# Risk Management

> The activity of identifying risks, rating their likelihood and impact, and assigning each one an owner and a mitigation.

Record: `architecture:risk-management`
Kind: activity
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: architecture, security, delivery
Canonical: https://banes-lab.com/ontology#architecture-risk-management

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Policy as Code](https://banes-lab.com/records/architecture/policy-as-code.md) and before [Continuous Compliance](https://banes-lab.com/records/architecture/continuous-compliance.md).

## Repair

- Refactored by: Add Mitigation, Reduce Exposure
- Detected by: risk register gaps
- Violated by: critical risk without owner/mitigation
- Measured by: residual risk score
- Enforced by: review gates

## Requires

- [Risk Identification](https://banes-lab.com/records/lexicon/risk-identification.md)
- [Mitigation](https://banes-lab.com/records/lexicon/mitigation.md)

## Reinforces

- [Compliance](https://banes-lab.com/records/architecture/compliance.md)
- [Security by Design](https://banes-lab.com/records/architecture/security-by-design.md)

## Enables

- [Priority-Based Controls](https://banes-lab.com/records/lexicon/priority-based-controls.md)

## Conflicts with

- [Unowned Risk](https://banes-lab.com/records/architecture/unowned-risk.md)

## In tension with

- [Speed](https://banes-lab.com/records/lexicon/speed.md)

## Tensions

- [Risk Management / Speed](https://banes-lab.com/records/tension/risk-management-speed.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Reinforced by

- [Threat Modeling](https://banes-lab.com/records/architecture/threat-modeling.md)

## Linked from

- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)