Identify
What can happen, from which source, in which process, in which words. 7 components, chapter 16 of the book.
Source taxonomy and source by process matrix
Every risk carries a node of a versioned, source-organized taxonomy with three levels and an “other” branch at each; branches are prioritized by summed exposure, not by count; the taxonomy is crossed with the process map in a matrix whose totals name the most influential source and the most exposed process.
Source: Risk breakdown structure and matrix [3]
Validated risk statement
The register row is a statement in four parts, condition, departure, asset, consequence against an objective; a statement missing a part or embedding its own solution is rejected; a nine-field description sits beneath it.
Source: Risk management handbook [11]; practitioner standard's nine-field description [6]
Failure-mode decomposition
Each process is decomposed into functions written as verb and noun, each function into its failure modes, effects and causes; controls in place are tagged as acting on the cause or on the mode; applicable to any process.
Source: Failure mode and effects analysis [8]
Horizon scanning
A scanning routine with declared drivers, a stated cadence and a radar with a trail; each signal is classified by speed, slow risks to the register as scenarios, fast risks to continuous monitoring with an indicator and a threshold.
Source: Horizon scanning guide [6]
External vocabularies
Identification consults four controlled lists, the thirty-three global risks on two horizons, the supervisors' vulnerabilities, the two hundred and eighty-one coded hazards and the four-part security scenario, and records the matching identifier as a field; the lists are mapped to the taxonomy, not adopted as it; an internal perception survey follows the published method.
Source: Global risks report [22]; supervisory radar [27]; hazard profiles [24]; register series [9]
Opportunities
Identification is run from the threat side, the opportunity side and both, with the technique and the side it finds recorded; a positive risk is a full register row with an opportunity flag and the same statement, node, process and tier as a negative one.
Source: Practitioner standard [6]; register series [9]; enterprise framework [2]
Component-level supply chain
For every third party the component is also known: a software bill of materials with eleven minimum fields, a hardware bill with geography of manufacture, the chain of nth parties; a bill that does not declare completeness is stored as incomplete; redacted and unknown fields are distinguished; every questionnaire question traces to a standard.
Source: Supply-chain instruments [15]