three months of slip at the stated burn rate. Already partially realized through the method-transfer failure. |
| R-07 | Yes — two internal audits ahead of the inspection window. | Five months of slip if a deficiency requires re-inspection, which is the lowest probability in the register and one of the larger schedule impacts. |
The program cannot influence whether a competitor is approved, and no mitigation exists that would. The register's original entry offered one — differentiation resting on tolerability — which is a genuine strategy but not a mitigation of that risk. It reduces the consequence if the risk materializes; it does nothing to the risk.
A register in which every entry has a mitigation is a register that has been filled in rather than thought about. Some risks are accepted, and the honest treatment is to name the acceptance so that a Committee can decide whether it agrees — which is a decision, and decisions are what a governance body is for.
The distinction matters most for R-01, the single largest exposure. Its response reads “partially managed”, and the only management action available — widening the dose span in Phase 2 so that the top dose carried into Phase 3 — was taken two years ago. There is nothing further to do. The largest exposure in this program is now entirely outside the program's control, and pretending otherwise would misdirect attention that has somewhere better to go.
5. Risks That Became Issues
The conversion rate is the register's report card. A risk that materializes without having been registered is a failure of foresight; a risk that materializes having been registered, rated and mitigated is something else entirely.
| Risk | Became | What happened | Assessment |
|---|---|---|---|
| R-03 | I-02 | Analytical method transfer failed acceptance on first pass | ⚠ Converted. The risk was registered, rated Medium, and mitigated with dual-source qualification — and it happened anyway, at the one supplier the program has. |
| R-05 | — | Enrolment behind curve | Converting. Not yet an issue in the register, and the leading indicators crossed their thresholds eleven months before the status report escalated it. |
That is worth being precise about, because it is the most misread event in the program. The analytical method transfer failed at the one supplier the program has, the mitigation named in the register was a qualification strategy that had not yet been executed, and the response cost $1,850,000 of contingency plus roughly $670,000 of internal effort that was planned to be doing something else.
Registering a risk is not the same as having a lever against it, and mitigations that exist as plans rather than as executed work do not reduce exposure. They reduce the feeling of exposure, which is worse than nothing because it is indistinguishable from the real thing until the day it is tested.
R-05 is converting now and has not yet been moved to the issue log. The leading indicators crossed their thresholds eleven months before the status report escalated enrolment to red. The register was not wrong about this risk; it was simply not the instrument that would detect it moving.
6. The Register's Blind Spots
| Blind spot | Why it is not in the register |
|---|---|
| Risks nobody named | Every register is a list of the things the people who wrote it thought of. The Phase 2 competitor read-out that reset the evidentiary bar is not in this register because nobody at Gate 4 expected it. |
| Correlated risks | ⚠ Exposure is summed as though the risks are independent. They are not: R-01, R-02 and R-06 share a root — if the effect size disappoints, tolerability matters more AND payers pay less. The true tail is worse than the arithmetic. |
| Risks inside the mitigation | The extended escalation schedule mitigates R-02 by delaying time to maintenance dose — which is itself a commercial risk nobody has registered. |
| Risks owned by somebody else | The CRO, the CMO and 260 sites each carry risks that become the sponsor's on materialization and appear in no sponsor register until they do. |
$271,700,000 is a sum computed as though the seven risks are independent. They are not. R-01, R-02 and R-06 share a root: if the effect size disappoints, then tolerability matters more as a differentiator and payers pay less for the same product. Those three do not fail one at a time.
The arithmetic understates the tail, and no amount of care in estimating the individual probabilities fixes that — it is a structural property of summing correlated risks. The number is useful for ranking and for trend. It is not a number to plan a reserve against.
The fourth blind spot is the one a program manager can actually act on. Meridian, Aldergate and 260 sites each carry risks that become the sponsor's the moment they materialize, and none of them appears in this register until it does. That is what the vendor governance cadence in the oversight plan is for: not to manage their risks, which the program cannot, but to hear about them earlier than the day they arrive.