Ethics, Risk, and Change

From the people system table to a risk register

Take out your Week 14 people system table. It lists each role in the 12-week test: what each person contributes, what authority they hold, where fairness is at risk and how they can raise a concern. In the Week 14 story, the game 1 fee arrived eight days late. The performer and the translator were asked to wait a week for their pay. Your table showed who waited and whether they had a real way to object.

That late payment had already happened. This week looks ahead to problems that have not happened yet. Judy's company is still testing Option A · Expansion (expand cheerleading and sports-entertainment talent management). Game 2 has been played, its fee is not yet due, and Judy is talking with two more teams about payment and terms.

Several things could still go wrong. A photo of the performer could be published without her approval. A home team could pay late again. Mina, the coordinator, could fall ill in the week of a future game. So far, the company has handled these dangers through trust: Mina knows the performer and Judy knows the home team. The shared photo record (Week 8) and the meeting decision log (Week 10) exist, but much daily checking still happens in a chat group.

Trust lets a small company act quickly when there is no time to check every detail. It becomes dangerous when it takes the place of a record, a rule or a way to say no. When a promise then fails, the person with the least power usually carries the largest cost.

This week's question is: what could go wrong in the test, who would be hurt, and who will act before it happens? You will answer it with a risk register. Then you will write a message that explains a change from informal habits to written processes to the people it affects.

Where this week fits

Week 14 showed who carries the work and who waits when money is late. Week 15 turns those people and their exposure into a list of risks, each with an owner, an early signal and a point at which the work stops. That list is the risk register. Week 16 turns the owner, signal and stop point of each row into a line on a management dashboard.

Four questions about one photo

Compliance, ethics, risk and reputation often appear together, but each word asks a different question. Compliance asks which rule applies: a law, a contract or a platform policy. Ethics asks what people owe one another, especially when the rules are incomplete or power is unequal. Risk asks what could happen, how likely and how harmful it is, and what response is available. Reputation asks how trust in the company would change if the conduct became visible.

One ordinary event can raise all four questions. After game 1, the home team's social media staff wanted to post a photo of the performer the same evening.

Notice that "we meant well" answers none of these questions. A well-meant decision can still put a burden on someone with little bargaining power. A small chance of harm can also require action when the harm cannot be undone. The chance that the home team posts the photo without asking may be small, but once it is posted, nobody can take it back.

A practical way to start is with the promise. What did the company say it would provide, protect, pay or keep private? Who does the work behind it, and who carries the loss if it fails? Then check the evidence: a public statement shows what the company said, and a signed approval form shows what the performer agreed to.

Who gets heard, and who is missing?

Mitchell, Agle and Wood (1997) explain why some people reach a manager's attention easily and others hardly at all. Power is the ability to change the outcome, for example by paying or approving. Legitimacy is how reasonable the person's claim is, given the work, the agreement or a duty. Urgency is how time-sensitive the claim is and how costly a delay would be.

The framework helps a manager notice who is likely to be overlooked. Here is how it looks in the practice scenario.

The table shows a pattern. The people with the most legitimate claims, the performer and the translator, have the least power in the room. A missing voice is a person who is affected by a decision but has not given evidence or taken part in it. A risk register should name missing voices. A decision made only by the people with power may be clear and still be unusable for the people who carry it out.

The map becomes useful when it changes who is asked, when they are asked and in which language. A performer who reads Korean needs the terms in Korean and time to read them before she answers.

Trust that people can check

Brown, Treviño and Harrison (2005) describe ethical leaders as people who act fairly themselves and who also manage ethics actively. They talk about standards, reward good conduct and consider ethics when they decide. The second half matters most for a small company. A founder may be honest and kind, but if nobody can check a decision, the company still depends on one person's memory and goodwill.

Ethical leadership shows up in ordinary choices that anyone can observe. Does the leader explain why a change is needed, ask for criticism before a commitment becomes hard to reverse and protect the person who raises a concern?

Trust also has a hidden cost. When a relationship is strong, people skip the written term and treat a favor as a routine. The company then depends on one person being available, and in the practice scenario that person is Mina. She knows the home team's contact, the performer's rest rule and which photos are approved.

If Mina is ill in a game week and nobody else can find that information, the company can do this work only while Mina is present. It cannot yet do it as an organization.

