Risk Analysis
 
Analyzing Risks
Creating Risk Types
EA Risk Types
The risk analysis phase associates a risk with:
• risk types
• risk factors, risk consequences and other risks
*Contextualizing a risk, i.e., defining its scope, is part of the risk analysis process. See also Contextualizing Risks.
Analyzing Risks
To analyze a risk:
2. Select a risk and open its properties.
3. In the Characteristics tab, expand the Analysis section.
A risk is characterized by:
• Risk types
*For more details, see Creating Risk Types and EA Risk Types.
• Risk Factors
• Risk Consequences
• Related Risks
Creating Risk Types
To create your own risk types:
1. In the navigation bar, click Risks > By Risk Type.
2. Click New.
The new risk type appears in the navigator menu tree.
*Similarly, you can create a sub-risk type from a risk type.
EA Risk Types
The risk taxonomy in Hopex enables the classification of risks identified through Enterprise Architecture activities and facilitates their analysis and reporting.
Security & compliance
Risk Type for risks concerning protection against threats and meeting legal/regulatory/security obligations.
Risk examples: vulnerabilities, IAM, encryption, audit findings, ISO/NIS2/GDPR, segregation of duties.
Data
Risk Type for risks concerning data quality, ownership, privacy, and fitness-for-purpose of information .
Risk examples: master data issues, inconsistent definitions, lineage gaps, privacy classification, retention.
Integration & complexity
Risk Type for risks concerning coupling, interfaces, dependencies, and the complexity that makes change fragile.
Risk examples: point-to-point integrations, API issues, brittle interfaces, dependency chains, too many handoffs.
Technology lifecycle / obsolescence
Risk Type for risks concerning sustainability of technology: supportability, end-of-life, skills availability.
Risk examples: EOL products, unsupported versions, skill scarcity, patching impossible, upgrade backlog.
Resilience & performance
Risk Type for risks concerning ability to meet availability, continuity, capacity, and performance needs.
Risk examples: outages, DR gaps, single points of failure, latency, scaling limits, capacity constraint.
Vendor / third-party & lock-in
Risk Type for risks concerning dependency on external parties and contractual/strategic exposure.
Risk examples: supplier failure, SLA weaknesses, exit costs, lock-in, subcontractor risk, license surprises.
Operability (run-ability)
Risk Type for risks concerning whether the solution can be reliably operated day-to-day.
Risk examples: monitoring gaps, unclear ownership, poor logging, no runbooks, hard-to-support design.
Service management / operations process
Risk Type for risks concerning weaknesses in IT operational processes and controls (ITIL/ITSM).
Examples of risks: change failures, incident/problem management maturity, CMDB gaps, release mgmt issues, poor escalation.
Change & adoption
Risk Type for risks concerning people/process adoption and business readiness to realize outcomes.
Examples of risks: training gaps, role confusion, resistance, change saturation, process not followed.
Delivery & governance
Risk Type for risks concerning ability to execute: planning, decisions, resources, funding, and coordination.
Examples of risks: planning, decisions, resources, funding, and coordination like schedule/cost risk, dependency delays, decision latency, unclear scope, lack of SMEs, weak governance.