Free resource
Industry risk taxonomies.
Draft level 1 and level 2 risk taxonomies for 14 industries, plus a generic one, free to download as CSV and adapt for your organisation.
15 taxonomies, 650 risksCSV
Each taxonomy sets out the level 1 risk categories an organisation in that industry typically manages, and the level 2 risks under each one. The generic taxonomy suits most organisations and carries a definition for every category.
They are drafts: starting points to adapt, not a standard. A taxonomy should reflect your own strategy, operating model and obligations. Paul Taylor's article Risk taxonomy: a common language for risk explains how to build one and use it.
Draft risk taxonomy
Generic
12 level 1 categories, 56 level 2 risks
- 01
Strategic
The risk that internal or external events, decisions or changes adversely impact an organisation's ability to achieve its strategic objectives, execute its business strategy, sustain long-term performance or create value for stakeholders.
- Competition
- Regulatory Change
- Reputation
- Transformation
- Strategic Execution
- Mergers & Acquisition
- Business Model
- 02
Operational & Process
The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
- Business Process
- Capacity, Quality & Delivery
- Assets, Facilities & Equipment
- Health, Safety & Physical Security
- Customer Feedback
- 03
People & Culture
The risk that inadequate workforce capability, capacity, leadership, culture, conduct or talent management practices adversely impact the organisation's ability to achieve its objectives, maintain compliance, deliver services and sustain a positive workplace environment.
- Talent & Succession
- Skills & Workforce Capacity
- Culture
- Conduct & Ethics
- 04
Legal, Regulatory & Compliance
The risk of failing to comply with applicable laws, regulations, regulatory obligations, industry standards, contractual commitments or internal policies, resulting in legal action, regulatory sanctions, financial penalties, operational restrictions or reputational damage.
- Regulatory Compliance
- Contractual Compliance
- Privacy & Data Protection
- Licensing & Reporting
- 05
Integrity & Conduct
The risk arising from unethical, improper, dishonest or inappropriate behaviours, actions, decisions or cultures that are inconsistent with the organisation's values, code of conduct, legal obligations or the expectations of stakeholders, resulting in customer harm, regulatory breaches, financial loss or reputational damage.
- Sanctions
- Conflicts & Misconduct
- Bribery & Corruption
- Internal & External Fraud
- 06
Financial
The risk of financial loss, reduced earnings, diminished asset value, or an inability to meet financial obligations, arising from internal or external factors that affect the organisation's financial position, performance, liquidity, funding or capital adequacy.
- Liquidity & Funding
- Credit & Counterparty
- Capital
- Tax
- Market
- Revenue
- Expense
- 07
Technology, Cyber & Data
The risk arising from the failure, inadequacy, misuse, unavailability or compromise of technology systems, cyber security controls, information assets or data management practices that impacts the organisation's ability to operate effectively, protect information, meet regulatory obligations and achieve its objectives.
- Cybersecurity Threats
- Technology Resilience & Outages
- Data Quality, Governance & Access
- Architecture, Cloud & Technical Debt
- 08
AI & Model
The risk that artificial intelligence systems, machine learning models, predictive analytics or other decision-making models are ineffective, biased, inaccurate, inadequately governed or used inappropriately, leading to poor decisions, stakeholder harm, regulatory non-compliance or adverse business outcomes.
- Model Error & Performance Drift
- Bias, Fairness & Harmful Outcomes
- Transparency, Provenance & Explainability
- Misuse, Autonomy & Human Oversight
- 09
Third Party & Supply Chain
The risk that external parties, suppliers, service providers, contractors or supply chain dependencies fail to deliver products, services or obligations in accordance with expectations, resulting in operational disruption, financial loss, regulatory non-compliance, information security incidents, customer impacts or reputational damage.
- Service Provider & Supplier Failure
- Concentration
- Cyber Supply Chain Dependency
- Subcontractor Failure
- Logistics, Sourcing & Disruption
- 10
Resilience & Continuity
The risk arising from inadequate preparedness, response, recovery or adaptation capabilities that impair the organisation's ability to withstand and recover from disruptions, maintain critical business services and continue operations during adverse events.
