Risk Management Domain

The Risk Management domain represents the structured approach to identifying, assessing, mitigating, monitoring, and responding to risks across the organization. It provides a comprehensive framework for modeling risk profiles, assessment methodologies, control mechanisms, and response strategies.

Schema: risk-management.schema.json
Specification: JSON Schema Draft-07

Overview

What is the Risk Management Domain?

The Risk Management domain captures the uncertainty dimensions that affect organizational activities, enabling risk-centric analysis that drives strategic planning, operational resilience, and compliance management. The domain covers:

Risk Profiles — Comprehensive views of specific risks
Risk Assessments — Structured evaluation methodologies
Risk Controls — Mechanisms to modify risk
Risk Responses — Approaches to addressing risks
Risk Monitoring — Ongoing observation and evaluation

This domain extends the Triodian Metamodel by providing deeper insights into risk factors, control effectiveness, and mitigation approaches.

Model Risk Management (MRM) Sub-domain

The Risk domain includes a Model Risk Management (MRM) sub-domain providing structured coverage of risks associated with model use in decision-making and regulatory reporting. MRM introduces elements for:

Model governance and validation
Performance monitoring and drift detection
Regulatory framework mapping (SR 11-7, Basel, IFRS 9, CCAR)

Model records (profile, governance, validation, monitoring and regulatory framework mapping) follow their own schema, model-risk-management.schema.json, and are identified by modelID. A risk profile for model risk uses this domain's schema; the risk category list has no separate model value, so model risk is recorded as operational.

Purpose and Value

The Risk Management domain enables architects and planners to:

Identify and categorize risks — Systematically capture risks impacting objectives
Assess and prioritize — Evaluate risks based on likelihood and impact
Implement controls — Develop appropriate mitigation strategies
Monitor effectiveness — Track risk indicators and control performance
Support decisions — Enable data-driven risk acceptance or reduction
Drive resilience — Improve visibility into risk interdependencies

For Data Engineers

The Risk Management domain maps directly to data quality and governance:

Risk Profile → Data quality risk /Security risk
Risk Assessment → Data quality assessment
Risk Control → Data quality rule /Validation check
Risk Response → Remediation workflow
Key Risk Indicator → Data quality metric /Alert threshold

Core Components

The Risk Management domain uses a comprehensive risk lifecycle:

Risk Identification: Discovery and categorization
Risk Assessment: Analysis of probability and impact
Risk Response: Mitigation strategies and controls
Risk Monitoring: Ongoing tracking and reporting

