GCRI · Systemic Risk Management
Enterprise and public risk
Enterprise risk management protects an organisation’s objectives; public risk management protects a population and its services. The two meet at shared infrastructure, outsourced public services, supply chains and the losses that firms cannot bear and governments end up carrying. This page sets out how each works, where their boundaries leave risks unowned, and what evidence helps executives and public servants align their management of shared exposures.
Enterprise and public risk on the record.
Enterprise and public risk: how the risk develops.
Private, sovereign and community mandates. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Firms manage their own loss
Enterprise risk management weighs risks against an organisation’s own objectives and appetite. Losses that fall on customers, communities or other firms are counted only where law, contract or reputation brings them back.
Government carries residual risk
When private resilience falls short, the public sector often absorbs the loss through emergency response, bailouts, compensation or lost services. These implicit commitments are rarely priced or recorded.
Outsourcing moves operations, not accountability
Public services delivered by contractors depend on the contractor’s continuity, finance and suppliers. The public body remains accountable for the service even when it no longer controls the operation.
Registers do not connect
Corporate risk registers and national risk assessments describe overlapping exposures in different terms. Without a shared view, neither side sees the risks that sit between them.
Hazards and exposure in Asia.
Population density, night lights and flood water over Asia, from NASA GIBS. Each layer carries its own date.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Hazards and exposure, for this page
About this layer
- Evidence
- Estimated
- Source
- Gridded Population of the World v4.11 (NASA SEDAC (CIESIN, Columbia University))
- Provider
- NASA SEDAC (CIESIN, Columbia University)
- Licence
- CC BY 4.0
- Vintage
- null; Census-based estimate, static (2020)
- Resolution
- about 1 km grid
- Uncertainty
- Census-based estimate of people per square kilometre in 2020, shown as exposure context; not a count of people affected by any hazard.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed
- Source
- VIIRS Black Marble (VNP46A2) (NASA LAADS DAAC)
- Provider
- NASA LAADS DAAC
- Licence
- NASA open data
- Vintage
- daily; Satellite radiance, corrected for moonlight and atmosphere
- Newest at build
- 2026-10-12
- Resolution
- about 500 m grid
- Uncertainty
- Satellite night-time radiance for the date shown; lights are a proxy for electricity use and outages, not a measurement of supply or access.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed (clouds leave gaps)
- Source
- VIIRS Global Flood Product (NASA LANCE)
- Provider
- NASA LANCE
- Licence
- NASA open data
- Vintage
- daily; Satellite detection; clouds leave gaps
- Newest at build
- 2026-10-14
- Resolution
- about 250 m grid
- Uncertainty
- Satellite detection; clouds leave gaps. Satellite or model raster as the provider publishes it. Clouds, swath gaps and retrieval error leave gaps and noise; values are indicators, not measurements at a place.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed
- Source
- VIIRS NOAA-20 corrected reflectance (NASA LANCE)
- Provider
- NASA LANCE
- Licence
- NASA open data
- Vintage
- daily; Satellite image
- Newest at build
- 2026-10-14
- Resolution
- about 250 m grid
- Uncertainty
- Satellite image. Satellite or model raster as the provider publishes it. Clouds, swath gaps and retrieval error leave gaps and noise; values are indicators, not measurements at a place.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Observed (clouds and overpass timing leave gaps)
- Source
- VIIRS NOAA-20 375 m (FIRMS) (NASA LANCE FIRMS)
- Provider
- NASA LANCE FIRMS
- Licence
- NASA open data
- Vintage
- daily; Satellite detection; clouds and overpass timing leave gaps
- Newest at build
- 2026-10-13
- Resolution
- about 500 m grid
- Uncertainty
- Satellite hot-spot detections for the day shown, including gas flares and industrial heat; not a confirmed fire, an incident report or a warning.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
About this layer
- Evidence
- Modelled (latest year GIBS publishes)
- Source
- MODIS Terra and Aqua land cover (MCD12Q1) (NASA LP DAAC)
- Provider
- NASA LP DAAC
- Licence
- NASA open data
- Vintage
- yearly; Satellite classification; latest year GIBS publishes
- Newest at build
- 2024-01-01
- Resolution
- about 500 m grid
- Uncertainty
- Satellite land cover classes for the year shown, including croplands; a classification with known errors, not a farm register.
- Reached through
- gibs.earthdata.nasa.gov, only after you allow the live map
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Hazards and exposure, framed on Asia.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.
Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · U.S. Geological Survey · NASA JPL OPERA DIST-ALERTSources and licences
- We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
- VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- NASA Fire Information for Resource Management System (FIRMS), VIIRS 375 m active fire product, NASA LANCE; vector tiles via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- MODIS land products (vegetation indices, gross primary production, land cover), NASA LP DAAC and LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
- Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
- © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
- Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
- Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
- Live: NASA EONET Events are indicative, not authority warnings.
- Live: U.S. Geological Survey Events are indicative, not authority warnings.
- Observed (EO): NASA JPL OPERA DIST-ALERT (contains modified Copernicus Sentinel data 2026). We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS).
- NASA GIBS: We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS).
- River discharge forecast, 30 days with range (GloFAS via Open-Meteo): Contains modified Copernicus Emergency Management Service information 2026; not a flood warning.
- Weather data by Open-Meteo.com (https://open-meteo.com/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
- Optional layers (11 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.
Layers and dates
- Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
- Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
- Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
- True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026
- Active fires and thermal anomalies: VIIRS NOAA-20 375 m (FIRMS), NASA LANCE FIRMS · 13 Oct 2026
- Land cover type (IGBP), yearly: MODIS Terra and Aqua land cover (MCD12Q1), NASA LP DAAC · 2024
Public and enterprise risk meet in shared infrastructure and services.
- WaterCouplingPublic utilities manage enterprise risk while carrying a public service duty.What to watchService obligations in licences
- EnergyCouplingPrivate generators and public security of supply objectives must be reconciled.What to watchCapacity obligations
- FoodCouplingPrivate logistics carry public food security risk.What to watchPrivate stockholding information
Findings are designed for the Global Sector Risk and Resilience series. The page sets out how ERM practice under COSO and ISO 31000 connects to national risk assessment under the OECD Recommendation of 2014.
- Cases where enterprise and public risk management were joined up.
- National risk assessment methods that draw on firms’ data.
Risk register.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Risk register
Enterprise and public risk · Enterprise A · Review cycle Q4
Residual risk
likelihood × impact, risks per cell
Counts of risks per cell. Shading follows the appetite bands.
Above appetite
| Supplier concentration | Procurement | High | ▲ 1 |
| Data centre flooding | Operations | High | ▲ 0 |
| Model error in pricing | Finance | Medium | ▲ 1 |
| Key staff loss | People | Medium | ▼ 1 |
Risk management process, after the international standard
- Scope, context, criteriaset
- Identifytaxonomy
- Analyselikelihood · impact
- Evaluatevs appetite
- Treatplans
- Monitor and reviewKRIs
- Record and reportboard
Treatment actions
- T-11Dual-source critical componentOwner: procurement · overdue6 d late
- T-14Move backup site above flood levelOwner: operationsdue 16 d
- T-17Independent model validationOwner: financedue 38 d
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Contingent liabilities disclosed | count and type in public accounts | annual | Government financial statements and fiscal risk statements | Published statistics |
| Critical public services delivered by contractors | count of services | annual | Contract registers | Published statistics |
| Contracts with continuity and exit clauses | percent of critical contracts | annual | Contract management records | REPORTED |
| Principal risks linked to national risk categories | percent of disclosed principal risks | annual | Disclosure analysis | ESTIMATED |
| Public-private exercises held | count | annual | Exercise programme records | REPORTED |
| Emergency support provided to firms | count of support measures by type | per event | Public budget and aid records | Published statistics |
Model enterprise and public risk as a system. Run the cascade.
