Enterprise Risk Map: What It Is and How to Build One (With Example)

Maxim Atanassov • August 13, 2024

An enterprise risk map is a one-page picture of an organization's principal risks: how likely each one is, how much damage it could do, who owns it, which way it is moving, and whether it sits inside or outside the board's risk appetite. Most risk maps plot risks on a likelihood-by-impact grid. What makes the map enterprise-wide is its scope: it covers strategic, operational, financial and compliance risks across the whole organization, and it ties each one to an objective.

Risk map vs. heat map vs. assurance map

People use "risk map" and "heat map" interchangeably. The distinction is worth keeping.

Tool	What it shows	Question it answers
Risk heat map	A likelihood-by-impact grid, coloured from green to red	How big is each risk?
Enterprise risk map	The principal risks on that grid, plus owner, trend, objective and appetite	Which risks matter most, and are they where we want them?
Assurance map	Who gives assurance over each principal risk	How do we know each risk is controlled?

The heat map is the format; the enterprise risk map is the content the board reviews; the assurance map tests whether the controls behind it work.

What goes on an enterprise risk map

Principal risks: 10 to 20, drawn from the risk register. Each has an ID and a one-line description.
Category: strategic, operational, financial or compliance.
Objective: the business objective the risk threatens.
Owner: one named executive per risk.
Likelihood and impact: rated on defined scales, usually 1 to 5.
Inherent and residual position: where the risk sits before and after controls.
Trend: rising, stable or falling since the last review.
Risk appetite line: the boundary between risks the board accepts and risks it must act on.
Date and version: the period the map covers and when it was last updated.

How to build an enterprise risk map in eight steps

1. Start from the objectives

List the organization's strategic objectives for the next one to three years. A risk earns a place on the map only if it threatens one of them.

2. Identify the principal risks

Run interviews and workshops with the executive team and business unit heads. Include internal and external risks, and threats as well as missed opportunities. Consolidate them into 10 to 20 principal risks; the full list stays in the register. Our guide to leading risk management workshops covers how to run these sessions.

3. Define the scales

Write down what each level means. For impact, use the organization's own measures: dollars of lost earnings, days of outage, regulatory action, harm to people, reputation. For likelihood, use a probability or a frequency over a stated period, such as "more than 50% in the next 12 months." Undefined scales are the main reason two executives rate the same risk differently.

4. Rate each risk twice

Rate the inherent risk (before controls) and the residual risk (after the controls in place today). The gap between the two shows how much the organization relies on its controls.

5. Score and colour the grid

Multiply likelihood by impact for a score from 1 to 25. A common banding: 1 to 4 low (green), 5 to 12 medium (amber), 15 to 25 high (red). Agree on the bands with the board, not just the risk team.

6. Plot the risks

Place each risk by its residual rating. Show the inherent position as a faded marker or an arrow, and size the marker by score or by financial exposure if the map is digital.

7. Draw the risk appetite line

Mark which cells exceed the board's appetite. Any risk beyond the line needs a response plan, an owner and a date. See our guide to risk appetite.

8. Add context, review and repeat

Add trend arrows and, where risks drive each other, lines between them. Have each owner validate their risks, then present the map to the executive team quarterly and to the board or its risk committee at least twice a year.

A worked example

A mid-sized manufacturer maps six principal risks. Scores are residual (after controls).

ID	Principal risk	Objective threatened	Owner	Likelihood (1 to 5)	Impact (1 to 5)	Score	Trend	Inside appetite?
R1	Loss of the largest customer	Grow revenue 10% a year	Chief Revenue Officer	2	5	10	Rising	Yes, at the limit
R2	Ransomware attack halts production	Keep plant uptime above 95%	Chief Information Officer	3	5	15	Rising	No
R3	Single-source supplier failure	Keep plant uptime above 95%	Chief Operating Officer	3	4	12	Stable	No
R4	Covenant breach on the credit facility	Fund the expansion	Chief Financial Officer	1	5	5	Falling	Yes
R5	Serious workplace injury	Zero harm	VP Operations	2	4	8	Stable	Yes
R6	New packaging regulation	Launch the new product line	General Counsel	4	2	8	Rising	Yes

Plotted on the grid:

Impact ↓ / Likelihood →	1 Rare	2 Unlikely	3 Possible	4 Likely
5 Severe	R4	R1	R2
4 Major		R5	R3
3 Moderate
2 Minor				R6
1 Insignificant

Two risks, R2 and R3, sit outside appetite, and both threaten the same objective: plant uptime. That link is what the board should discuss. A list of red cells would not reveal it; a map tied to objectives does.

Limitations, and how to work around them

False precision. A score of 12 looks exact; it rests on two judgments. Louis Anthony Cox Jr. showed in "What's Wrong with Risk Matrices?" (Risk Analysis, 2008) that matrices can rank risks wrongly. Use the map to frame the conversation, and quantify the top risks in dollars where the decision is large. Douglas Hubbard's The Failure of Risk Management explains how.
Snapshot, not film. A map ages fast. Trend arrows and quarterly updates help; key risk indicators fed from live data help more.
Risks shown in isolation. A grid hides how risks compound. Draw the links between related risks, as in the example, or run scenario tabletop exercises on clusters.
Ratings drift. Without written scale definitions, ratings rise and fall with the mood in the room.

For a fuller critique, see why your current risk assessment process sucks.

From map to action

Each zone of the map calls for a response:

Outside appetite: reduce the likelihood or the impact, transfer the risk (insurance, contracts), or avoid the activity. Assign an owner and a date.
At the limit: monitor with key risk indicators and agree on the trigger that moves the risk into action.
Inside appetite: accept and review at the next cycle.

See effective risk mitigation strategies and how to prioritize risk.

Frequently asked questions

What is risk mapping?

Risk mapping is the process of identifying an organization's principal risks, rating their likelihood and impact, and plotting them on a grid so leaders can see which need action. In enterprise risk management, it also links each risk to an objective, an owner and the board's risk appetite.

How do you create a risk map?

Start from the objectives, identify the principal risks, define likelihood and impact scales, rate each risk before and after controls, score and colour the grid, plot the risks, draw the appetite line, and review the map with the owners and the board.

What should you put on a risk map?

Each principal risk's ID, description, category, owner, objective threatened, likelihood, impact, trend, and its position relative to risk appetite, plus the date the map was last updated.

Is a risk map the same as a risk matrix?

A risk matrix is the likelihood-by-impact grid with its scoring rules. A risk map is that grid populated with the organization's risks and their context.

How often should an enterprise risk map be updated?

Quarterly for the executive team, at least twice a year for the board, and immediately after a major event such as an acquisition, a new regulation or an incident.