Domain Attributes

Risk Profile Attributes

Attribute	Type	Description	Required
`riskID`	String	Unique identifier for the risk	✓
`title`	String	Name or title of the risk	✓
`description`	String	Detailed explanation of the risk	✓
`riskCategory`	Enum	Classification of risk type
`orgUnitTitle`	String	Organization unit responsible	✓
`orgUnitID`	String	ID of the organization unit named in `orgUnitTitle`
`orgUnitRoles`	Array[String]	Roles managing this risk
`riskSource`	Enum	Origin of the risk
`riskOwner`	String	Individual responsible
`riskProbability`	Object	Likelihood of occurrence: `level`, `numericValue`, `rationale`, `timeHorizon` (free text, e.g. "12 months")
`riskImpact`	Object	Potential effect if realized: `level`, `financialImpact`, `nonFinancialImpacts` (`impactType`, `description`, `severity`), `rationale`
`riskSeverity`	Object	Combined probability and impact: `level`, `score`, `calculationMethod`
`riskTolerance`	Object	Acceptable level of this risk: `toleranceLevel` (`zeroTolerance`, `low`, `moderate`, `high`, `caseByCase`), `thresholds` (`metricName`, `thresholdValue`, `responseRequired`), `rationale`
`riskStatus`	Enum	Current status in lifecycle
`mitigationStrategy`	Object	Approach to risk reduction: `approachType`, `description`, `expectedOutcome`, `implementationStatus`
`residualRisk`	Object	Risk remaining after controls: `level`, `acceptableLevel`, `description`, `additionalControls`
`controlEffectiveness`	Object	Effectiveness of current controls: `level`, `lastAssessment`, `improvementNeeds`
`reviewFrequency`	Enum	How often risk is reassessed (shared frequency list)
`lastReviewDate`	Date	Date of last formal risk review
`nextReviewDate`	Date	Scheduled date for next review
`regulatoryImplications`	Array[Object]	Compliance aspects: `regulationType`, `regulationName`, `implications`, `complianceStatus`
`strategicImplications`	Object	Impact on strategic objectives: `overallImpact` (`enabling`, `impeding`, `neutral`, `mixed`), `affectedObjectives` (`objectiveID`, `impactDescription`, `impactSeverity`)
`emergingFactors`	Array[Object]	Developing influences: `factorName`, `description`, `potentialImpact`, `timeHorizon`, `monitoringApproach`
`relatedRisks`	Array[Object]	Relationships to other risks: `riskID`, `relationshipType` (`parent`, `child`, `contributor`, `consequence`, `similar`, `opposing`, `compound`, `other`), `relationshipStrength` (1-5), `description`
`keyRiskIndicators`	Array[Object]	Metrics for monitoring (see below)
`dependencies`	Array[Object]	Other domains, processes or systems related to this risk: `dependencyType`, `domainType`, `entityID`, `description`
`crossDomainRelationships`	Array[Object]	Directional relationships from this risk to entities in other domains: `targetDomain`, `relationshipType` and `description` (required), `targetEntityID`, `metadata`
`documentationReferences`	Array[Object]	References to detailed documentation: `documentName`, `documentLocation`, `documentType` (`policy`, `procedure`, `assessment`, `report`, `plan`, `controlDescription`, `other`), `documentDate`
`assessments`	Array[Object]	Risk assessments conducted (see below)
`controls`	Array[Object]	Risk controls implemented (see below)
`responses`	Array[Object]	Risk response actions (see below)
`monitoring`	Object	Risk monitoring activities (see below)

Rating Scales

The risk profile's ratings use the shared lists in common.schema.json:

Probability (riskProbability.level) uses the five-point likelihood scale: veryLow, low, medium, high, veryHigh.
Impact (riskImpact.level) uses the five-point impact magnitude: negligible, minor, moderate, major, severe.
Risk levels (riskSeverity.level, residualRisk.level, and an assessment's inherentRiskLevel and residualRiskLevel) use the four-point risk level: low, medium, high, critical. A five-point "very high" maps to critical and "very low" to low.
Non-financial impact severity uses low, medium, high, critical; its impactType uses the risk category list plus safety.
Control effectiveness uses notAssessed, ineffective, partiallyEffective, effective, highlyEffective.
Compliance status uses compliant, partiallyCompliant, nonCompliant, underReview, exempt, notApplicable.

Enumeration Values

Risk Category (`riskCategory`)

The shared risk category list, plus project.

Value	Description	Example
`strategic`	Strategic direction risks	Market shifts, competition
`operational`	Day-to-day operations risks	Process failures, capacity, model failures
`financial`	Financial performance risks	Liquidity, credit
`market`	Market movement risks	Price, demand, interest rate movements
`economic`	Economic condition risks	Recession, inflation
`political`	Political risks	Government change, sanctions
`compliance`	Regulatory compliance risks	Violations, penalties
`legal`	Legal and contractual risks	Litigation, contracts
`technology`	Technical failure and obsolescence	System failures, legacy platforms
`security`	Cybersecurity risks	Cyberattack, data breach
`privacy`	Personal data risks	Misuse of personal data
`dataQuality`	Data accuracy and completeness risks	Flawed reporting data
`supplyChain`	Supply chain risks	Supplier failure, disruption
`people`	Workforce, skills, capacity and labour risks	Talent, safety, culture
`reputational`	Brand and reputation risks	Public trust, media
`relationship`	Stakeholder and partner relationship risks	Partner disputes
`changeManagement`	Risks from organizational change	Failed adoption
`environmental`	Natural-environment and climate risks	Climate, sustainability
`external`	Other outside events beyond the organization's control	Pandemics, natural disasters
`other`	Any other risk
`project`	Project delivery risks	Schedule, scope, budget overruns