Assembled from the Nexus Standards area profile Global and systemic risk: the hazards it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Choose the components, pick an initiating hazard and step through the cascade. The Map view places the run on an example geography with open data. Every coupling weight is a stated assumption you can change. A teaching model, not a forecast, an assessment or a certification. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- Financial contagion
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
- Sovereign debt crisis (set off downstream)
- Currency crisis (set off downstream)
Systems and couplings
- Global and systemic risk
- Compound and cascading hazard standards Mechanism
- Financial stability and prudential risk Mechanism
- Supply chain and trade risk Cascade
- Future generations and long-term risk Common driver
Controls
NS-0Constitution and principlesNS-3Risk record UNIs (grammar, legacy crosswalk, allocation authority)NS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-14Conformance and crosswalk to external standardsNRS-H120Hazard family: Structural fragility of interconnected systems (NHS-1 sys.fragility)NRS-C6Systemic and cascading riskNRS-H61Hazard family: Cascading failure (NHS-1 sys.cascade)NRS-H62Hazard family: Compound and multi-hazard events (NHS-1 sys.compound)NRS-H94Hazard family: Systemic cyber events (NHS-1 cyber.systemic-cyber)NRS-H60Hazard family: Supply-chain and flow disruption (NHS-1 sys.supply-chain)
Observation
- INFORM Risk Index (listed for reference)
- World Bank Open Data and World Development Indicators API (listed for reference)
- IMF data services (WEO, IFS, FSI via SDMX) (listed for reference)
- Direct economic loss attributed to disasters in relation to global GDP
- Macroeconomic Dashboard
Example geography
- Bangladesh: 134 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| IMF Fiscal Transparency Code and fiscal risk statements | Standards for disclosing fiscal risks and contingent liabilities | Public, IMF terms of use |
| Government financial statements and public accounts | Recorded provisions, guarantees and contingent liabilities | Public records, licence per government |
| Public contract registers and procurement portals | Which services are contracted out and to whom | Open data where published, licence per portal |
| Corporate annual reports and principal risk disclosures | How firms describe their risks and dependencies | Public records, terms per publisher |
| OECD reports on the governance of critical risks | Practice on public-private cooperation in risk management | Public, OECD terms of use |
How enterprise and public risk is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Model, equations and assumptions
The model structure used for enterprise and public risk, the assumptions it makes and how each is tested.
Ri = f(Hi, Ei, Vi, Ci)hazard, exposure, vulnerability and coping capacityEAL = ∑k pk · Lkover events k with annual probability pkxt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| Assumption | Why it is made | How it is tested |
|---|---|---|
| Hazard and exposure are independent within an event | Keeps the loss integral tractable | Compare with a copula fit on joint records |
| Couplings are linear near the operating point | Lets shocks propagate through A | Perturb beyond the linear range and compare |
| Vulnerability curves transfer between places | Local curves are rarely available | Validate against observed losses where they exist |
- Inputs
- versioned datasets with provenance
- Outputs
- distributions, never single numbers
- Code
- released with the model card and tests
- Reproduction
- same data, code, environment and seed
Who decides, and what the evidence serves.
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Ministries of finance | Which contingent liabilities to record, limit or provision | Fiscal risk notes; support measures in past events |
| Commissioning public bodies | Which continuity and exit terms to require in critical service contracts | Contract continuity reviews; supplier dependency maps |
| Corporate boards | Which of the firm’s risks fall on public services or communities | Shared exposure maps; national risk crosswalks |
Outputs this topic produces
- Maps of shared exposures between firms and public services
- Fiscal risk notes on implicit public commitments
- Contract continuity reviews for outsourced critical services
- Crosswalks between corporate and national risk categories
What experts ask about mandates.
- Which risks does each mandate cover, and which fall between them?
- When a firm reduces its own risk, where does that risk go?
- How do governments act as insurers of last resort, and how does that change private behaviour?
- How can communities, which bear many consequences, take part in decisions about risk?
How risk moves between mandates.
Each mandate has its own objectives, accountability and tools. Because none of them sees the whole system, risk tends to flow towards whoever is least able to refuse it or least able to see it coming.
Risk transfer
Firms transfer risk through contracts, insurance and outsourcing. The risk does not disappear; it moves.
Implicit backstop
When losses are too large for others, public budgets absorb them, which can encourage risk-taking elsewhere.
Residual risk
Households and communities carry what no one else covers, often with little voice in the decisions that created it.
How cross-mandate risk is analysed.
- 01
Enterprise risk frameworks
Structured processes for organisational risk. Limits: they focus inward and seldom capture risks imposed on others.
- 02
National risk assessments
Government assessments of major risks to a country. Limits: quality and openness vary, and private dependencies are often unclear.
- 03
Distributional analysis
Tracing who bears losses across groups. Limits: data on household exposure is often weak.
- 04
Participatory methods
Involving affected communities in risk assessment, supported by decision analysis. Limits: requires time, trust and resources.
How it is studied, and what the methods cannot say.
- 01Decision analysis under uncertaintyMulti-criteria treatment choice · Decision trees for contingent plansApplied here
- 02Scenario design and stress testingCross-sector scenario design · Reverse stress testing · Second-round effectsApplied here
- 03Network science and contagionDependency network mapping · Centrality and concentration · Failure propagation simulationApplied here
Where this page’s references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is enterprise risk management?
What is a contingent liability?
Why connect corporate and public risk registers?
Why does risk transfer matter systemically?
Is public risk management different in kind?
Does the platform advise governments?
Contribute evidence from this page.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.