EMEP Risk Management Process

Risk identification, scoring, ownership, and mitigation cadence for EMEP with a process flowchart.

EMEP risk management is a continuous process. Risks are identified, scored, assigned owners, and mitigated on a regular cadence. This page defines the process and the roles involved.

Process Flowchart

Identification

Risks are identified from:

• Failure modes catalog. See Failure Modes.
• Architecture review meetings.
• Security audits and dependency scans.
• Incident postmortems.
• External threat intelligence.

Anyone can propose a risk. Proposals are triaged by the risk owner.

Scoring

Each risk is scored on two axes:

• Likelihood: 1 (rare) to 5 (almost certain).
• Impact: 1 (negligible) to 5 (catastrophic).

Risk score = Likelihood x Impact.

Score	Severity	Action
1-4	Low	Monitor, no immediate action
5-9	Medium	Define mitigation, review quarterly
10-16	High	Active mitigation, review monthly
17-25	Critical	Immediate action, review weekly, escalate to leadership

Ownership

Every risk has a single owner. The owner is responsible for:

• Defining and executing mitigation.
• Updating the risk status in the register.
• Reporting progress at review meetings.

Owners are assigned from the team most closely associated with the risk domain: security, infrastructure, ML engineering, or operations.

Mitigation Cadence

Severity	Review Frequency	Escalation Path
Low	Quarterly	Team lead
Medium	Monthly	Team lead
High	Weekly	Engineering manager
Critical	Weekly	CTO / VP Engineering

Status Definitions

• OPEN: risk is identified but mitigation is not complete.
• MITIGATED: mitigation is in place and verified. Risk remains in register.
• ACCEPTED: mitigation is not cost-effective. Risk is acknowledged and monitored.
• CLOSED: risk is no longer relevant. Requires justification.

Integration Points

• Risk Register: the single source of truth for all risks. See Risk Register.
• Failure Modes: failure modes are primary inputs to risk identification. See Failure Modes.
• Project Management: high and critical risks are tracked as project tasks. See Project Management.
• KPI Specification: risk reduction is a tracked KPI. See KPI Specification.