Heat map

The heat map places an entity’s risks on a likelihood × impact matrix by their residual score. The matrix, its bands and its colours come from the criteria set that applies to that entity.

Who uses it: the Entity Risk Manager and executives, and anyone else within their own scope. See Roles and permissions.

What the heat map shows

• The residual layer. Each risk sits in the cell of its residual likelihood and impact.
• Bands and colours from the criteria set. The cells are coloured by the Rating band the criteria set defines, so every entity in the group reads the same colours the same way.
• A count per cell. Each cell shows how many risks sit in it.
• Drill-down. Click a cell to list its risks; open a risk to see its record, scores and controls.

Reading the heat map

1. Open the heat map of your entity.
2. Choose the reporting period.
3. Look at the cells in the highest bands first.
4. Click a cell to list its risks, then open a risk to see why it scores where it does.

The heat map across a group

A parent reads the heat map of each entity beneath it, built from what each entity has approved and reported up. It reads; it does not change a subsidiary’s scores. See Report-Up-Only and Subsidiary-Independence.

What the system does or refuses

• Positions are computed. A risk’s cell follows its residual score; it cannot be moved by hand. See Computed, never typed.
• The reader’s visibility applies. You see only the entities in your own branch of the group. See Down-Only Visibility.

Related

• Scoring a risk
• Dashboards and reporting — the heat map on the executive summary