- Critical Service Disruption
- Crisis & Emergency Response
- Disaster Recovery & Recoverability
- Dependencies & Single Points of Failure
- 11
Sustainability, Climate & Environment
The risk arising from environmental impacts, climate change, sustainability-related factors, or the organisation's management of its environmental, social and governance (ESG) responsibilities, which may result in financial loss, operational disruption, regulatory non-compliance, reduced stakeholder confidence or an inability to achieve strategic objectives.
- Physical Climate
- Transition, Policy & Market
- Environmental Impact & Pollution
- Resources, Ecosystems & Biodiversity
- 12
Geopolitical & External
The risk arising from changes in the political, economic, social, environmental, regulatory or market environment, including geopolitical events, that may disrupt operations, affect strategic objectives, create financial losses, or impact the organisation's ability to deliver products and services.
- Conflict & Political Instability
- Trade Restrictions & Fragmentation
- Macroeconomic Volatility
- Misinformation & Social Disruption
Draft risk taxonomy
Banks, Mutuals & NBFIs
11 level 1 categories, 47 level 2 risks
- 01
Strategic
- Competition
- Regulatory Change
- Reputation
- Product Development
- Strategic Execution
- 02
Operational Risk
- Business Process
- Change Management
- Project
- Service Provider
- Customer
- Fraud
- WHS
- People
- Model
- 03
Cyber Security
- Cyber Attack
- Access Management
- 04
Financial Crime
- Money Laundering
- Terrorism Financing
- Sanctions Breaches
- Transaction Monitoring Failures
- KYC Deficiencies
- 05
Compliance & Conduct
- Conduct
- Regulatory Compliance
- Privacy
- Mis-Selling
- 06
Capital Adequacy
- Regulatory Capital Shortfall
- 07
Liquidity & Funding
- Wholesale Funding Market Disruption
- Retail Deposit Outflows
- Short-Term Funding Rollover Risk
- Taxation
- 08
Market Risk
- Interest Rate in the Banking Book
- Foreign Exchange
- Equity Price
- Commodity Price
- Traded Market Risk
- 09
Credit Risk
- Retail Credit Default
- Business Lending Default
- Concentration
- Counterparty
- Collateral Valuation
- 10
Business Disruption & Technology
- System Outages
- Legacy
- Artificial Intelligence
- Cloud Migration
- Data Governance
- 11
Environmental & Sustainability
- Physical Risk
- Transition Risk
Draft risk taxonomy
Education & Training
11 level 1 categories, 44 level 2 risks
- 01
Service Delivery & Educational Quality
- Curriculum Delivery
- Literacy & Numeracy Support
- Assessment & Reporting
- Student Behaviour Support
- Student Wellbeing & Health
- Disability Support & Inclusion
- 02
Legal, Regulatory & Compliance
- Regulatory Compliance
- Child Safety Obligations
- Privacy
- Contractual Obligations
- 03
Reputation & Conduct
- Fraud & Corruption
- Code of Conduct
- Student Protection
- Misconduct
- 04
Business Continuity & Emergency Management
- Critical Incident
- Emergency Management
- Building Security
- Asset Management
- Business Disruption
- 05
Financial Risk
- Revenue
- Expense
- Grants Management
- Liquidity & Funding
- 06
Work, Health & Safety
- Curriculum Activity Safety
- Facilities Safety
- Machinery & Equipment Risk
- Hazardous Substances
- Environmental Hazards
- 07
People Risk
- Industrial Relations
- Capability
- Diversity & Inclusion
- 08
Information & Technology
- Cyber Security
- Information Security
- Data Governance
- System Availability
- Vulnerability Management
- Legacy
- Access Management
- 09
Infrastructure & Assets
- Building Maintenance & Repairs
- Capital Works Programs
- Environmental Sustainability
- 10
