The framework / 04

The structure of risk

The structure of risk is a core model for Plain Risk. It connects the circumstances, possible developments, those affected, and the harm or loss they could suffer.

A starting question is: how could someone or something come to suffer harm in these circumstances?

Reading the relationships

Exposure describes being in circumstances where harm is possible. Causes and consequences explain how developments connect. The same occurrence can be a consequence in one connection and a cause in another. Calling something a control identifies the possibility it is intended to prevent, detect or limit.

The diagram provides a starting pattern. A situation can involve several causes, people and consequences, or a gradual change without a single defining event. A description can leave a connection unresolved rather than imply that it is established.

Example: A restaurant stores chilled ingredients in one cold room. Cooling could fail, the food could spoil, and the restaurant could lose stock. The diagram distinguishes what happens from who suffers the loss.

Drag a point to move an item, or focus it and use the arrow keys.

Start at any node and type directly into its field. You can add further items and connections. The example and your own entries are kept separate.

Connect items

Review the connections with the people involved. Entries stay in this page only; print your work before leaving or reloading.

What the model helps examine

  • Who or what could be harmed, and in what respect?
  • How do the possible developments connect, and under what conditions?
  • Does the description distinguish a consequence from the harm it could cause?
  • Which possibility does a proposed control address, and could it contribute to another risk?

Likelihood concerns a specified possibility, period and set of conditions. Uncertainty identifies what is unknown or unsettled. Objectives help explain what matters and guide exploration; a declared objective is not required for someone to face harm.

The diagram organises a description. It does not establish the truth of its connections or calculate a risk rating.

Plain Risk, developed by Dr Julien Maréchal. © 2026 The Governance Practice.

Original materials: CC BY 4.0. Scope and attribution.

Logos, third-party material, and website software are excluded.