← Back to Context Management

Risk Taxonomy

The Map: A structured knowledge framework that organizes risk artifacts into interconnected layers, providing the guardrails AI agents need to operate safely.

What is a Risk Taxonomy?

A risk taxonomy is a structured knowledge map that organizes your organization's risk artifacts into interconnected layers. It defines what entities exist, how they relate, and what governance applies.

In regulated industries, this isn't optional—you're expected to have documented, auditable frameworks. But for AI agents, a well-structured taxonomy becomes something more powerful: a navigable knowledge graph that provides context and guardrails for every decision.

The Taxonomy Pyramid

Risk artifacts organized in layers, from strategic requirements down to technical foundations.

1

Requirements

Regulatory & Business requirements that drive everything below

2

Risks

Risk taxonomy and risk types classified across all domains

3

Policies

Governing documents that set boundaries and standards

4

Governance

Forums, mandates, and terms of reference that guide decisions

5

Processes

Process maps and procedures that define how work gets done

6

Controls & MI

KRIs, RCSA, and management information that monitors effectiveness

7

Systems / Feeds / Data / Models

Technical foundation that enables everything above

Three Core Principles

Complete

Comprehensive coverage across all risk domains—no gaps for AI to stumble into

Consistent

Uniform standards applied everywhere—predictable structure for reliable navigation

Communicated

Clearly articulated to staff and regulators—transparency builds trust

11 Interconnected Artifact Categories

Each category linked to create a navigable knowledge graph for AI agents.

Risks

Policies

Governance

Processes

Controls

Products

Reports

Feeds

Data

Models

Systems

Keeping Artifacts Current

Banks continuously change, requiring systematic documentation updates during every change project. A stale taxonomy is worse than no taxonomy—it gives AI agents false confidence in outdated information.

Check Out

Artifacts are locked for editing when change projects begin. The current state is preserved as baseline—creating a clear "before" snapshot.

Amendments

Updates reflect post-change production state—methodology docs, model libraries, data dictionaries, curve inventories. Everything that changes gets documented.

Check In

After validation and sign-off, updated production views are checked in, creating complete audit trails. The taxonomy always reflects reality.

Why This Matters

When artifacts accurately represent current production processes, they become powerful tools for managing change efficiently and maintaining accountability. AI agents can trust the taxonomy—and so can regulators.

The Map Needs Navigators

The taxonomy provides structure—but structure alone doesn't capture how decisions actually get made. That's where the Context Graph comes in: capturing the real paths people take through this carefully structured map.

Explore Context Graph →