Risk Source (`riskSource`)

Value	Description	Example
`internal`	Within organization	Process gaps, technology changes
`external`	Outside organization, including vendors, partners and regulators	Market conditions, supplier failures, new requirements
`hybrid`	Arising from both internal and external factors	Third-party integration weaknesses

Risk Status (`riskStatus`)

Value	Description
`identified`	Risk identified, not assessed
`assessed`	Assessment completed
`accepted`	Risk accepted as-is
`mitigated`	Controls in place and under monitoring
`transferred`	Risk transferred (insurance)
`avoided`	Activity discontinued
`realized`	The risk event has occurred
`closed`	Risk no longer applicable

Risk Response Type (`approachType`)

mitigationStrategy.approachType. A response's responseStrategy uses the same values.

Value	Description	Example
`accept`	Accept risk within tolerance	Minor operational risks
`reduce`	Implement controls to reduce	Process improvements
`transfer`	Shift risk to third party	Insurance, outsourcing
`avoid`	Discontinue risk-creating activity	Exit market
`exploit`	Act to make a positive risk (opportunity) certain	Commit resources to a favourable opportunity
`share`	Share risk with partners	Joint ventures
`enhance`	Increase the likelihood or effect of a positive risk	Invest to accelerate an opportunity
`contingent`	Prepare a response to trigger only if set conditions occur	Contingency plans, fallback arrangements

Control Type (`controlType`)

Value	Description	Example
`preventive`	Prevent risk occurrence	Access controls
`detective`	Detect risk occurrence	Monitoring, alerts
`corrective`	Correct after occurrence	Incident response
`directive`	Direct required behaviour	Policies, standards
`deterrent`	Discourage undesirable actions	Warning notices, sanctions
`recovery`	Restore operations after an event	Backups, disaster recovery
`compensating`	Alternative control	Manual review
`other`	Any other control type

Control Category (`controlCategory`)

Value	Description	Example
`administrative`	Policy-based	Procedures, training
`technical`	Technology-based	Encryption, firewalls
`physical`	Physical security	Locks, badges
`operational`	Process-based	Segregation of duties
`managerial`	Management oversight	Risk committees, reviews
`procedural`	Defined step-by-step procedures	Approval workflows
`contractual`	Contract terms	Supplier SLAs, indemnities
`other`	Any other category

Risk Assessment Elements

Risk Assessment (`assessments`)

Attribute	Type	Description
`assessmentID`	String	Unique identifier for the risk assessment
`assessmentTitle`	String	Name of assessment
`assessmentMethod`	Enum	Methodology: `qualitative`, `semiQuantitative`, `quantitative`, `scenarioBased`, `workshop`, `expertJudgment`, `historicalAnalysis`, `modelBased`, `other`
`assessmentScope`	Object	Boundaries of assessment: `inScope`, `outOfScope`, `scopeRationale`
`assessmentContext`	String	Business context
`assessmentDate`	Object	When conducted: `startDate`, `completionDate`, `validityPeriod`
`assessmentParticipants`	Array[Object]	People involved: `participantName`, `participantRole`, `participationType`
`identifiedRisks`	Array[Object]	Risks discovered: `riskID`, `riskTitle`, `riskDescription`, `riskCauses`, `riskConsequences`, `inherentRiskLevel`, `residualRiskLevel`
`assessmentFindings`	Array[Object]	Key outcomes: `findingTitle`, `findingDescription`, `findingCategory`, `findingSeverity` (`low` … `critical`, or `informational`)
`assessmentRecommendations`	Array[Object]	Suggested actions: `recommendationTitle`, `recommendationDescription`, `recommendationPriority`, `timeframe`

Risk Control Elements

Risk Control (`controls`)