Community, Stakeholder & External Engagement
- Community Relationships
- 11
Strategic
- Regulatory Change
- Competition
Draft risk taxonomy
Public Administration & Safety
12 level 1 categories, 39 level 2 risks
- 01
Governance, Strategy & Decision Making
- Governance
- Strategic Execution
- 02
Financial Risk
- Revenue
- Expense
- 03
Legal, Regulatory & Compliance
- Regulatory Compliance
- Privacy
- Contractual Compliance
- Statutory Reporting Obligations
- 04
Service Delivery & Operational Performance
- Service Delivery
- Customer Service
- Project
- 05
Infrastructure, Assets & Capital Works
- Asset Management & Lifecycle
- Maintenance
- Capital Works
- Fleet Management
- 06
People & Talent
- Industrial Relations
- Workforce Capability
- Talent Attraction & Retention
- Psychosocial Hazards
- 07
Information Technology & Cybersecurity
- Cybersecurity Threats
- System Reliability
- Data Governance
- Access Management
- 08
Service Providers
- Contract Management
- Supply Chain Disruption
- Service Provider Performance
- 09
Resilience
- Incident Management
- Natural Hazards
- Business Continuity
- Critical Infrastructure Resilience
- 10
Community, Stakeholders & Reputation
- Reputation
- Community Expectations
- Stakeholder Engagement
- 11
Environmental, Climate & Sustainability
- Climate Change
- Environmental Compliance
- Waste & Resource Management
- Biodiversity & Land Management
- 12
Economic, Social & External Environment
- Political Change
- Demographic Change
Draft risk taxonomy
Transport, Postal & Warehousing
10 level 1 categories, 38 level 2 risks
- 01
Fleet Operations & Road Safety
- Vehicle Incidents
- Driver Fatigue & Impairment
- Load Restraint Failures
- Dangerous Goods Transport
- Vehicle Maintenance & Defect Management
- 02
Supply Chain & Network Resilience
- Supplier Concentration
- Logistics Disruption
- 03
Information Technology and Cybersecurity
- Cybersecurity Threats
- System Reliability
- Data Governance
- Warehouse Automation Failures
- Access Management
- 04
Legal, Regulatory & Compliance
- Regulatory Compliance
- Dangerous Goods Compliance
- Contractual Compliance
- Chain of Responsibility Breaches
- Environmental & Emissions Regulation
- 05
People & Talent
- Industrial Relations
- Workforce Capability
- Talent Attraction & Retention
- Psychosocial Hazards
- 06
WHS
- Mobile Plant Collision Risk
- Manual Handling
- Slips, Trips & Falls
- 07
Environmental, Climate & Natural Hazards
- Natural Disaster
- Hazardous Materials
- Emissions, Sustainability & ESG Obligations
- 08
Financial
- Expense
- Revenue
- Liquidity
- Fuel Price
- 09
Strategic
- Competition
- Customer
- Reputation
- Mergers & Acquisition
- 10
Business Continuity & Emergency Response
- Major Transport Network Closures
- System Outage
- Pandemic
Draft risk taxonomy
Arts & Recreation Services
11 level 1 categories, 49 level 2 risks
- 01
Revenue
- Grants
- Sponsorship
- Merchandise
- Transfer Fees
- Broadcast
- Registration Fees
- 02
Expense
- Travel Costs
- Fixed Costs
- Labour Costs
- 03
Financial
- Credit
- Liquidity
- Asset Depreciation
- 04
Strategic
- Strategic Execution
- Reputation
- Business Model
- Project
- 05
Governance, Integrity & Compliance
- Doping
- Match Fixing
- Gambling
- Fraud
- Financial Crime
- Conflict of Interest
- Code of Conduct
- Privacy
- Governance
- Compliance
- 06
People & Talent
- Volunteer Shortages
- Workforce Capability
- Talent Attraction & Retention
- Psychosocial Hazards
- 07
WHS
- Concussion & Head Injuries
- Playing Surface Hazards
- Weather Exposure
- Equipment Safety
- Equipment Storage & Maintenance
- 08
Safeguarding & Duty of Care
