The Global Centre for Risk and Innovation (GCRI)
Risks that are not named are not managed. Identification finds the hazards, threats, vulnerabilities and consequences that matter, and a taxonomy gives them shared names and classes so that registers can be compared, aggregated and linked. This page sets out how identification works, where taxonomies help and where they hide interconnection, and the reference vocabularies that make one register readable beside another.
Identification and risk taxonomy · Enterprise A · Review cycle Q3
likelihood × impact, risks per cell
Counts of risks per cell. Shading follows the appetite bands.
| Supplier concentration | Procurement | High | ▲ 1 |
| Data centre flooding | Operations | High | ▲ 0 |
| Model error in pricing | Finance | Medium | ▲ 0 |
| Key staff loss | People | Medium | ▼ 0 |
Fig.Risk register. Design wireframe with placeholder names and illustrative values, not a record or a live system.
A risk taxonomy is a structured set of names and categories used to describe risks consistently, so registers can be compared and combined. Identification finds the hazards, threats and consequences that matter. Reference vocabularies such as the UNDRR-ISC Hazard Information Profiles let national and organizational registers describe the same hazard in the same terms.
For identification and risk taxonomy, in GCRI's spatial-intelligence reading, the map opens on population density, true-colour imagery and flood water, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Hazards and exposure, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For identification and risk taxonomy, in GCRI's spatial-intelligence reading, the map opens on population density, true-colour imagery and flood water, framed on Asia; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Risk identification beyond registers. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Workshops and registers list the risks people have seen before. Novel, slow or cross-sector risks are under-identified unless horizon scanning, scenario work and external sources are used deliberately.
A taxonomy that sorts risks into separate boxes, such as operational, financial and strategic, can hide the links between them. Risks that span categories are split or counted twice.
Two organizations describe the same hazard in different terms and at different levels of detail. Without a shared reference vocabulary, their registers cannot be combined into a picture of shared exposure.
A register reviewed once a year misses emerging risks and keeps retired ones. Without triggers for review, the list drifts away from the organization's real exposure.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Risk identification | The process of finding, recognising and describing risks that could affect objectives. |
| Risk register | A record of identified risks with their owners, assessments, treatments and review dates. |
| Hazard | A process, phenomenon or human activity that may cause loss of life, injury, damage or disruption, in UNDRR usage. |
| Horizon scanning | A systematic search for early signs of emerging risks and opportunities beyond current planning. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Register entries mapped to a reference taxonomy | percent of entries | per review | Risk register | REPORTED |
| Emerging risks added | count per review cycle | per review | Horizon scanning records | REPORTED |
| Risks spanning more than one category | count | per review | Risk register with linked categories | REPORTED |
| Time since last register review | months | continuous | Register metadata | OBSERVED |
| Hazards covered against a reference list | percent of applicable hazard profiles | annual | Comparison with UNDRR-ISC Hazard Information Profiles | ESTIMATED |
| External sources consulted in identification | count by type | per review | Identification method record | DECLARED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| UNDRR-ISC Hazard Information Profiles | Standard definitions and descriptions of hazards across natural, technological, biological and societal clusters | Public, UNDRR and ISC terms of use |
| UNDRR terminology on disaster risk reduction | Agreed definitions of hazard, exposure, vulnerability, capacity and related terms | Public, UN terms of use |
| National risk registers and national risk assessments | Government-published lists of risks with their descriptions and assessment approach | Public records, licence per government (UK under Open Government Licence) |
| IEC 31010 Risk assessment techniques | Descriptions of identification techniques such as checklists, HAZOP and scenario analysis | Licensed standard, purchase required |
| IRDR Peril Classification and Hazard Glossary | A hierarchical classification of perils used in loss databases | Public, IRDR terms of use (to check) |
Systemic Risk Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Chief risk officers and risk teams | Which taxonomy the register should follow, and how emerging risks enter it | Crosswalks; register health checks; identification protocols |
| National risk assessment teams | Which hazards and threats belong in the national register | Coverage against reference hazard profiles; peer register comparison |
| Sector regulators | Which risk classes regulated entities must report in a common format | Taxonomy options with their mapping to existing reporting |
Identification fails less from lack of effort than from the way organizations are built. Registers mirror the organization chart, so each unit reports the risks it owns and few report the risks that arise between units or outside the organization altogether.
A taxonomy that separates operational, financial and strategic risks can hide a single cause behind all three.
Registers are updated incrementally and drift away from how the organization and its environment actually work.
People overweight recent and vivid events and underweight unfamiliar ones.
A formal structure of concepts and relationships, such as cause, event, consequence and control, that lets risks be linked rather than only listed. Building one takes sustained effort and agreement on terms.
Bow-tie diagrams, fault trees and causal loop diagrams expose shared causes and pathways. They are only as complete as the knowledge of those who build them.
Structured search for weak signals of emerging risk. It produces many false alarms and needs disciplined follow-up.
Pre-mortems, red teams and cross-functional reviews widen perspective. Group dynamics can still suppress dissent.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.