Risk Mapping: Methodology and Tools for Mid-Market Companies
A risk map is the documented representation of the risks an organisation faces, assessed by likelihood and impact, and prioritised for treatment. Several regulatory frameworks require one explicitly: Article 17(II)(3) of the French Sapin II law requires a corruption risk map; Article 9 of Regulation (EU) 2024/1689 (the EU AI Act) requires a risk management system for each high-risk AI system; ISO 31000:2018, the international risk management standard, describes risk mapping as the output of the risk identification and assessment process; and ISO/IEC 27005:2022, the information security risk management standard, requires a risk register that functions as a risk map for the information security scope. For a mid-market company, the challenge is not identifying risks but organising them into a map that governance can read, that named owners can maintain, and that a regulator can verify. A spreadsheet can hold a small, stable inventory; it becomes inadequate when risks are numerous, when several business units share a single map, or when the map must feed treatment workflows automatically. Optivalue.ai provides the structure to build, maintain and demonstrate a risk map that meets these requirements.
Identifying and Cataloguing Risks: Sources and Method
Risk identification begins with sources: internal events, near-misses, audit findings, incident reports, regulatory changes, and external databases of sector-specific risks. ISO 31000:2018 recommends a structured identification process that includes context analysis, stakeholder consultation, and review of internal documentation. For each risk, the catalogue must record the risk description, the risk category (operational, legal, financial, reputational, environmental), the organisational unit affected, the existing controls, and the named owner. A risk that does not have a named owner cannot be managed; the owner is responsible for the accuracy of the entry and for triggering updates when circumstances change. Optivalue.ai guides each owner through a structured questionnaire and flags entries that are missing mandatory fields. For risk mapping for AI systems required by the EU AI Act, the same methodology applies, with the additional requirement to link each risk to the specific AI system it concerns.
Assessing Risks: Likelihood, Impact, Criticality
Risk assessment converts identified risks into a prioritised inventory. The standard approach, described in ISO 31000:2018 and its sector-specific derivatives, assesses each risk on two axes: likelihood (the probability that the risk materialises over a defined horizon) and impact (the magnitude of the consequence if it does). The product of likelihood and impact gives a criticality score, which determines the priority of treatment. Qualitative scales (low, medium, high, very high) are appropriate for most mid-market contexts; quantitative approaches require data that many organisations do not have. The residual risk, after existing controls are taken into account, is what the risk owner must be prepared to defend to governance. Each assessment must be dated and signed by the named owner so that the version history demonstrates regular review.
Prioritising Treatments
A risk map without a treatment plan is an inventory, not a management instrument. Treatment options are four: accept (the residual risk is within tolerance), reduce (controls are added to lower likelihood or impact), transfer (insurance or contractual allocation), or avoid (the activity generating the risk is discontinued). Each treatment decision requires a named owner, a completion date, and documented evidence of implementation. The map must show, for each risk, which treatment option has been chosen and the status of its implementation. Treatments that remain open beyond their target date must trigger a review escalation. Optivalue.ai assigns each treatment action to a named owner, tracks the target date, and alerts the owner when the deadline approaches or is passed.
Keeping the Map Current: Frequency and Triggers
A risk map that is not updated is a liability, not an asset. ISO 31000:2018 recommends periodic review and event-triggered updates. Event triggers include material organisational changes (mergers, restructuring, new markets), significant incidents, regulatory changes, and findings from internal audit. The frequency of periodic review depends on the sector and the volatility of the risk environment; frameworks such as the AFA guidelines for Sapin II compliance recommend at least an annual review of the corruption risk map. Each review must be version-controlled and the changes documented, so that the evolution of the map can be traced over time. A GRC platform that hosts and updates the risk map automates the versioning, the review cycle reminders, and the linkage between the map and the treatment workflows.
Book a demonstration with Optivalue.ai
FAQ
What is the difference between a risk map and a risk register?
A risk register is a structured list of identified risks with their assessment scores, owners and treatment status. A risk map is a visual representation of the same data, typically plotted on a likelihood-impact matrix (also called a heat map), designed to communicate the risk portfolio to governance. In practice, the two terms are often used interchangeably; the underlying data set is the same. A tool that maintains a structured risk register and generates a visual heat map from the data covers both concepts. The distinction matters when a regulatory text requires a specific format: the AFA guidance on corruption risk mapping expects a documented list with qualitative assessment, not necessarily a graphical heat map.
Which regulatory frameworks explicitly require a risk map?
Several frameworks require a risk map or its equivalent. Article 17(II)(3) of the French Sapin II law requires a corruption risk map. The AFA guidelines detail the expected methodology. Article 9 of EU Regulation 2024/1689 (the AI Act) requires a risk management system for each high-risk AI system, which includes a risk identification and assessment step equivalent to a risk map. ISO/IEC 27005:2022 requires a risk register for information security. ISO 37001 requires a bribery risk assessment. The common structure of all these requirements is identification, assessment, treatment, and periodic review with documented evidence.
Who should own the risk map in a mid-market company?
Ownership of the overall risk map typically sits with the risk manager, the chief compliance officer, or the chief financial officer, depending on the organisational structure. Individual risk entries must be owned by the business unit or functional manager most directly accountable for the underlying activity. Governance (board or audit committee) must approve the map and the risk appetite. Internal audit may assess the quality of the process. The distinction between the owner of the map (the person responsible for the process and the overall document) and the owner of individual risk entries (the person responsible for the accuracy of each entry and the progress of treatments) is essential to making the instrument operational.
How does a risk map feed the treatment workflow?
The risk map identifies which risks exceed the organisation's risk tolerance after existing controls are taken into account. Those risks require a treatment decision: accept, reduce, transfer or avoid. Each treatment option that requires action, for example adding a control or purchasing insurance, generates a task with a named owner and a target completion date. The map is updated when the treatment is completed and the residual risk is reassessed. This feedback loop, from map to treatment plan and back to map, is what transforms a static inventory into a live management instrument. Software that connects the map to a task management layer automates the loop and produces the evidence trail that audit and governance require.
What is the minimum content of a corruption risk map under Sapin II?
The AFA guidelines for Article 17 of the Sapin II law specify that the corruption risk map must identify the processes, activities, and third-party relationships that expose the organisation to bribery and corruption risks; assess each scenario by likelihood and potential impact; document the existing controls; and calculate a residual risk score. The map must be signed off by a named owner and reviewed regularly. The AFA inspects organisations against this standard; a map that is undated, unowned, or does not show residual risk after controls is not considered compliant.
Back to top
On the same topic