Graph · Operational risk taxonomy
Sixteen risk types, one set of chains
Every operational risk type below is traced from the regulation to the evidence that proves the control works. Drawn together, the chains show which controls carry several risk types at once, and where a chain stops before it reaches proof.
- Risk types
- 16
- Chains
- 0
- Elements
- 0
- Links
- 0
- Shared
- Chain breaks
- 0
Chain map
Click a node to trace its chain. Zoom with the buttons, a double click, or Ctrl/⌘ and scroll. Drag empty space to pan.
Circles are chain elementsA regulation, policy, risk, loss scenario, weakness, control, indicator or piece of evidence. Each colour is one of the sixteen risk types.
Open circles are sharedThe same element serves more than one risk type. Access recertification, for example, holds up chains in internal fraud, information security and third party at once.
Red rings are breaksThe chain stops there. Nothing downstream proves that the risk is controlled, which is where an examiner or a loss usually finds the gap.
Rows lines it upSwitch to Rows to see each risk type across the eight links, from regulation on the left to evidence on the right.
Try it with your own chains
One row per chain: a risk type, then the eight links in order. Leave trailing cells blank where a chain stops and the map flags a break. Identical text in the same link becomes one shared element. Everything runs in your browser; nothing is uploaded or stored.