Risk Heatmap

1) Purpose and value

A risk heatmap is a visual tool for ranking and communicating risks on a "Likelihood × Impact" matrix, linked to controls, metrics and action plans.

• a common prioritization language (business, technical and legal teams);
• transparent CAPA/investment decisions;
• tracking of dynamics (before/after measures) and "audit-ready" status.

2) Taxonomy and scope

• Regulatory/Licensing, Privacy/Data, InfoSec/Tech processes, Payments/AML/KYC, Operations/Availability, Marketing/Responsible advertising, Suppliers/VRM.

• Jurisdictions/markets, Business lines/products, Services/platforms, Critical providers.

3) Likelihood and impact scales

3.1 Likelihood (example of a 5-level scale)

1. Rare (once in >3 years / p<5%)

2. Low (once in 1–3 years)

3. Medium (annually)

4. High (quarterly)

5. Very high (monthly or more often)

3.2 Impact (multi-factor)

• Finance: direct losses/fines/chargebacks.
• Licensing/Legal consequences: suspension, bans, investigations.
• Privacy/Data: volume of PII, notifications, supervisory action.
• Operations/Uptime: MTTR, SLO, failed releases, RTO/RPO.
• Reputation: media, social networks, partner sanctions.
• A 1–5 scale with clear thresholds (e.g. 1: <€10k, 5: >€1m).

4) Scoring and risk levels

Individual risk: `Score = Likelihood × Impact` (1–25).

• 20–25 — Critical (red)
• 12–19 — High (orange)
• 6–11 — Medium (yellow)
• 1–5 — Low (green)
• Residual risk: after accounting for current controls (effectiveness confirmed by ToD/ToE/CCM).
• Target risk: after the planned measures; the target date is recorded.

5) Data sources and links to controls

GRC register: risk descriptions, owners, current/target scores.
CCM/metrics: pass rate of control rules, incidents, KRIs.
Vendors/VRM: certificates, SLAs, incidents, changes in data locations.
Finance/Payments: fines, chargeback ratio, fraud loss %.
All values that affect the scales must have evidence links (logs/reports) and timestamps.

6) Aggregation and consolidation

Bottom-up: from services/jurisdictions to domains and the company.
Aggregation rules: maximum for Impact, a percentile for Likelihood, or a weighted median (by business volume).
Separate layers: Inherent (without controls), Residual (with controls), Target (after CAPA).
Separate correlated risks (e.g. a shared infrastructure vulnerability) from independent ones.

7) Visualization

A color-coded 5×5 matrix; interactive risk points with pop-up cards (description, owner, controls, CAPA).
Layer switches: Inherent / Residual / Target.
Filters: jurisdiction, product, domain, provider, period.
"Before/after" trends for measures and drift over 30–90 days.

8) Roles and RACI

9) KRIs and escalation thresholds

• Privacy: dsar_response_p95, TTL-based deletion, complaints/ombudsman.
• Security: vulnerability p95 TTR, share of critical "red" CCM rules, SoD violations.
• Payments: chargeback ratio, fraud loss %, appeal win rate.
• Operations: SLO breach rate, P1/P2 incidents, RTO/RPO tests.
• Escalations: Amber when warning thresholds are exceeded; Red means mandatory CAPA and "stop-the-line" for critical areas.

10) Decision-making and the link to CAPA

Every "red" point requires an action plan: Corrective/Preventive, owner, deadline, budget, success KPI.

• Critical: CAPA ≤ 30 days, re-audit after 60–90 days; weekly committee.
• High: CAPA ≤ 60 days, 90-day monitoring.
• Medium/Low: into the quarterly/half-year plan.
• If the risk cannot be reduced, a waiver with an expiry date and compensating controls.

11) Dashboards (minimum)

Heatmap View: the current matrix + Residual/Target layers.
Risk Trend: score dynamics, "before/after CAPA".
Controls Linkage: CCM pass rate per risk, "red" gates.
Regulatory Exposure: risks by jurisdiction and license.
Vendor Risk: a heatmap of critical providers (certificates, SLAs, incidents).
Audit-Readiness: evidence completeness/hash receipts per risk.

12) Effectiveness metrics

Risk Reduction Index: ∆ of the weighted average risk score quarter over quarter.
On-time CAPA: % of measures completed on time (by severity).
Repeat Findings (12 months): share of repeat findings for related risks.
Evidence Completeness: % of risks with a complete evidence pack.
Drift After Fix: cases of returning to the "red" zone 30–90 days later.
Coverage: share of business assets/jurisdictions reflected on the map.

13) SOPs (standard procedures)

SOP-1: Methodology setup

Define scales and thresholds → agree them in the Committee → record them in the repository (versioned).

SOP-2: Quarterly cycle

Collect inputs/KRIs → recalculate scores → owner review → committee decisions → publish dashboards → export the "audit pack".

SOP-3: Incident trigger

On a Critical/High incident: an unscheduled map update, a link to CAPA and a re-audit plan.

SOP-4: Vendor perimeter

VRM questionnaire/certificates → update supplier risks → confirm mirrored measures (Vendor Mirror).

SOP-5: Archive and evidence

Heatmap snapshots (PDF/PNG/CSV) + hash receipts → WORM archive → links in GRC.

14) Artifact templates

14.1 Risk card (excerpt)

ID/Name, owner, domain/jurisdictions

Likelihood/Impact/Inherent/Residual/Target

Controls (ID, metrics, CCM rules)

KRIs and actual values

CAPA/waivers, dates, budget, KPIs

Evidence links and hash receipts

14.2 Scale policy (excerpt)

Likelihood:
1: p<5% / >3y
3: annual
5: monthly+
Impact (finance):
1: <€10k
3: €100k–€300k
5: >€1m
Escalation:
Critical: CAPA≤30d; Committee weekly
High: CAPA≤60d; Committee bi-weekly

14.3 "Before/after" report

Heatmap screenshots (Residual vs Target)

Table of ∆ changes per risk

Completed CAPAs, sustainability metrics

15) Anti-patterns

A "pretty picture" with no link to controls/KRIs and CAPA.
Vague scales → manipulated scores.
No versioning/evidence for score changes.
Summing incomparable risks without aggregation rules.
Infrequent updates → the map does not reflect reality.
Waivers without deadlines or compensating measures.

16) Maturity model (M0–M4)

M0 Ad hoc: a one-off picture, no methods/metrics.
M1 Planned: agreed scales, quarterly updates.
M2 Managed: links to controls/KRIs, CAPA, dashboards, WORM archive.
M3 Integrated: automatic recalculation (CCM), policy-/assurance-as-code, slices by jurisdiction/vendor.
M4 Continuous Assurance: predictive KRIs, scenario modeling, "what-if", priority recommendations.

17) Related wiki articles

Risk-Based Auditing (RBA)

Compliance KPIs and metrics

Continuous Compliance Monitoring (CCM)

Corrective Action Plans (CAPA)

Re-audits and enforcement follow-up

Policy and standards repository

Compliance roadmap

Compliance guide for partners / VRM

Summary

A risk heatmap is not a report but a management mechanism: common scales, links to controls and KRIs, regular updates, demonstrable decisions and sustainability checks after measures are taken. This approach makes prioritization objective, speeds up committee decisions and keeps you permanently "audit-ready".