What to remember
- Define the operating scope
- Trace critical dependencies
- Connect every risk to an object
- Document controls and owners
Start from actual flows
Start with the product, service or decision being examined. Identify what enters, what leaves, who transforms information or material and which resources are indispensable. The map should answer a question rather than reproduce the entire organization.
- Suppliers and partners
- Sites and teams
- Data, materials and payments
- Systems and infrastructure
- Customers or beneficiaries
Identify dependencies
A dependency becomes critical when it concentrates many flows, has few substitutes or requires a long replacement time. Relationships between elements matter as much as the elements themselves.
Represent the type and direction of the relationship, capacity, recovery time and alternatives. This structure avoids risk lists disconnected from operations.
Qualify risk without false accuracy
A risk score should be explained. When evidence is scarce, a qualitative scale with observable criteria is preferable to an arbitrary probability. Separate gross exposure, existing controls and residual risk.
| Component | Question | Evidence |
|---|---|---|
| Exposure | Which flow or asset is affected? | Explicit link on the map |
| Likelihood | Why could the risk occur? | History, signal or attributed judgment |
| Impact | Which consequence and horizon? | Affected value, delay or service |
| Control | Which measure reduces the risk? | Owner, status and test |
Use the map in the trade-off
Map brings flows, dependencies and risks together on a shared canvas. It complements strategic comparison: an attractive option that depends on one supplier or a fragile system may require a prerequisite.
The useful deliverable combines the visualization with a prioritized list of critical points, measures, owners and signals to monitor.
Frequently asked questions
What is the difference between a risk map and risk register?
The map shows relationships and dependencies. The register details each risk, assessment, owner and action. They complement each other.
Which scope should be mapped?
Set a scope aligned with the decision and explore the paths whose failure would materially change the choice.
How should risks be prioritized?
Combine object criticality, dependency strength, impact, substitution capacity and the effectiveness of existing controls.