- Working With Children Compliance
- Duty of Care for Minors
- Safe Transport & Supervision
- Bullying, Harassment, Discrimination
- 09
Operational
- Business Continuity
- Service Provider
- 10
Information Technology & Cybersecurity
- System Availability
- Cybersecurity
- Data Governance
- Information Security
- Access Management
- 11
Community, Stakeholders & Reputation
- Reputation
- Community Expectations
- Stakeholder Engagement
Draft risk taxonomy
Mining
9 level 1 categories, 43 level 2 risks
- 01
Operational
- Transportation Events
- Unplanned Fire or Explosion
- Geotechnical Instability Events
- Weather
- Hazardous Materials Containment Failure
- Service Provider
- Natural Events
- 02
People & Talent
- WHS
- Workforce Capability
- Talent Attraction & Retention
- Psychosocial Hazards
- 03
Key Infrastructure Failure
- Storage Facility Failure
- Fixed Plant Equipment Failure
- Unavailability of Shared Infrastructure
- 04
Cybersecurity
- Cybersecurity Incident
- Service Provider Cybersecurity Incident
- Artificial Intelligence
- Access Management
- 05
Strategic
- Strategic Execution
- Country
- Regulatory Change
- Physical Disruptions
- Consumer Preferences
- Stakeholder Expectations
- 06
Financial
- Commodity Price Volatility
- Fuel Price Volatility
- Liquidity
- Expense
- Revenue
- Foreign Exchange Volatility
- Interest Rate Volatility
- Asset Valuation
- 07
Community
- Human Rights & Indigenous Rights
- Stakeholder Expectations
- Governance
- 08
Environment
- Nature, Biodiversity & Climate Impact
- ESG Expectations
- Physical & Transition
- 09
Ethics & Compliance
- Regulatory Compliance
- Sanctions
- Fraud
- Financial Crime
- Misconduct
Draft risk taxonomy
Electricity, Gas, Water & Waste Services
13 level 1 categories, 55 level 2 risks
- 01
Strategic
- Competition
- Regulatory Change
- Reputation
- Consumer Preferences
- 02
Legal, Regulatory & Compliance
- Regulatory Compliance
- Licensing
- Contractual Compliance
- Statutory Reporting Obligations
- Privacy
- Environmental Regulations
- Litigation
- Land Access Disputes
- 03
Financial
- Revenue
- Expense
- Liquidity
- Energy Price Volatility
- Commodity Price
- Foreign Exchange
- 04
Operational & Asset Management
- Asset Failure
- Maintenance
- Lifecycle Management
- Systems Availability
- Business Process
- 05
Health, Safety & Environment
- Worker Injury
- Public Safety
- Hazardous Materials
- Environmental Contamination
- 06
Cybersecurity
- Data Governance
- Information Security
- Cybersecurity Incident
- Access Management
- 07
Customer & Community
- Customer Services
- Stakeholder Engagement
- 08
Technology & Digital Systems
- Failure of Operational Technology
- IT Outage
- Legacy IT
- 09
Supply Chain & Procurement
- Service Provider
- Inventory
- Service Provider Concentration
- Modern Slavery
- 10
Business Continuity & Resilience
- Disaster Recovery
- Business Continuity
- Crisis Management
- 11
Environmental, Social & Governance
- Emissions Reduction Target
- Water Stewardship
- Governance
- 12
People & Talent
- Misconduct
- Workforce Capability
- Talent Attraction & Retention
- Psychosocial Hazards
- Industrial Relations
- 13
Project Delivery
- Major Project Delays
- Project Governance
- Change Management
- Cost Overrun
Draft risk taxonomy
Agriculture, Forestry & Fishing
9 level 1 categories, 35 level 2 risks
- 01
Climate & Environmental
- Climate Change
- Water Scarcity
- Soil Degradation, Erosion & Salinity
- Deforestation, Habitat Loss & Biodiversity Decline
- Pollution
- 02
Operational & Production
- Machinery Hazards
- Livestock Handling
- 03
Biosecurity & Disease
- Crop Pests, Invasive Species & Plant Diseases
