Risk Taxonomy

Usually it is a hierarchy: top-level categories such as financial, operational, strategic, compliance and reputational, each split into narrower groups. Operational risk, for example, can divide into people, process, systems and external events. The project version, the risk breakdown structure, organises sources of risk for one project, such as technical, commercial, external and management. Clear definitions stop two teams using one word for different things. A taxonomy lets firms combine risks into one register, compare business units, link risks to controls and loss events, and report to the board by category. It should be stable enough to compare over time but revisited when the business changes. A taxonomy only classifies; it does not rate risks. Group-level loss figures add up only when each team files an event under the same label.

After a merger, one insurer classes a mis-paid claim as operational risk while the other calls the same event processing risk and counts it under technology. The merged group adopts a single taxonomy with three levels and written definitions, maps the old registers to it, and can finally add up losses by category across the whole group.