Risktaxonomi

Risktaxonomi, or risk taxonomy, is a structured framework for organizing and classifying risks into categories and subcategories to support identification, assessment, measurement, reporting, and governance across an organization. It provides a standardized vocabulary and a navigable map of risk that enables aggregation and comparison across units and time.

The primary purpose is to create a common language, facilitate data collection, and align risk categorization with an organization’s risk appetite, controls, and regulatory expectations. A well-designed taxonomy supports trend analysis, scenario planning, and portfolio-level risk visibility.

A typical taxonomy is hierarchical, with top-level domains such as strategic, financial, operational, compliance, information technology and cyber, environmental and social governance (ESG), and reputational risk. Each domain contains subcategories with definitions, criteria, and indicators. For example, financial risk may include credit risk, market risk, and liquidity risk; IT risk may include cyber risk and data privacy risk.

Development and maintenance involve collaboration among risk managers, business units, and governance bodies. It requires clear definitions, decision rules, scoring criteria, and a registry or data model that maps risks to controls, indicators, and reporting systems. Taxonomies are regularly reviewed to reflect new threats, regulatory changes, and business strategy.

Usage includes risk registers, dashboards, appetite statements, and regulatory reporting. Taxonomy mappings also support data harmonization, benchmarking, and cross-project risk communication and governance.