A short trust review shows where a company relies on a person instead of a process. Ask five questions about any important promise:

1. What exactly are we trusting?
2. Who benefits if the promise holds?
3. Who carries the cost if it fails?
4. What evidence would show that the promise is being kept?
5. How can a person question it or step back without needing special access to Judy?

Week 14 showed how a phrase such as "We are a family" can make boundaries, such as refusing a later pay date, feel disloyal. A person can support the project fully and still question a schedule, a photo or a payment date.

What a risk register is, and how to score it

A risk register is a table in which each row describes one thing that could go wrong. Each row says who would be exposed and how likely and serious the problem is. It also names an owner, an early signal that starts action and a point at which the work stops. The risk-management guideline ISO 31000 (2018) describes this work as a cycle: identify, assess, treat, monitor and communicate.

Most registers score each risk twice, on a scale from 1 to 5. Likelihood is how probable the event is during the period you are planning for. Severity is how much harm it would do, and how hard that harm would be to undo. The numbers only work if everyone uses the same meanings. Here are the meanings Judy's staff use for the 12-week test.

Many companies multiply the two scores to get a priority between 1 and 25 and discuss the highest numbers first. The priority orders a meeting, but it does not decide what is acceptable. So Judy's staff add one rule: any risk with a severity of 5 gets an owner and a stop condition, whatever its likelihood. A score can also mislead when the people affected have not been asked, so the scores are checked again after they speak.

Worked example: a risk register for the Option A test

Judy's staff list six risks for the rest of the test and for any appearances that follow, sorted by priority. The home team pays NT$60,000 per appearance 30 days after the game, and NT$25,000 of each appearance's NT$35,000 cost is paid before the game. Cash must never fall below NT$100,000, and no photo is published without the performer's written approval.

The late payment comes first because it is both likely and serious. The photo and permission rows have lower priority, but both have a severity of 5. Each would cross a red line or a legal limit that cannot be undone, so each still has an owner and a stop condition.

The two Mina rows come from earlier chapters. In the week before game 1 (test week 3), Mina used all 10 of her test hours (Week 9). In test week 7, a third team contacted Judy and asked for an appearance at its own home game on the Saturday of test week 8. Accepting it would have taken Mina to 11 of her 10 test hours in test week 7 (Week 11). A backup who has never run a game week cannot yet take over.

For the highest-priority risk, Judy's staff also write a full entry that connects the promise, the control and the repair.

The full entry makes two points. First, "payment risk" is too broad to act on; the cause, trigger, owner and remedy turn it into work for a named day.

Second, the missing-voices field changes the design. After the meeting, the performer liaison asked the performer, in Korean, what mattered most to her. The performer said that a reliable pay date mattered more than an early one. So Judy kept the control "pay on the agreed date" and dropped an idea to pay early in some months and late in others. The row improved because a missing voice was heard.

Privacy means appropriate use of information

Privacy means that personal information is collected, used and kept in a way that fits a clear purpose. Someone is accountable for that use. Secrecy is only about who can see something. A process can be private and still open to the people who need to understand it.

Mina cannot work after 6 p.m. because of a family-care duty. In a private process, Judy and the person who plans the schedule know the reason. Everyone else sees only "Mina unavailable after 6 p.m." Mina knows who knows and when the note will be deleted. A secret process looks different: a scheduling rule that nobody can see, including the people whose hours it changes. Secrecy hides information but gives nobody a way to check whether the rule is fair.

Before collecting personal information for the test, Judy's staff ask four questions:

1. Purpose. Why do we need it, and can we explain that purpose to the person in one sentence?
2. Access. Who needs to see it to do the work, as opposed to who would find it convenient?
3. Keeping and deleting. How long will we keep it, and who deletes it?
4. Correction and withdrawal. How can the person correct it, or withdraw consent for future use?

The NIST Privacy Framework (National Institute of Standards and Technology, 2020) offers a structure for asking these questions inside an organization's risk management.

Consent is an informed agreement to a stated use. The person knows the purpose, has a real alternative and knows how to withdraw where that is possible. Power can make a free choice feel forced: the performer may approve every photo because she fears that refusal will cost her the next game. A signature collected under pressure is weak evidence of consent.

So the approval form is in Korean and offers three choices: "approve", "approve with changes" and "do not use". It also states that saying no has no effect on future work.

Checking local conditions when plans change

Week 4 showed how to compare settings by mechanisms, such as who approves and which language version counts, rather than by national character. This week adds one habit: a local check record for each risk that depends on a rule in Taiwan or Korea. It names the rule, who checks it and by when.

