Risk Management Domain Ontology

FLOW ALGEBRA
TITLE: Risk Management Domain Ontology
VERSION: 1.0
DOMAIN: Business Domains / Risk Management
SOURCE_URL: https://kirethresearch.org/booksai-core/ontologies/domain-ontologies/business-domains/risk-management-domain-ontology.html
STATUS: Domain-based ontology draft; source-page contents not independently verified.
AUTHORS: Mark Higgins — Sky (Recursive AI)

1. PURPOSE
Represent risk identification, assessment, treatment, monitoring and governance as typed, traceable semantic relationships. Support AI retrieval and inference without confusing estimated risk with established outcomes.

2. TYPED ENTITIES
Organisation: entity {id, name, sector, jurisdiction}
Objective: entity {id, organisation_id, description, horizon}
Risk: entity {id, title, description, category, status, owner_id}
RiskCategory: concept {strategic, operational, financial, compliance, reputational, cybersecurity, environmental, safety, supply_chain}
Threat: entity {id, source, description}
Vulnerability: entity {id, description, severity}
Asset: entity {id, type, criticality}
Event: entity {id, occurrence_time, observed:bool}
Consequence: entity {id, impact_type, magnitude, unit}
LikelihoodEstimate: measurement {risk_id, probability, time_horizon, method, uncertainty}
ImpactEstimate: measurement {risk_id, value, unit, method, uncertainty}
Control: entity {id, type, effectiveness, status, owner_id}
MitigationAction: entity {id, action, deadline, status}
RiskAssessment: record {id, risk_id, assessment_date, methodology, assessor_id}
RiskRegister: collection {id, organisation_id, review_date}
RiskOwner: role {id, responsibility}
RiskAppetite: policy {organisation_id, category, tolerance, unit, period}
Incident: event {id, date, actual_impact, response_status}
Indicator: measurement {id, risk_id, metric, value, threshold, observation_time}
Evidence: record {id, source, collected_at, reliability}

3. TYPED RELATIONSHIPS
Organisation --HAS_OBJECTIVE--> Objective
Organisation --MAINTAINS--> RiskRegister
RiskRegister --CONTAINS--> Risk
Risk --THREATENS--> Objective
Risk --AFFECTS--> Asset
Threat --EXPLOITS--> Vulnerability
Threat --MAY_TRIGGER--> Event
Event --MAY_CAUSE--> Consequence
Risk --HAS_LIKELIHOOD_ESTIMATE--> LikelihoodEstimate
Risk --HAS_IMPACT_ESTIMATE--> ImpactEstimate
Risk --ASSESSED_BY--> RiskAssessment
Risk --OWNED_BY--> RiskOwner
Control --MITIGATES--> Risk
MitigationAction --IMPLEMENTS--> Control
Risk --MONITORED_BY--> Indicator
RiskAssessment --SUPPORTED_BY--> Evidence
Incident --REALISES--> Risk
RiskAppetite --CONSTRAINS--> RiskDecision

4. FLOW DEFINITIONS
flow IdentifyRisk(inputs: Organisation, Objective, Threat?, Vulnerability?, Evidence*) -> Risk
  require objective is linked to organisation
  create risk with documented causal pathway or uncertainty label
  preserve source provenance

flow AssessRisk(inputs: Risk, LikelihoodEstimate, ImpactEstimate, RiskAssessment) -> RiskProfile
  require consistent time_horizon and units
  calculate expected_loss only when probability and impact are comparable
  expected_loss = probability * monetary_impact
  output uncertainty, assumptions and assessment date

flow TreatRisk(inputs: RiskProfile, Control*, RiskAppetite) -> TreatmentDecision
  compare assessed exposure with documented tolerance
  options = {avoid, reduce, transfer, accept}
  require accountable human approval for consequential decisions
  record residual_risk and control assumptions

flow MonitorRisk(inputs: Risk, Indicator*, Incident*, Evidence*) -> RiskUpdate
  compare indicator observations against thresholds
  detect meaningful changes in likelihood, impact or control effectiveness
  trigger reassessment; do not infer causation from correlation alone

5. INFERENCE RULES
RULE R1: IF a risk threatens a critical objective AND credible evidence indicates elevated exposure THEN flag for review.
RULE R2: IF a control is ineffective OR expired THEN residual risk requires reassessment.
RULE R3: IF an indicator crosses its documented threshold THEN request investigation, not automatic confirmation of an incident.
RULE R4: IF an incident is confirmed THEN link observed consequences to the relevant risk and update the register.
RULE R5: IF an assessment is outdated relative to policy THEN mark assessment as requiring review.
RULE R6: IF estimated residual exposure exceeds risk appetite THEN escalate to the authorised risk owner.

6. CONFIDENCE
CONFIDENCE: [0.0, 1.0]
confidence applies to evidential support for a statement, not the probability of the risk event.
confidence_basis = {source_quality, recency, corroboration, measurement_quality, model_validation}
Never treat a confidence score as an observed frequency or calibrated event probability without evidence.

7. SEMANTIC_EQUIVALENCE
risk ≈ uncertainty affecting objectives (context-dependent)
threat != risk
hazard != realised incident
inherent_risk != residual_risk
risk_likelihood != evidence_confidence
risk_tolerance != risk_appetite (related, not interchangeable)
Map aliases only when definitions, context, time horizon and units agree.

8. PROVENANCE
For each assertion retain: {source_id, source_type, author_or_system, timestamp, method, version, jurisdiction, confidence}.
Distinguish observed facts, model estimates, scenarios and expert judgements.

9. FLOW_HASH
FLOW_HASH = SHA256(canonicalise({ontology_version, typed_entities, relationships, rules, parameters, provenance_schema}))
Exclude volatile runtime timestamps from the canonical schema hash; hash individual observations separately.

10. UPDATE_MODEL
UPDATE_MODEL:
  triggers: [new_incident, new_evidence, threshold_breach, control_change, scheduled_review, regulation_change]
  actions: [validate_source, preserve_prior_version, update_estimates, recompute_residual_risk, log_changes, request_approval]
  audit: immutable_version_history

11. AI_CONSUMPTION
AI_CONSUMPTION:
  format: typed_semantic_flow
  use_cases: [risk_register_search, control_mapping, evidence_retrieval, risk_explanation, scenario_comparison, monitoring_support]
  constraints: [do_not_invent_probabilities, expose_assumptions, respect_jurisdiction, protect_sensitive_records, human_review_for_material_decisions]
  outputs: [entities, relationships, derived_findings, supporting_evidence, uncertainty, version]

END FLOW ALGEBRA