The Hazard Heatmap 2.3C.4-1

The hazard heatmap is the visual output of the quarterly hazard scan. It rates each organizational decision domain on two dimensions — impact if corrupted and current control effectiveness — to surface the areas where moral-hazard risk is highest and investment is most urgent.

Building the Heatmap

Step 1 — Identify Decision Domains

List every domain where your institution makes consequential decisions: hiring, data access, finance, contract approval, vendor management, security, compliance, compensation, promotion, termination, strategic planning, and any domain specific to your institution's mandate.

Step 2 — Rate Each Domain

For each domain, assess two dimensions.

Impact if corrupted. How severe would the consequences be if decision-making in this domain were compromised — through gaming, capture, or misaligned incentive? Low: inconvenient but recoverable. Medium: significant harm to people, trust, or institutional capacity, with moderate recovery cost. High: institution-damaging, with difficult or impossible recovery.

Current control effectiveness. How well does the institution's current structure prevent corruption in this domain? Strong: hard-coded controls, segregation of duties, regular audit. Adequate: policy-based controls, periodic review. Weak: judgment-dependent, no structural enforcement, or controls that exist on paper but are not audited.

Step 3 — Map the Results

Table 2.3C.4-1 — Hazard Heatmap

Quarterly assessment of organizational moral-hazard risk by decision domain

Risk levels: Critical (high impact + weak control) — requires immediate action. Elevated (high impact + adequate control, or medium impact + weak control) — requires quarterly monitoring and improvement plan. Managed (adequate or strong controls proportional to impact) — maintain. Accepted (low impact regardless of control) — not worth structural investment unless impact assessment changes.

Step 4 — Track Quarter Over Quarter

Each quarterly heatmap is compared to the previous one. Critical-risk domains that remain critical after one quarter require escalation to governance leadership. Elevated-risk domains that remain elevated after two quarters require a structural review — why are controls not improving? Domains that move from managed to elevated or critical require investigation — what changed?

The heatmap becomes part of the organization evidence pack (2.3C.4-3) and is reviewed alongside the hazard scan findings.

Integration Points

• Quarterly hazard scan (2.3C.4): The hazard scan produces the assessment; the heatmap visualizes and tracks it.
• Enforce-in-code flow (2.3C.3-1): Critical-risk domains identified by the heatmap are candidates for stronger encoding — moving from policy to hard code, or from review to mandatory policy.
• Organization evidence pack (2.3C.4-3): Quarterly heatmaps, tracked over time, demonstrate that the institution is actively managing its moral-hazard landscape.