Why a viral AI risk map raised a procurement question
This week, an AI risk map circulated on LinkedIn: 12 domains, 55 categories, and 196 risk factors, developed by Evan Wheeler and shared by Jad Nicolas, as noted in Procurement Insights by Jon W. Hansen. The piece credits the map as a thorough inventory and a starting point, not a control framework. Hansen’s question is how those 196 items affect each other, because in operations they do.
Accountability charts do not match how risk behaves
Most organizations assign each risk type to a function. Security sits with IT, model risk with data science, contracts with legal, and supplier risk with procurement. Maps mirror the org chart, which helps accountability but poorly reflects behavior, because risks do not stay in silos.
Registers score one risk while outcomes need several
The usual approach is a register: likelihood times impact, one risk at a time. Hansen asks how you can rate a risk without knowing what it crosses. A supplier qualification gap might look minor alone. Pair it with an approver measured on cost savings, a supplier cutoff at 2 p.m., and an AI agent allowed to place orders on its own, and the result can be a missed delivery on a critical part. None of the four might score high alone; together they are the failure. Registers rarely include a field for “this one makes that one worse.”
The scale of combinations nobody tracks
Hansen puts the math in one figure: 196 risks can pair in 19,110 different ways, before counting three- or four-way crossings or dormant risks that wake when something else changes. At any moment some strands are active, some quiet, and some are about to cross. A longer list adds completeness and makes the tracking problem harder.
Start from the outcome, not the full list
Hansen describes an approach used since 1998: start with an outcome that is falling short and trace back. Only a handful of factors among a large map then matter, the ones that crossed to produce that outcome.
In a defence maintenance operation in 1998, next-day delivery was 51% though each function’s measures looked correct. Technicians were measured on call volume and held part orders until late afternoon, crossing procurement’s clock and supplier and courier cutoffs. Tracing from missed deliveries surfaced those links; within three months next-day delivery reached 97.3%. Hansen frames this as strands that cross and show their connection at the shared outcome.
AI and three review questions
The limiting factor is not how many risks you can list but how many interactions you can see at once, what Hansen calls the aperture. Tools and structures often reward completeness and single-owner boxes, not seeing where strands cross. AI agents do not stay in one box: one decision can cross procurement, finance, logistics, and a supplier’s operation in seconds while governance is still one owner at a time.
For the next risk review, Hansen poses: which outcome is falling short and which risks crossed to produce it; which risks are dormant and what would wake them; and who owns the connections between risks, not only the risks themselves. If no one can answer the third, he argues that may be the biggest risk, and it is not on the map.