- Livestock Disease
- Biosecurity
- 04
Supply Chain & Logistics
- Service Provider
- Inventory
- Service Provider Concentration
- Infrastructure
- 05
Financial
- Revenue
- Expense
- Liquidity
- Foreign Exchange
- Commodity Price
- 06
People & Talent
- Seasonal Workers
- Workforce Capability
- Talent Attraction & Retention
- Psychosocial Hazards
- 07
Technology & Digital Systems
- Failure of Operational Technology
- IT Outage
- Legacy IT
- Cybersecurity
- 08
Legal, Regulatory & Compliance
- Regulatory Compliance
- Environmental Regulations
- Contractual Compliance
- Modern Slavery
- 09
Strategic
- Reputation
- Stakeholder Engagement
- Governance
- ESG
Draft risk taxonomy
Manufacturing
10 level 1 categories, 41 level 2 risks
- 01
Strategic Risk
- Regulatory Change
- Competition
- Governance
- Reputation
- Strategic Execution
- Product Innovation & Obsolescence
- 02
Process Safety & Hazardous Materials
- Hazardous Chemicals
- Combustible Dust Hazards
- Flammable Liquids, Gases & Explosives
- 03
Machinery, Equipment & Plant Safety
- Fixed Machinery
- Robotics & Automation
- Equipment Failure
- Noise Exposure
- 04
Operational & Production Continuity
- Unplanned Downtime
- Maintenance Scheduling
- Business Process
- Quality Control
- Critical Utilities
- 05
Financial
- Revenue
- Expense
- Liquidity
- Foreign Exchange
- Commodity Price
- 06
Workforce Health, Safety & Ergonomics
- Mobile Plant & Pedestrian Interaction
- Ergonomic Strain, Repetitive Motion Injuries
- Fatigue, Heat and Environmental Exposure
- 07
Supply Chain & Logistics
- Service Provider
- Service Provider Concentration
- Inventory
- Inbound Quality Control
- 08
Technology, Automation & Cybersecurity
- Automation or Robotics Failure
- Cybersecurity Threats
- IT Outages
- Data Governance
- IT Legacy
- 09
Legal, Regulatory & Compliance
- Contract Compliance
- Regulatory Compliance
- Environmental Obligations
- 10
Environmental, Social & Governance
- Emissions Reduction
- Water Stewardship
- Pollution
Draft risk taxonomy
Construction
12 level 1 categories, 41 level 2 risks
- 01
Strategic Risk
- Regulatory Change
- Competition
- Governance
- Reputation
- Strategic Execution
- Product Innovation & Obsolescence
- Project
- 02
Working at Height
- Falls
- Dropped Objects
- Scaffolding
- 03
Mobile Plant & Vehicle Interaction
- Traffic Management
- Mobile Plant & Pedestrian Interaction
- 04
Temporary Works & Structural Stability
- Temporary Works & Structural Stability Failure
- Lifting Operations & Crane Stability Failure
- Temporary Works Engineering Verification Failure
- 05
Financial
- Revenue
- Expense
- Liquidity
- Foreign Exchange
- Commodity Price
- Credit
- 06
Electrical & Energy Hazards
- Overhead Power Line Strike
- Isolation & Energy Control Failure
- Defective Electrical Equipment & Portable Power Failure
- 07
Excavation, Ground & Geotechnical
- Excavation Collapse
- Unstable Ground Conditions
- Underground Services Strike
- 08
Legal, Regulatory & Compliance
- Contract Compliance
- Regulatory Compliance
- Permit Breaches
- 09
Materials, Equipment & Plant Failure
- Materials Quality & Structural Integrity Failure
- Plant Maintenance
- Plant & Equipment Reliability Failure
- 10
Supply Chain & Procurement
- Service Provider
- Service Provider Concentration
- Inventory
- 11
Environmental & Site Conditions
- Weather
- Environmental & Occupational Exposure
- 12
Workforce, Competency & Safety Culture
- Workforce Capability
- Talent Attraction & Retention
- Subcontractor Capability
Draft risk taxonomy
Defence
10 level 1 categories, 53 level 2 risks
- 01
Strategic Risk
- Regulatory Change
- Competition
