The IRM Standard introduces a four-category risk taxonomy + FOIL (Financial/Operational/Internal/External) typology to provide comprehensive Risk Universe coverage. (1) Strategic Risks: risks affecting the achievement of long-term strategic objectives - including (a) Reputation Risk + Brand Damage + ESG Reputation; (b) Competitor Action + Market Share Loss + Disruptive Technology + Innovation Risk; (c) Customer Demand + Consumer Behaviour + Demographic Change; (d) Regulatory + Legal + Political Change including Brexit/Trade Wars/Geopolitical; (e) Environmental + Climate Change + Net Zero Transition; (f) M&A + Corporate Action + JV/Partnership; (g) Business Model Risk + Digital Transformation. (2) Financial Risks: risks affecting financial performance + position - including (a) Market Risk (interest rate + foreign exchange + equity + commodity price); (b) Credit Risk (counterparty default + concentration + sovereign + settlement); (c) Liquidity Risk (funding + market liquidity + asset-liability mismatch); (d) Capital Risk (capital adequacy + Solvency II/Basel III); (e) Tax Risk + Transfer Pricing; (f) Pension Risk + Defined Benefit Deficit; (g) Investment Risk + Portfolio Concentration; (h) Insurance Risk + Underwriting + Reserving + Catastrophe. (3) Operational Risks: per Basel definition - the risk of loss resulting from inadequate or failed internal processes + people + systems + external events including (a) Process Risk + System Failures + Cyber + IT Outage; (b) People + HR Risk + Key Person + Conduct + Fraud + Insider Threat; (c) Supply Chain Risk + Third Party + Concentration; (d) Technology Risk + Cyber + Data Quality; (e) Legal + Compliance + Sanctions + AML/CTF + Bribery and Corruption; (f) Physical Security + Premises + Fire; (g) Health Safety Environment (HSE) + Safety incidents; (h) Business Continuity Disruption + Pandemic + Natural Catastrophe. (4) Knowledge Management Risks: per IRM unique addition - risks relating to organisational knowledge + intellectual property + including (a) Knowledge Resources + Tacit Knowledge Loss + Key Person; (b) Information and Data Risk + Data Quality + Data Governance + Data Privacy + GDPR/DPDP; (c) Intellectual Property + Patents + Trademarks + Trade Secrets; (d) Records Management + Document Retention + e-Discovery; (e) Learning Organisation + Innovation + R&D Risk; (f) AI/Machine Learning Risk + Model Risk + Algorithmic Bias + Explainability. (5) FOIL Typology: alternative cross-cutting view - Financial Risk (Internal) + Operational Risk (Internal) + Internal Risk (Strategic Internal) + External Risk (Strategic External). (6) Upside/Downside: each risk category includes both threats (downside) and opportunities (upside) - explicitly recognised by IRM standard distinct from threat-only models. Coordinates with COSO ERM Integrated Framework risk categorisation + ISO 31000 risk assessment + Basel Committee operational risk + Solvency II ORSA risk categories + Standards Australia/NZ AS/NZS 4360 (predecessor) + Aon Risk Maturity Index + 2024-2025 Emerging Risks (AI + Climate + Geopolitical + Cyber). IRM Four Risk Categories applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.