Jon W. Hansen, FCIPS | Procurement Insights | Hansen Models™
This week, an AI risk map made the rounds on LinkedIn: 12 domains, 55 categories and 196 risk factors, developed by Evan Wheeler and shared by Jad Nicolas. It drew hundreds of reactions, and it deserved them. It’s a thorough inventory of what can go wrong when an organization adopts AI, and its author is clear that it’s a starting point, not a control framework.
But looking at it raised a question I couldn’t shake. All 196 risks sit in their own boxes. How do they affect each other? Because they do.
Risk is organized by owner
Most organizations assign each kind of risk to a function. Security belongs to IT. Model risk belongs to the data science team. Contracts belong to legal. Supplier risk belongs to procurement. Every box needs someone accountable for it, so every risk map ends up looking like the organization chart.
That makes sense for accountability. It makes very little sense for how risk actually behaves, because an organization chart is a picture of silos, and risks don’t stay in them.
Risks are rated one at a time
The standard tool for managing risk is a register, and the standard way to rate a risk is likelihood times impact, scored one risk at a time.
Think about what that means. How can you rate a risk without knowing what it crosses? A supplier qualification gap might be a minor risk on its own. Combine it with an approver measured on cost savings, a supplier cutoff at 2 p.m. and an AI agent allowed to place orders on its own, and it becomes a missed delivery on a critical part. None of those four would score high in the register. Together, they’re the failure.
The register has no column for “this one makes that one worse.” So even when people know risks interact, there’s nowhere to put it.
The number nobody can track
Here’s the problem in a single figure. A list of 196 risks can pair up in 19,110 different ways. That’s before counting three or four risks crossing at once, or a dormant risk waking up when something else changes. At any moment, some of those strands are active, some are quiet, and a few are about to cross.
Nobody can track 19,110 combinations from a list. Adding more risks to the map makes the list more complete and the problem harder.
Start from the outcome
There’s a better way in, and it’s the way we’ve worked since 1998. Don’t start with the list. Start with an outcome that’s falling short, and trace it back.
Start with one outcome that’s falling short, trace it back, and only a handful of the 196 light up: the ones that actually crossed to produce it. Test that one decision, and let real outcomes update what you watch.
In 1998, at a defence maintenance operation, next-day delivery stood at 51%. Every function was doing its job, and every measure was accurate. The failure lived in the connections between them: service technicians measured on call volume, holding their part orders until late afternoon, crossing procurement’s clock and the suppliers’ and couriers’ cutoffs. No single function’s risk list would have shown it. Tracing back from the missed deliveries did, and within three months next-day delivery reached 97.3%.
That’s Strand Commonality™: the risks that matter aren’t isolated items. They’re strands that cross, and they show their connection at the outcome they produce together.
Why don’t we widen the aperture?
The real limit in risk management isn’t how many risks we can list. It’s how many we can see interacting at once. That’s what I call the aperture.
In 1998, I could follow three or four strands at a time. Within about a year and a half, it was four to six. Today, with ARA™ RAM 2025™ powered by SLAP OS™, it’s ten or twelve, followed reliably and simultaneously. That isn’t a longer list. It’s a wider view of how a smaller set of strands crosses, changes and wakes up.
So why don’t more organizations widen their aperture? Because their tools reward the opposite. A risk register rewards completeness: one more row is always defensible. A map rewards coverage. And a functional structure rewards each owner for managing their own box. None of them rewards anyone for seeing where and how multiple strands cross to impact an outcome.
And AI makes this urgent. An AI agent doesn’t stay in one box: a single decision can cross procurement, finance, logistics and a supplier’s operation in seconds, while the governance meant to oversee it is still organized one owner at a time. You can’t govern AI, or the risks it creates, without seeing where they cross.
Three questions for your next risk review
Which outcome is falling short right now, and which risks crossed to produce it?
Which of your risks are dormant, and what would wake them up?
Who in your organization is responsible for the connections between risks, not just for the risks themselves?
If nobody can answer the third, that’s the biggest risk on the map, and it isn’t on the map.
Hansen’s Agentic Governance Readiness (AGR) Snapshot™ starts from one outcome and traces it back through the strands that produced it, in two weeks. Contact us at HPT@hansenprocurement.com to review one decision.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
Risks Are Owned in Silos. They Do Damage Together.