Attribute	Type	Description
`controlID`	String	Unique identifier for the risk control
`controlTitle`	String	Name of control
`controlType`	Enum	Type of control
`controlCategory`	Enum	Functional category
`controlMethod`	Enum	Operation: `automated`, `manual`, `hybrid`, `systemic`, `periodic`, `continuous`, `other`
`controlObjective`	String	What control achieves
`implementationStatus`	Enum	Implementation state (shared implementation status list)
`controlEffectiveness`	Object	How well it works: `designEffectiveness`, `operationalEffectiveness`
`controlTesting`	Object	How and when the control is tested: `testingMethod`, `testingFrequency`, `lastTestResult` (`passed`, `failed`, `passedWithExceptions`, `notTested`)

Risk Response Elements

Risk Response (`responses`)

Attribute	Type	Description
`responseID`	String	Unique identifier for the risk response
`responseTitle`	String	Name of the risk response
`responseStrategy`	Enum	Approach to handling risk (same values as `approachType`)
`responseDescription`	String	Detailed explanation of response approach
`responsePriority`	Enum	Priority level (`low`, `medium`, `high`, `critical`)
`responseStatus`	Enum	Current status: `notStarted`, `planning`, `inProgress`, `implemented`, `completed`, `canceled`, `deferred`
`responseTimeline`	Object	Implementation schedule: `startDate`, `targetEndDate`, `actualEndDate`
`responseSuccess`	Object	Criteria for success: `successCriteria` (`criterionName`, `targetValue`, `currentValue`), `overallSuccess`

Risk Monitoring Elements

Risk Monitoring (`monitoring`)

Attribute	Type	Description
`monitoringID`	String	Unique identifier for the risk monitoring activity
`monitoringTitle`	String	Name of the risk monitoring activity
`monitoringFrequency`	Object	Frequency of monitoring: `reviewCycle` (shared frequency list plus `biWeekly`), `justification`
`monitoringMethods`	Array[Object]	Approaches used: `methodName`, `automationLevel`
`earlyWarningSystem`	Object	Early detection of risk changes: `alertMechanisms`, `escalationPath`
`reportingStructure`	Object	How results are reported: `reportTypes` (`reportName`, `reportFrequency`), `dashboards` (`dashboardName`, `updateFrequency`)

Key Risk Indicator Elements

Key Risk Indicator (`keyRiskIndicators`)

Attribute	Type	Description
`indicatorName`	String	Name of KRI
`description`	String	Indicator description
`currentValue`	String	Current measurement, as text (e.g. `"12"`, `"4.2%"`)
`threshold`	String	Alert threshold, as text
`trend`	Enum	Direction judged against the goal: `improving`, `stable`, `declining`, `fluctuating`, `notTracked`
`monitoringFrequency`	Enum	Measurement frequency (shared frequency list)

A KRI's trend says whether the risk position is getting better or worse, not whether the number is rising: a falling remediation time is improving, a rising drift index is declining.

Domain Relationships

The Risk Management domain integrates with other metamodel domains:

Target Domain	Relationship Type	Description
Strategy	Alignment	Risks aligned to strategic objectives
Capabilities	Exposure	Capabilities expose to risks
Policy	Governance	Policies govern risk management
Performance	Measurement	Risk KPIs tracked
Finance	Impact	Financial impact of risks
Technology	Exposure	Technology risks identified
Information	Protection	Information security risks
Initiatives	Response	Initiatives address risks
Organization	Ownership	Org units own risks
Compliance	Requirements	Compliance risks managed