- Product Development
- Reputation
- Concentration
- Product Innovation & Obsolescence
- 02
Manufacturing & Operational
- Technology
- Data Governance
- Third Party Supplier
- Fraud
- Business Process
- Project
- Equipment Breakdown
- Customer Feedback
- Maintenance Failures
- Business Continuity
- 03
Financial Risk
- Expense
- Revenue
- Foreign Exchange
- Liquidity Risk
- Taxation
- 04
Supply Chain & Logistics Risk
- Supplier & Third Party Management
- Critical Component Shortages
- Inventory Management Failures
- Customs & Export Delays
- Logistics & Transport
- 05
Environmental, Health & Safety Risk
- Workplace Safety
- Weapons & Munitions Safety
- Hazardous Materials
- Occupational Health
- Process Safety
- Manufacturing Safety
- Psychosocial Safety
- 06
Regulatory & Compliance Risk
- Defence Regulatory Compliance
- Firearms & Weapons Regulation
- Privacy
- Export Controls & Sanctions
- Legal & Contractual Compliance
- Regulatory Compliance
- Fraud, Bribery & Corruption
- 07
Product Safety & Quality Risk
- Safety Defects
- Product Recalls
- Failure to Meet Military Specifications
- 08
Cyber Security Risk
- Cyber Security
- Information Security
- Technology Platforms
- 09
People & Talent Risk
- Workforce Capability
- Talent Attraction & Retention
- Employee Misconduct
- 10
Security & Physical Asset Risk
- Physical Security Breaches
- Theft of Weapons
- Sabotage
- Loss of Classified Material
Draft risk taxonomy
Franchise
9 level 1 categories, 39 level 2 risks
- 01
Strategic Risk
- Regulatory Change
- Competition
- Product Development
- Reputation
- Site Selection
- Product Innovation & Obsolescence
- 02
Operational Execution
- Change Management
- Customer Feedback
- Project
- Fraud
- Business Process
- 03
Financial Risk
- Expense
- Revenue
- Credit
- Liquidity Risk
- 04
Supply Chain & Logistics Risk
- Supplier & Third Party Management
- Logistics
- Inventory Management Failures
- Quality Assurance
- 05
Legal, Regulatory & Compliance Risk
- Franchising Code of Conduct
- Consumer Law Breaches
- Legal & Contractual Compliance
- Regulatory Compliance
- Litigation
- 06
Health, Safety & Environment
- Food Safety
- WHS
- Hazardous Materials
- 07
Technology, Systems & Cybersecurity
- Cyber Security
- Information Security
- IT Outage
- Legacy IT
- Access Management
- 08
People & Talent Risk
- Workforce Capability
- Talent Attraction & Retention
- Employee Misconduct
- Training & Development
- 09
Business Continuity & Disruption
- Disaster Recovery
- Business Continuity
- Crisis Management
Draft risk taxonomy
Software Company
6 level 1 categories, 23 level 2 risks
- 01
Strategic
- Competition
- Regulatory Change
- Reputation
- Concentration
- Strategic Execution
- 02
Operational Risk
- Business Process
- Change Management
- Project
- Business Continuity
- Customer
- 03
Technology & Cyber
- Information Technology
- Information Security
- Artificial Intelligence
- Data Governance
- 04
Legal & Compliance
- Regulatory Compliance
- Privacy
- Litigation
- 05
Financial Risk
- Revenue
- Expense
- Liquidity
- Capital
- 06
People & Culture
- Capability
- Key Person Risk
- 1
Start from the closest taxonomy
Choose your industry, or the generic taxonomy if none fits.
- 2
Download the CSV
One row per level 2 risk, with four columns: Primary, Primary Definition, Secondary and Secondary Definition. It opens in Excel, Google Sheets and Numbers, and it is the four-column layout ShelfGRC's taxonomy import reads.
- 3
Make it yours
Rename, merge and split categories, add definitions and level 3 risk types, and validate the result with your risk, compliance, legal and audit teams before it is approved.