Risk mapping: the complete 7-step method

What are the ten events that could prevent your company from achieving its objectives this year? If your executive committee gives ten different answers, you need risk mapping. This tool lists, assesses and ranks the organisation's risks so that management can focus its efforts where the stakes are real. Done well, it becomes the common language of the board, the CEO and operational teams.

Yet many risk maps remain documents produced for an auditor, a funder or a partner bank, then forgotten. Here we set out the seven-step method we apply at Hodemia Consulting, inspired by international frameworks and by our engagements in Europe, the Gulf and Algeria, with a simple goal: a risk map that is useful, alive and actually used to make decisions.

1. Why risk mapping is the cornerstone of the framework

A decision tool before it is a deliverable

Risk mapping lies at the heart of business risk management: without it, you cannot set a risk appetite, steer internal control or build a risk-based audit plan. It also allows limited resources to be allocated rationally, avoiding overinvestment in minor risks while major exposures go unmonitored.

Growing expectations in Algeria

Banks and financial institutions must maintain internal control and risk measurement and monitoring systems in line with Bank of Algeria regulation No. 11-08 of 28 November 2011. On anti-money laundering, Law No. 25-10 of 24 July 2025 requires a national and sectoral risk assessment shared with obliged entities, which must in turn assess their own risks. Beyond the financial sector, lending banks, foreign investors and major clients increasingly ask to see a company's risk map before committing.

Recognised frameworks

Two frameworks structure the approach: the ISO 31000 standard (2018 version), which describes a process of risk identification, analysis, evaluation and treatment, and the COSO ERM framework (2017 version), which links risks to strategy and performance. The method below follows their spirit in an operational form.

2. Steps 1 and 2: framing the exercise and identifying risks

Step 1: set the framework

Before listing a single risk, make three decisions. First, the scope: the whole company, a subsidiary, a project or a process. Next, the reference objectives, because a risk only exists in relation to an objective: revenue growth, production continuity, compliance, reputation. Finally, the scoring scales, which must be defined before the workshops, otherwise everyone will score according to their own perception. Also appoint a sponsor at CEO level and a coordinator, often the head of risk or internal control.

Step 2: risk identification

Identification combines several sources so that nothing is left in a blind spot:

• interviews with executive committee members and process owners;
• cross-functional workshops, where the clash of viewpoints brings out risks no one would have raised alone;
• analysis of past incidents, audit reports and inspection letters;
• monitoring of the external environment: regulation, exchange rates, supply, competition, cybersecurity.

Each risk must be worded precisely, in the form "cause, event, consequence". "Supplier risk" says nothing; "disruption in the supply of an imported raw material, due to dependence on a single supplier, leading to a production line shutdown" allows action. Then group risks into families (strategic, operational, financial, compliance, reputational) in a single risk register.

3. Steps 3 and 4: scoring risks and assessing controls

Step 3: scoring gross risk

Scoring means assessing each risk against two criteria: its likelihood of occurrence and its impact. A four-level scale avoids the temptation of the middle score. Impact should be described across several dimensions, financial, operational, regulatory and reputational, with thresholds suited to the size of the company.

Likelihood × impact gives the criticality of the gross risk, that is, before mitigation measures are taken into account.

Take the example of an Algerian distributor dependent on imported inputs: a sharp increase in customs clearance times may be rated "high" in likelihood and "critical" in impact, a criticality of 12 out of 16. This figure is only meaningful if it results from a reasoned consensus between the purchasing, finance and sales departments, not from the opinion of a single expert.

Step 4: assess the control framework

For each major risk, list the existing controls: procedures, segregation of duties, approvals, insurance, business continuity plans. Then assess their actual effectiveness, not their existence on paper. A purchasing procedure that is not applied reduces no risk. This assessment produces the net risk, or residual risk. In our engagements, this is often the most revealing step: the gap between declared and observed control is frequently large, especially in fast-growing companies.

4. Steps 5 and 6: ranking risks and building the action plan

Step 5: map and rank

Net risks are plotted on a likelihood-impact matrix, the well-known "heat map", in green, amber and red zones. This representation serves first and foremost to drive discussion: why does the finance department rate a risk as critical while sales sees it as moderate? The final ranking must be approved by the CEO, who compares the results with the risk appetite set by the board. For the board, one page is enough: the top 10 major risks, their trend and their owners.

Step 6: the action plan

For each risk above the acceptable threshold, choose a treatment strategy:

• reduce: strengthen controls, diversify suppliers, train teams;
• transfer: insurance, contractual clauses, well-supervised outsourcing;
• avoid: exit an activity, market or partner that is too risky;
• accept: a formal, documented decision, reserved for risks within appetite.

Each action is assigned a named owner, a deadline, a budget and a completion indicator. An action plan without owners is a wish list.

5. Step 7: monitoring, updating and keeping the risk map alive

Monitoring through indicators

Major risks are linked to key risk indicators (KRIs) with alert thresholds: dependence on the largest customer, average collection period, number of IT incidents, turnover of key staff. Tracked quarterly by the executive committee, these indicators turn the risk map into a dashboard. A full review takes place at least once a year, reported to the board of directors or the audit committee, and whenever a significant event occurs: an incident, an acquisition, a new business line or a regulatory reform.

Scaling the effort to the size of the company

An SME can start with around twenty risks, two workshops and a spreadsheet, reviewed twice a year. A structured group will build a risk map for each subsidiary and department, consolidated at head-office level, and integrate it into an overall risk management framework.

The most common mistakes

• Copying a generic list of risks, unrelated to the company's objectives;
• Leaving the exercise to a single department, without involving operational teams;
• Confusing gross and net risk, and overestimating the effectiveness of controls;
• Listing so many risks that the ranking becomes unreadable;
• Producing a risk map and never updating it.

In the Gulf as in Europe, we have found that the most useful risk maps are not the most detailed ones, but those that management actually uses to make decisions on investment, recruitment and growth.

Conclusion: making risk mapping a management tool

Risk mapping is not a formal box-ticking obligation, but an instrument of clarity for executives. Framing, identification, scoring, control assessment, ranking, action planning and monitoring: these seven steps provide a shared view of what truly threatens the company's objectives. In an Algerian environment where partners, lenders and supervisors expect evidence, a living risk map, reviewed regularly and owned by the CEO, is a tangible advantage. Start simple, involve your teams, and let the tool mature with each review.

Fayçal Lounes

Founder of Hodemia Consulting

Nearly 20 years of international experience in regulatory compliance, risk and governance (EY in Luxembourg, San Francisco and London; Director, Regulatory & Compliance Services at KPMG Middle East). Certified coach, trainer and academic.