Examples

Example 1: Cybersecurity Risk Profile

{
  "riskID": "RISK-CYBER-001",
  "title": "Critical Data Breach Risk",
  "description": "The risk of unauthorized access to or exfiltration of sensitive customer and financial data through external cyberattack or internal compromise, resulting in regulatory sanctions, financial loss, and reputational damage.",
  "riskCategory": "technology",
  "orgUnitTitle": "Information Security Department",
  "orgUnitRoles": [
    "Chief Information Security Officer",
    "Security Operations Manager",
    "Data Protection Officer"
  ],
  "riskSource": "external",
  "riskOwner": "Chief Information Security Officer",
  "riskProbability": {
    "level": "medium",
    "numericValue": 0.35,
    "rationale": "Based on threat intelligence showing increased targeting of our industry, balanced against our enhanced security controls",
    "timeHorizon": "12 months"
  },
  "riskImpact": {
    "level": "severe",
    "financialImpact": "$5-15 million",
    "nonFinancialImpacts": [
      {
        "impactType": "reputational",
        "description": "Severe damage to brand trust and customer confidence",
        "severity": "high"
      },
      {
        "impactType": "compliance",
        "description": "Substantial fines under data protection regulations",
        "severity": "high"
      },
      {
        "impactType": "operational",
        "description": "Service disruption during incident response",
        "severity": "medium"
      }
    ],
    "rationale": "Based on analysis of recent industry breaches and our specific data exposure"
  },
  "riskSeverity": {
    "level": "high",
    "score": 16,
    "calculationMethod": "5x5 risk matrix combining probability and impact values"
  },
  "riskTolerance": {
    "toleranceLevel": "low",
    "thresholds": [
      {
        "metricName": "Security incidents involving PII",
        "thresholdValue": "0",
        "responseRequired": "Immediate executive notification and investigation"
      },
      {
        "metricName": "Failed security tests",
        "thresholdValue": ">5%",
        "responseRequired": "Security remediation within 48 hours"
      }
    ],
    "rationale": "Given regulatory requirements and potential reputational impact"
  },
  "riskStatus": "mitigated",
  "mitigationStrategy": {
    "approachType": "reduce",
    "description": "Comprehensive cybersecurity program including advanced threat protection, security monitoring, encryption, access controls, and security awareness training",
    "expectedOutcome": "Reduce likelihood of successful breach while maintaining detection capabilities",
    "implementationStatus": "implemented"
  },
  "residualRisk": {
    "level": "medium",
    "acceptableLevel": true,
    "description": "Remaining risk primarily related to zero-day vulnerabilities and sophisticated threat actors",
    "additionalControls": [
      "Investigating additional advanced endpoint protection",
      "Enhancing threat hunting capabilities"
    ]
  },
  "controlEffectiveness": {
    "level": "effective",
    "lastAssessment": "2025-03-15",
    "improvementNeeds": [
      "Strengthen third-party security assessment process",
      "Enhance cloud security monitoring"
    ]
  },
  "reviewFrequency": "quarterly",
  "lastReviewDate": "2025-04-01",
  "nextReviewDate": "2025-07-01",
  "regulatoryImplications": [
    {
      "regulationType": "Data Protection",
      "regulationName": "GDPR",
      "implications": "Breach notification requirements and potential fines up to 4% of global revenue",
      "complianceStatus": "compliant"
    },
    {
      "regulationType": "Financial",
      "regulationName": "PCI-DSS",
      "implications": "Requirements for securing payment card data",
      "complianceStatus": "compliant"
    }
  ],
  "strategicImplications": {
    "overallImpact": "mixed",
    "affectedObjectives": [
      {
        "objectiveID": "STRAT-DIGITAL-003",
        "impactDescription": "Risk considerations require adjustment to cloud migration timeline",
        "impactSeverity": "moderate"
      },
      {
        "objectiveID": "STRAT-CUSTOMER-002",
        "impactDescription": "Enhanced security measures could create friction in customer experience",
        "impactSeverity": "minor"
      }
    ]
  },
  "emergingFactors": [
    {
      "factorName": "AI-Enhanced Cyber Threats",
      "description": "Increasing sophistication of attacks using AI to evade detection",
      "potentialImpact": "Could increase probability of successful breach",
      "timeHorizon": "mediumTerm",
      "monitoringApproach": "Threat intelligence subscription and quarterly assessment"
    },
    {
      "factorName": "Extended Supply Chain Exposure",
      "description": "Increasing integration with third-party systems expanding attack surface",
      "potentialImpact": "New vectors for data compromise",
      "timeHorizon": "immediate",
      "monitoringApproach": "Third-party security assessment program"
    }
  ],
  "relatedRisks": [
    {
      "riskID": "RISK-TECH-005",
      "relationshipType": "contributor",
      "relationshipStrength": 4,
      "description": "Legacy System Maintenance Risk contributes to cybersecurity vulnerabilities"
    },
    {
      "riskID": "RISK-COMP-002",
      "relationshipType": "consequence",
      "relationshipStrength": 5,
      "description": "Data breach would trigger Regulatory Compliance Risk"
    }
  ],
  "keyRiskIndicators": [
    {
      "indicatorName": "Security Incidents",
      "description": "Number of security incidents detected per month",
      "currentValue": "12",
      "threshold": "25",
      "trend": "stable",
      "monitoringFrequency": "daily"
    },
    {
      "indicatorName": "Vulnerability Remediation Time",
      "description": "Average time to remediate critical vulnerabilities",
      "currentValue": "1.8 days",
      "threshold": "3 days",
      "trend": "improving",
      "monitoringFrequency": "weekly"
    },
    {
      "indicatorName": "Phishing Simulation Success Rate",
      "description": "Percentage of employees clicking on simulated phishing emails",
      "currentValue": "4.2%",
      "threshold": "5%",
      "trend": "stable",
      "monitoringFrequency": "monthly"
    }
  ],
  "dependencies": [
    {
      "dependencyType": "critical",
      "domainType": "capability",
      "entityID": "CAP-SECOPS-001",
      "description": "Security Operations capability"
    },
    {
      "dependencyType": "important",
      "domainType": "information",
      "entityID": "INFO-DATA-003",
      "description": "Customer Data Security Classification Framework"
    }
  ],
  "documentationReferences": [
    {
      "documentName": "Information Security Policy",
      "documentLocation": "Policy repository (IS-POL-001)",
      "documentType": "policy",
      "documentDate": "2024-12-15"
    },
    {
      "documentName": "Annual Cybersecurity Risk Assessment",
      "documentLocation": "Risk repository (RISK-RPT-2025-01)",
      "documentType": "assessment",
      "documentDate": "2025-02-28"
    }
  ]
}

