From Risk Lists to Risk Maps

Most organisations manage risk as a list of problems. Few map how those problems move. This post explains why lists miss what matters, how risk maps reveal connections, and why seeing disruption as a system is the first step toward stronger supply chain resilience.

Most teams keep a risk register. Few keep a risk map. The register names threats. The map shows how trouble moves and where you can stop it.

In a polycrisis environment, interaction beats accumulation. Five small stresses that reinforce each other can cause more damage than one large hazard. That is why lists underperform. Risk maps help you act in the right place at the right time.

Three quick shifts

• From rows to flows. List the event, then draw how it travels through your network.
• From probability to controllability. Score where you can act with effect.
• From buffers to switches. Pair each pathway with a pre-authorised move.

What risk lists miss

Registers treat items as independent. Operations do not. A shipping delay becomes a cash squeeze. A cash squeeze cuts supplier capacity. Lower capacity triggers premium freight. Premium freight erodes margins and service.

The links matter more than the nodes. Without the links, teams fix symptoms and re-incur the costs one step downstream.

Two warning signs are common:

1. Heat maps that change colour but never change decisions.
2. Repeated incidents with new owners and the same root logic.

What a risk map contains

A good map fits on one page. It shows:

• Stresses: background pressures that shape fragility. Examples: supplier concentration, shallow inventory, single-threaded data flows.
• Triggers: thresholds or events that flip the state. Examples: transit time exceeds limit, a cyber breach, a credit downgrade.
• Crises: the outcomes leaders feel. Examples: missed OTIF, cost spikes, cash strain, trust damage.
• Propagation pathways: physical, informational, financial, and reputational routes through which disruption spreads.
• Switches: specific interventions tied to a trigger and pathway. Examples: mode swaps, telemetry fallbacks, credit holds, communication playbooks.
• Owners and cadence: who runs the switch, and how often the map is updated.
• Metrics: exposure × controllability (E×C) scores and time from signal to action.

Together, these turn a static list into a system map that shows how risk behaves.

Mini-case: a small upstream shock that spreads

A tier-two component plant floods. Your tier-one supplier warns of a two-week slip.

• Physical pathway: the supplier reallocates scarce capacity to its largest customer. Your confirmed orders become soft holds. You shift part of the transport mix to air.
• Informational pathway: engineering approves a temporary substitute. ERP lag hides the change from planning. Forecast error grows at SKU level.
• Financial pathway: premium air freight costs rise. A distributor delays payment. Treasury raises the weekly cash buffer.
• Reputational pathway: a key account misses a launch milestone. Your account team absorbs the pressure.

A list would label this as supplier disruption. A map would reveal three early switches: a pre-approved alternate component, a temporary allocation rule for key accounts, and a clean data message to planning.

Decision time drops. The blast radius shrinks. You avoid paying twice.

Build your first map in a week

Day 1: Frame the field.
Identify five to seven material stresses. Define the crisis states that matter: service, cost, cash, reputation.

Day 2: Make triggers explicit.
Set thresholds, not guesses. Example: “Transit time exceeds twelve days for three consecutive sailings.”

Day 3: Trace one hop per pathway.
For your top triggers, draw how each pathway carries the shock. Use one verb per arrow. Keep it clear.

Day 4: Score E×C and pick switches.
Score exposure and controllability on a one-to-three scale. Choose three switches you can execute inside forty-eight hours. Assign an owner.

Day 5: Set cadence and publish.
Review monthly. Archive stale items. Promote emerging stresses. Update triggers as conditions change. Share the map and the switch list where people actually work.

What this means for operators

• Model the flow. Trace stress to trigger to crisis across each pathway.
• Fund switches. Build option value with pre-authorised moves.
• Track latency. Measure signal to decision to action and shorten the gap.
• Standardise language. Use STC, pathways and E×C across teams.

Book a 30-minute discovery call with The Signal House to learn how to design and embed living risk maps across your organisation.