The Global Centre for Risk and Innovation (GCRI)
Enterprise risk management protects an organization's objectives; public risk management protects a population and its services. The two meet at shared infrastructure, outsourced public services, supply chains and the losses that firms cannot bear and governments end up carrying. This page sets out how each works, where their boundaries leave risks unowned, and what evidence helps executives and public officials align their management of shared exposures.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Hazards and exposure, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For enterprise and public risk, in GCRI's spatial-intelligence reading, the map opens on population density, night lights and true-colour imagery, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Enterprise and public sector risk management are the practices by which firms protect their objectives and governments protect populations and services. They meet at shared infrastructure, outsourced public services and supply chains, and in losses that firms cannot bear and governments carry. Linking their registers shows exposures neither sees alone.
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Enterprise and public risk · Enterprise A · Review cycle Q4
likelihood × impact, risks per cell
Counts of risks per cell. Shading follows the appetite bands.
| Supplier concentration | Procurement | High | ▲ 1 |
| Data centre flooding | Operations | High | ▲ 0 |
| Model error in pricing | Finance | Medium | ▲ 1 |
| Key staff loss | People | Medium | ▼ 1 |
Private, sovereign and community mandates. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Enterprise risk management weighs risks against an organization's own objectives and appetite. Losses that fall on customers, communities or other firms are counted only where law, contract or reputation brings them back.
When private resilience falls short, the public sector often absorbs the loss through emergency response, bailouts, compensation or lost services. These implicit commitments are rarely priced or recorded.
Public services delivered by contractors depend on the contractor's continuity, finance and suppliers. The public body remains accountable for the service even when it no longer controls the operation.
Corporate risk registers and national risk assessments describe overlapping exposures in different terms. Without a shared view, neither side sees the risks that sit between them.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Contingent liability | An obligation that depends on a future event, such as a guarantee or an implicit commitment to support. |
| Fiscal risk | The possibility of differences between expected and actual fiscal outcomes, including from contingent liabilities. |
| Exit clause | A contract term that sets how a service is transferred or continued if a supplier fails or the contract ends. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Contingent liabilities disclosed | count and type in public accounts | annual | Government financial statements and fiscal risk statements | OFFICIAL |
| Critical public services delivered by contractors | count of services | annual | Contract registers | OFFICIAL |
| Contracts with continuity and exit clauses | percent of critical contracts | annual | Contract management records | REPORTED |
| Principal risks linked to national risk categories | percent of disclosed principal risks | annual | Disclosure analysis | ESTIMATED |
| Public-private exercises held | count | annual | Exercise programme records | REPORTED |
| Emergency support provided to firms | count of support measures by type | per event | Public budget and aid records | OFFICIAL |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| IMF Fiscal Transparency Code and fiscal risk statements | Standards for disclosing fiscal risks and contingent liabilities | Public, IMF terms of use |
| Government financial statements and public accounts | Recorded provisions, guarantees and contingent liabilities | Public records, licence per government |
| Public contract registers and procurement portals | Which services are contracted out and to whom | Open data where published, licence per portal |
| Corporate annual reports and principal risk disclosures | How firms describe their risks and dependencies | Public records, terms per publisher |
| OECD reports on the governance of critical risks | Practice on public-private cooperation in risk management | Public, OECD terms of use |
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Ministries of finance | Which contingent liabilities to record, limit or provision | Fiscal risk notes; support measures in past events |
| Commissioning public bodies | Which continuity and exit terms to require in critical service contracts | Contract continuity reviews; supplier dependency maps |
| Corporate boards | Which of the firm's risks fall on public services or communities | Shared exposure maps; national risk crosswalks |
Each mandate has its own objectives, accountability and tools. Because none of them sees the whole system, risk tends to flow towards whoever is least able to refuse it or least able to see it coming.
Firms transfer risk through contracts, insurance and outsourcing. The risk does not disappear; it moves.
When losses are too large for others, public budgets absorb them, which can encourage risk-taking elsewhere.
Households and communities carry what no one else covers, often with little voice in the decisions that created it.
Structured processes for organizational risk. Limits: they focus inward and seldom capture risks imposed on others.
Government assessments of major risks to a country. Limits: quality and openness vary, and private dependencies are often unclear.
Tracing who bears losses across groups. Limits: data on household exposure is often weak.
Involving affected communities in risk assessment, supported by decision analysis. Limits: requires time, trust and resources.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.