Example 2: Data Quality Risk

{
  "riskID": "RISK-DATA-001",
  "title": "Data Quality Degradation Risk",
  "description": "Risk of inaccurate or incomplete data affecting business decisions and regulatory reporting",
  "riskCategory": "operational",
  "orgUnitTitle": "Data Governance Office",
  "riskOwner": "Chief Data Officer",
  "riskSource": "internal",
  "riskProbability": {
    "level": "medium",
    "numericValue": 0.4
  },
  "riskImpact": {
    "level": "major",
    "financialImpact": "$2-5 million annually",
    "nonFinancialImpacts": [
      {
        "impactType": "operational",
        "description": "Poor business decisions based on flawed data",
        "severity": "high"
      },
      {
        "impactType": "compliance",
        "description": "Inaccurate regulatory reporting",
        "severity": "medium"
      }
    ]
  },
  "riskStatus": "mitigated",
  "mitigationStrategy": {
    "approachType": "reduce",
    "description": "Data quality program with automated validation, monitoring, and remediation workflows"
  },
  "keyRiskIndicators": [
    {
      "indicatorName": "Data Quality Score",
      "description": "Overall data quality across critical data elements",
      "currentValue": "94.5",
      "threshold": "90",
      "trend": "improving"
    },
    {
      "indicatorName": "Failed Data Quality Rules",
      "description": "Number of data quality rule failures per day",
      "currentValue": "45",
      "threshold": "100",
      "trend": "stable"
    }
  ]
}

Example 3: Model Risk (MRM)

The risk profile for a model. Model risk is categorised as operational; the model itself is described by a Model Risk Management record.

