C2.1 Source taxonomy and source by process matrix

Risk breakdown structure and matrix [3]

What it requires. Every risk carries a node of a taxonomy organized by source, three levels deep, with an “other” branch at every level so that nothing is forced into a box it does not fit. Branches are prioritized by summed exposure, not by the number of rows filed under them. The taxonomy is crossed with the process map in a matrix whose cells hold the summed exposure of one source on one process; the totals name the most influential source and the most exposed process. The taxonomy is versioned, and a retired branch keeps the history filed under it.

Where it comes from. The risk breakdown structure was proposed in the project literature in 2002, by analogy with the work breakdown structure, and the matrix crossing it with processes followed in 2005 [3]. Level zero is all the risk of the undertaking; level one is a handful of major sources; levels two and three refine them until a risk can be placed by cause rather than by effect. A lessons-learned loop promotes a recurrent risk up the tree to a generic one, and a 2026 branch covers the risks of artificial intelligence.

What it reconciles. The sources organize taxonomies by effect in finance, by function in the cyber framework, by hazard type in disaster risk, by process in continuity. Chapter 11 adopted organization by source at the first level because it is the one that rolls up without double counting; C2.1 makes that operational. It also closes a gap the project literature admits, that nothing is said about keeping a taxonomy stable over a decade, by adding versioning and the preservation of history under retired branches.