The record also separates two answers that sound alike: "we have not checked" and "we checked, and no rule applies". In test week 7, the home team asked to move game 2 from Saturday to Sunday (Week 10). The adviser's confirmation from test week 3 named Saturday, so until Mina asked again, the honest entry was "not yet checked for the new date".

Moving from chat messages to written processes

The register leads to a decision. Three kinds of record still travel mostly through the chat group: photo approvals, schedule changes and payment dates. From now on, Judy wants all three recorded in a shared written log, extending the Week 10 decision log. This is the move from founder closeness to written authority that Week 14 described, and it changes how people work.

Mina's first reaction is worry. In the week before a game she already uses about 7 to 8 of her 10 test hours. A log looks like extra work on top of the chat. It is more useful to hear this as information than as resistance to overcome. Oreg, Vakola and Armenakis (2011) reviewed decades of studies on reactions to change. They found that reactions depend on the change itself, on how it is introduced and on the setting, as well as on the person.

Resistance can signal different conditions, and each needs a different response:

• The purpose is unclear. The response is to explain the problem and the evidence.
• The workload or role does not fit. The response is to redesign the change or add resources.
• A safety or consent boundary is at stake. The person is protecting someone, so the response is to pause and check.

A refusal to follow a confirmed safety rule, such as the 12-hour rest rule, is a different case. There the manager holds a firm boundary. The skill is to tell these cases apart by looking at the issue, the evidence and who holds power.

Judy starts with a listening record. She writes down Mina's concern in Mina's words, the evidence Mina gives and what is still open. Then she redesigns the change so that the log replaces the chat for these three items, and Mina writes each item once. The performer liaison enters the Korean approvals. The photo rule stays fixed because it is a red line, but the format of the log is open for comment.

Worked example: the change message

Judy sends this message to everyone who works on the test. It goes out in Chinese and Korean, with time to reply.

The message has three strengths. It separates what is decided from what is open, so nobody is asked for an opinion on something already final. It admits what the company does not know yet. It also names a condition under which the change itself will be redesigned.

Where each option is most exposed

The register above is for the Option A test, but each option has its own risks. The table names, for each option, the most exposed people, the hardest risk to reverse and the control needed before growth.

For each option, you can write a conditional statement: "If the company can put these controls in place, the option can be considered. If it cannot, the company should narrow, redesign or decline it." This week does not choose between the options; in Week 17 you choose one and defend it.

Where AI adds risk this week

The register and the change message contain sensitive material: the performer's photos and approval forms, a family-care note and people's pay dates. Pasting that material into an AI tool is itself a privacy decision, so the four privacy questions apply first. There is a second risk. An AI summary of staff concerns tends to keep the points repeated most and drop the one raised quietly. That quiet concern is often the missing voice the register is meant to catch, so a person reads the original concerns before a row is closed.

Class practice: one risk and a change message

This practice is done without AI tools. Your teacher will tell you which worksheet to use and how to submit it.

1. Choose an option and an activity. Choose one option (A · Expansion, B · Boutique or C · Content-centered return) and one activity it would need in the next 12 weeks. Name one person who does the work and one missing voice.
2. Describe one risk. Write the event and who is exposed. Give a likelihood and a severity score from 1 to 5, with one reason for each.
3. Decide who acts. Write the owner, the trigger and the stop condition.
4. Announce a written process. In three or four sentences, say what is decided, what is still open and how a person can raise a concern.

Swap with a classmate, who checks whether the most exposed person could really use that route. Keep your work for Week 16.

Key points and what you bring to Week 16

• Compliance, ethics, risk and reputation ask four different questions about the same event.
• Power, legitimacy and urgency explain why some people are heard and others are missed. Name the missing voices, and change who is asked and in which language.
• A risk register gives each risk an owner, an early trigger and a stop condition. Likelihood and severity scores from 1 to 5 set the order of discussion. They do not decide what is acceptable, and any severity of 5 gets a control.
• Privacy means appropriate, accountable use of information. Consent is meaningful only when the person has a real alternative.
• Resistance to change is information. A good change message says what is decided, what is still open and how to raise a concern.

Before you approve a change, ask yourself: Who is affected, and who has not been asked? Who owns the greatest risk? When will you look at the decision again?

For Week 16. Bring your risk register and your Week 13 cash calendar. In Week 16, the owner, trigger and stop condition from each row become a line on a management dashboard, and the cash calendar supplies the cash line.