Enterprise Risk Management

BC-120 Level 1 Cross-Industry 12 providers 31 API surfaces 8 rated strong or better

Identifying, assessing, mitigating, and monitoring risks at enterprise level.

Enterprise Risk Management (BC-120) is a level-1 business capability in the Cross-Industry model. The catalog holds 31 API surface(s) from 12 provider(s) that can perform some part of it, 8 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.

Where this capability definition comes from. This capability is part of a published business-architecture model that API Evangelist did not author. It is redistributed here under CC-BY-4.0. Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented. Source repository · NOTICE and third-party framework attributions

Sub-capabilities

Risk Framework & Appetite Management BC-120.10

Risk taxonomy, framework, appetite, and tolerance.

1 provider, 2 API surfaces

Risk Identification & Assessment BC-120.20

Risk discovery, assessment, scoring, prioritisation.

10 providers, 13 API surfaces

Risk Treatment Management BC-120.30

Mitigation, transfer, avoidance, acceptance decisions.

3 providers, 5 API surfaces

Risk Monitoring & Reporting BC-120.40

Risk indicators, dashboards, reporting to governance bodies.

1 provider, 1 API surface

Corporate Insurance Management BC-120.50

Buying and managing corporate insurance programmes.

1 provider, 2 API surfaces

Providers that reach this capability

Ordered by rating band. Reach means a provider publishes an API surface that can perform some part of this capability — it is not a claim that any particular organisation has deployed it.

Exemplar 3 Complete, well-documented, and agent-ready
OneTrustRisk ActionsRisk ManagementRisk RelationshipsRisk Templates5 APIs77.1DrataRisk DocumentsRisk LibraryRisk NotesRisk Registers5 APIs70.7anecdotesRisk1 API69.4
Strong 5 Solid coverage with minor gaps
AiriaGovernanceDashboardMitigationDefinitionRiskArtifactRiskControls7 APIs65.7FenergoRisk Assessment1 API64.3SecureframeRisk1 API59.3AclaimantPoliciespolicy-programs2 APIs57.2Credo AIentity_risk_scenariosrisksuse_case_risk_scenarios3 APIs56.7
Developing 4 Usable, with meaningful gaps to close
Signal AIRisk Events1 API52.0Base OperationsThreats1 API50.3WegalvanizeMitigationsRisksStrategy3 APIs49.8AloftRisk Assessments1 API45.6
This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature. This page shows which providers and tags reach Enterprise Risk Management. The underlying tag → capability edges — each with the quoted fragment of the provider's own OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate it passed — are available through the API, along with company-level capability maps. Only edges at confidence ≥ 0.7 with evidence found verbatim in the source contract are published at all.

See plans →  ·  How the edges are graded →