Start with Propagation, Not Probability

The first step in quantifying risk is not measurement—it’s mapping. Before probabilities or financial models, organizations must understand how events propagate. This begins by tracing a risk or opportunity from its triggering event through operational impacts, all the way to financial outcomes—affecting income, cash flow, or the balance sheet.

 

Bi-directional Flow and Double Materiality

A triggering event can originate externally—such as regulatory shifts, climate events, or geopolitical tensions—or internally, like a process failure or strategic misalignment. These events don’t exist in isolation. They propagate through functions, systems, and relationships. Some ripple inward, affecting operations and strategy. Others radiate outward, influencing brand, supply chains, or community trust. This reflects double materiality: the firm’s exposure to the world—and the world’s exposure to the firm.

 

Visualizing Cause and Effect

The core tool to navigate this complexity is the causality map: a directional diagram where each node represents a discrete event or condition, and each arrow shows how events are causally linked. These maps are not static—they are dynamic models of how disruptions or opportunities spread, evolve, and interact.

 

Apply the Materiality Filter

However, not every chain deserves to be modelled. A materiality filter must be applied. Only chains that could significantly affect organizational objectives or stakeholder decisions should be registered. This threshold should align with the firm’s accounting materiality framework—ensuring consistency and focus.

 

Instrument the Chain with Metrics

Once a chain is registered, it must be instrumented. This means assigning metrics to each node in the chain—quantitative indicators that can track the real-time health of each event or condition. These metrics carry:

• A trigger threshold: the point at which the event becomes active or significant.

• A tolerance range: the acceptable bandwidth before action is needed.

 

For example, if a supplier delay is one node, the metric might be “on-time delivery %,” with a threshold below 90% triggering upstream concern, and a tolerance range of 90–95% indicating a watchlist status. This structure enables early warning systems, targeted responses, and probabilistic modelling based on real data.

 

Why It Matters

1. It transforms structure into action. Metrics operationalize the map, turning conceptual diagrams into live dashboards.

2. It enables dynamic quantification. With trigger points and tolerance bands in place, probabilistic models can simulate risk exposure with greater realism and confidence.

3. It links causality to governance. When thresholds are breached, escalation paths are clear. Boards and risk committees get visibility grounded in evidence, not gut feel.

4. It drives resilience and growth through feedback. Metrics not only inform but learn—creating feedback loops where systems self-correct before failure propagates.

 

The Foundation of Modern ERM

Causality mapping, combined with metric instrumentation, is the bridge between narrative and science. It shifts ERM from static heat maps to real-time intelligence. For organizations serious about managing uncertainty, this is the essential foundation. Only by mapping propagation, filtering by materiality, and tracking with defined metrics can risk be truly quantified—and strategy made resilient.