Domain
Risk
This directory contains enterprise risk management standards, registers, and procedures covering risk identification, analysis, treatment, acceptance, and monitoring.
Note
Its original content is released under CC BY-SA 4.0; a quotation that NOTICE.md (opens in a new tab) allows or keeps under its transition clause keeps its source licence and is not relicensed under CC BY-SA 4.0.
Policy, 1
Policies
Standard, 2
Standards
Procedure, 3
Procedures
Guideline, 1
Guidelines
Register, 3
Registers
- Assurance Map Registerv1.1.7
- Key Risk Indicator Cataloguev1.1.7
- Scenario Risk Cataloguev1.0.4
Template, 4
Templates
Annex, 1
Annexes
Leadership, 17
Leadership pages for this area
Pages from the executive layer that tag this area. They explain and advise; the documents above govern.
- Choosing between human review, human oversight, and autonomous authority for AI-assisted workdecision narrative
- Choosing how much cloud and supplier concentration to accept and what exit readiness to maintaindecision narrative
- What the governing body should require for third-party and AI supply-chain risk oversightexecutive brief
- What the governing body should require to know its enterprise risk is governedexecutive brief
- From AI idea to retirement: the governed life of an AI systemjourney
- From policy intent to independent assurance: the journey of a privileged-access controljourney
- From retention rule to destruction evidence: the governed journey of a recordjourney
- How leadership can know, with evidence, whether critical services could continue and recover after a disruptionoutcome map
- How leadership can know, with evidence, whether the controls it relies on are operatingoutcome map
- How leadership can know, with evidence, whether the organization's legal and regulatory obligations are identified and metoutcome map
- What the governing body should ask about enterprise architecture and accumulated technology debtoversight question set
- What the governing body should ask about risk appetite, the register, acceptances, early-warning indicators, and board reportingoversight question set
- What the governing body should ask about the organization's AI inventory, risks, incidents, suppliers, and changeoversight question set
- What happens when a critical AI supplier failsscenario
- What happens when a monitored risk breaches the appetite the governing body setscenario
- When a customer-data service must move after its legal operating boundary changesscenario
- When the enterprise identity provider can no longer be trustedscenario
Next on the tour
Open a domain: Architecture