Risks flow upwards

The lead played the blast radius and named what was missing (D22↗): a risk does not stop with its holder. Connect the CRM and two risks sat with the CIO and Sales, as if the CTO, the CEO and the board had nothing to carry.

• Every live risk now lights the path from its holder to the board. Each role above carries a count, so the CEO's badge is the aggregate of what the CIO, the CISO, Sales and the COO hold beneath. Click or hover a role and a panel says what it holds, what it carries from below, what it is informed of, and what the map says it protects.
• Every risk that holds at that moment is listed under the figure: holder and state, the chain it reaches, its consequence in words, and whether it can be undone.
• The level the business already accepts is on the picture. Row 1 is now the rep's own mail, and it establishes R0, a risk inside the rep's own authority that they accept on connecting. A new row 9, the shared sales inbox every rep is delegated to, is outside the mandate and establishes R7, held by Sales. The article's tables, counts and six weeks follow: nine rows, five in the gap, unbounded excess five, then four, then three; four open risks on day 42, two of them the rep's own.
• Only the roles this agent reaches are drawn. Marketing, Product and HR stay in the tables and leave the figure. Legal and the CFO are informed of every risk that touches a customer or their data.
• A compound risk is drawn larger by the number of facts it needs, so the lethal trifecta is the biggest circle on the page. Size is a count of facts, not a rating.
• The control group is titled controls, as boundaries, which is what they are.

What was not done:

• A quantity of impact or potential loss on a risk. Each carries a consequence in words and an undo property, and no number. The article's own rule is that kinds of consequence do the work a score usually does, and a loss figure is the lead's decision.
• Other scenarios. One agent, as asked.