Posted on November 12, 2026
0
Jon W. Hansen, FCIPS | Procurement Insights | Hansen Models™
This week, an AI risk map made the rounds on LinkedIn: 12 domains, 55 categories and 196 risk factors, developed by Evan Wheeler and shared by Jad Nicolas. It drew hundreds of reactions, and it deserved them. It’s a thorough inventory of what can go wrong when an organization adopts AI, and its author is clear that it’s a starting point, not a control framework.
But looking at it raised a question I couldn’t shake. All 196 risks sit in their own boxes. How do they affect each other? Because they do.
Risk is organized by owner
Most organizations assign each kind of risk to a function. Security belongs to IT. Model risk belongs to the data science team. Contracts belong to legal. Supplier risk belongs to procurement. Every box needs someone accountable for it, so every risk map ends up looking like the organization chart.
That makes sense for accountability. It makes very little sense for how risk actually behaves, because an organization chart is a picture of silos, and risks don’t stay in them.
Risks are rated one at a time
The standard tool for managing risk is a register, and the standard way to rate a risk is likelihood times impact, scored one risk at a time.
Think about what that means. How can you rate a risk without knowing what it crosses? A supplier qualification gap might be a minor risk on its own. Combine it with an approver measured on cost savings, a supplier cutoff at 2 p.m. and an AI agent allowed to place orders on its own, and it becomes a missed delivery on a critical part. None of those four would score high in the register. Together, they’re the failure.
The register has no column for “this one makes that one worse.” So even when people know risks interact, there’s nowhere to put it.
The number nobody can track
Here’s the problem in a single figure. A list of 196 risks can pair up in 19,110 different ways. That’s before counting three or four risks crossing at once, or a dormant risk waking up when something else changes. At any moment, some of those strands are active, some are quiet, and a few are about to cross.
Nobody can track 19,110 combinations from a list. Adding more risks to the map makes the list more complete and the problem harder.
Start from the outcome
There’s a better way in, and it’s the way we’ve worked since 1998. Don’t start with the list. Start with an outcome that’s falling short, and trace it back.
Start with one outcome that’s falling short, trace it back, and only a handful of the 196 light up: the ones that actually crossed to produce it. Test that one decision, and let real outcomes update what you watch.
In 1998, at a defence maintenance operation, next-day delivery stood at 51%. Every function was doing its job, and every measure was accurate. The failure lived in the connections between them: service technicians measured on call volume, holding their part orders until late afternoon, crossing procurement’s clock and the suppliers’ and couriers’ cutoffs. No single function’s risk list would have shown it. Tracing back from the missed deliveries did, and within three months next-day delivery reached 97.3%.
That’s Strand Commonality™: the risks that matter aren’t isolated items. They’re strands that cross, and they show their connection at the outcome they produce together.
Why don’t we widen the aperture?
The real limit in risk management isn’t how many risks we can list. It’s how many we can see interacting at once. That’s what I call the aperture.
In 1998, I could follow three or four strands at a time. Within about a year and a half, it was four to six. Today, with ARA™ RAM 2025™ powered by SLAP OS™, it’s ten or twelve, followed reliably and simultaneously. That isn’t a longer list. It’s a wider view of how a smaller set of strands crosses, changes and wakes up.
So why don’t more organizations widen their aperture? Because their tools reward the opposite. A risk register rewards completeness: one more row is always defensible. A map rewards coverage. And a functional structure rewards each owner for managing their own box. None of them rewards anyone for seeing where and how multiple strands cross to impact an outcome.
And AI makes this urgent. An AI agent doesn’t stay in one box: a single decision can cross procurement, finance, logistics and a supplier’s operation in seconds, while the governance meant to oversee it is still organized one owner at a time. You can’t govern AI, or the risks it creates, without seeing where they cross.
Three questions for your next risk review
If nobody can answer the third, that’s the biggest risk on the map, and it isn’t on the map.
Hansen’s Agentic Governance Readiness (AGR) Snapshot™ starts from one outcome and traces it back through the strands that produced it, in two weeks. Contact us at HPT@hansenprocurement.com to review one decision.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
Related reading
Source
Share this:
Like this:
Related