{
  "riskID": "RISK-MODEL-001",
  "title": "Credit Scoring Model Risk",
  "description": "Risk of model degradation or bias in credit scoring model affecting lending decisions",
  "riskCategory": "operational",
  "orgUnitTitle": "Model Risk Management",
  "riskOwner": "Chief Risk Officer",
  "riskSource": "internal",
  "riskStatus": "mitigated",
  "mitigationStrategy": {
    "approachType": "reduce",
    "description": "Regular model validation, performance monitoring, and drift detection"
  },
  "regulatoryImplications": [
    {
      "regulationType": "Supervisory Guidance",
      "regulationName": "SR 11-7",
      "implications": "Model validation and governance requirements",
      "complianceStatus": "compliant"
    }
  ],
  "keyRiskIndicators": [
    {
      "indicatorName": "Model Performance (Gini)",
      "description": "Gini coefficient for model discrimination",
      "currentValue": "0.72",
      "threshold": "0.65",
      "trend": "stable"
    },
    {
      "indicatorName": "Population Stability Index",
      "description": "PSI measuring data drift",
      "currentValue": "0.08",
      "threshold": "0.1",
      "trend": "declining"
    }
  ]
}

Implementation Guidelines

Risk Management Best Practices

Establish governance — Define clear risk ownership and accountability
Use consistent methodology — Apply standardized assessment approaches
Prioritize effectively — Focus resources on highest-impact risks
Test controls — Regularly validate control effectiveness
Monitor continuously — Track KRIs and emerging risks

Risk Assessment Matrix

Control Framework

Control Layer	Purpose	Examples
Preventive	Stop risk occurrence	Access controls, encryption
Detective	Identify occurrences	Monitoring, alerts, audits
Corrective	Fix after occurrence	Incident response, recovery
Compensating	Alternative protection	Manual reviews, oversight

OpenMetadata Integration

For Data Platform Teams

When integrating with OpenMetadata, map Risk entities as follows:

Triodian Element	OpenMetadata Entity	Notes
Risk Profile	Tag/Classification	Risk tagging
Risk Control	Test Definition	Data quality tests
Key Risk Indicator	Test Result	Quality metrics
Risk Assessment	Test Suite	Assessment suites
Control Effectiveness	Test Status	Pass/fail tracking

# Example: Map Risk Control to OpenMetadata Test
def create_risk_control_test(control):
    """
    Map Triodian Risk Control to OpenMetadata Test Definition
    """
    return {
        "name": control["controlID"].lower(),
        "displayName": control["controlTitle"],
        "description": control.get("controlObjective", ""),
        "testDefinitionType": "dataQuality",
        "testPlatforms": ["OpenMetadata"],
        "parameterDefinition": [
            {
                "name": "threshold",
                "displayName": "Threshold",
                "dataType": "NUMBER",
                "required": True
            }
        ],
        "tags": [
            {"tagFQN": f"ControlType.{control['controlType']}"},
            {"tagFQN": f"ControlCategory.{control['controlCategory']}"}
        ]
    }

Schema Reference

Repository: Triodian/Triodian_Metamodel
Schema: risk-management.schema.json
Specification: JSON Schema Draft-07
License: Apache License 2.0

Previous: Finance Domain | Next: Supply Chain Domain

Overview​

What is the Risk Management Domain?​

Model Risk Management (MRM) Sub-domain​

Purpose and Value​

Core Components​

Domain Attributes​

Risk Profile Attributes​

Rating Scales​

Enumeration Values​

Risk Category (riskCategory)​

Risk Source (riskSource)​

Risk Status (riskStatus)​

Risk Response Type (approachType)​

Control Type (controlType)​

Control Category (controlCategory)​

Risk Assessment Elements​

Risk Assessment (assessments)​

Risk Control Elements​

Risk Control (controls)​

Risk Response Elements​

Risk Response (responses)​

Risk Monitoring Elements​

Risk Monitoring (monitoring)​

Key Risk Indicator Elements​

Key Risk Indicator (keyRiskIndicators)​

Domain Relationships​

Examples​

Example 1: Cybersecurity Risk Profile​

Example 2: Data Quality Risk​

Example 3: Model Risk (MRM)​

Implementation Guidelines​

Risk Management Best Practices​

Risk Assessment Matrix​

Control Framework​

OpenMetadata Integration​

Schema Reference​