One Language for RiskCompanion site · catalog 1.0
The companion site of the book

One language for risk,
one place to look it up

Twenty-seven open frameworks, from ISO 31000 and COSO to the Basel Committee, NIST, NASA, FMEA and the Sendai Framework, read with the same questions and consolidated into one architecture: seven layers, forty-seven components, three lenses and eight objects, every component carrying the key of the source it came from.

This site holds the parts of the book that have to be able to change: the component catalog (appendix B), the open register schema (appendix C), the glossary, the sources and the places to challenge and contribute. The first edition of the book describes catalog 1.0.

Where to start

Pick your seat at the table

Board members and committees

Read the framework in one picture and the seven principles; then the glossary entries for appetite, tolerance, limit and threshold.

Start here →

Chief risk officers and risk teams

Start at the layers, read every component of Frame and Analyze, then the three lenses.

Start here →

Internal auditors and supervisors

Every component names its source; start from the twenty-seven sources, then Record, Assure and Report.

Start here →

People who build registers and agents

The eight objects, the open formats and the worked example PAY-014, then the schemas themselves.

Start here →
The framework in one picture

The Consolidated Risk Management Framework

The framework borrows its spine from ISO 31000 and adds nothing to it: the six steps of that process become six layers, and Govern is drawn around them, not among them, because governance decides that the cycle runs rather than happening at a point in it. Each layer answers one question, and the components are the units an organisation adopts: each has a code, a name, a specification an auditor can test and a developer can build, and the source it came from.

Three subjects cut through every layer as lenses: artificial intelligence; climate and physical hazards; third parties and the components they supply. Eight objects sit under the layers: the objective, the risk, the control, the scenario, the indicator, the event, the hazard and the assurance activity. The layers are verbs; the objects are nouns.

Read the framework page →

The Consolidated Risk Management Framework: 27 sources, seven layers, 47 components, three lenses, eight objects
Figure 14.1 of the book. Click to enlarge.
Seven layers

Click a layer to see its components

L6Record, Assure and Report
Where the evidence lives, who vouches for it, and what the board sees5 componentsL5Monitor
Whether reality agrees with the estimate, and how fast the organisation learns7 componentsL4Respond
What is decided, by whom, and how robust the control is7 componentsL3Analyze
How likely, how severe, how sure, and whether the method can be trusted9 componentsL2Identify
What can happen, from which source, in which process, in which words7 componentsL1Frame
What the objectives are, how much risk is acceptable, and at which level7 componentsL0Govern
Who leads, what the organisation values, and who is allowed to do what5 components
Vocabulary

One word for each thing

The book keeps one term per idea and records every retired term as an alias, with the source that used it. Appetite, tolerance, limit and threshold are four different things; inherent, expected and measured exposure are three fields, not one called residual. Open the glossary →

Open formats

Records that can leave the building

Four of the twenty-seven sources publish a format a program can validate. The framework adopts them and proposes schemas for the objects that have none, so that a register, an incident or a hazard means the same thing in every organisation that uses it. What a schema is, in plain words →