Diagrams and notesInsider Risk / Threat Convergence

A thread under a Forscie® diagram ended with Joshua Sinai suggesting I draw how I see risk, threat and event. So here it is, with Steve Layne’s InR/T construct borrowed for the title, since it keeps both sides in view instead of collapsing them.

Drawn one inside another, the three sit still: a relationship that holds whether or not an event is actually occurring. Drawn against time they behave differently. They move at their own pace and intersect intermittently, and the intersections are the part worth watching.

Risk is the standing exposure, and it is not only technical. Weak entitlement design belongs to it, and so does the way people work. Threat is who could and would act. An event is what occurred, stripped of any why.

Underneath all three sit the motives. No instrument gives direct access to them, though evidence can support hypotheses about them, and an investigation rarely returns a single one. What surfaces is usually several, weighted and partly contradictory, which is why the same act can be read more than one way even after someone has looked.

A case can open on any of these factors, and tests how they relate; the motive does not have to be known in advance. They do not always line up, and when they do the reading still depends on which of them you are looking through.

Separate tracks also mean separate work. You reduce risk by closing what can be exploited and by shaping the conditions people work under. You address threat by monitoring within the approved scope and by acting to prevent or stop the harm. Different actions, different rhythms. Do only one and the other keeps running underneath, until whatever you left uncovered on one track meets whatever was moving on the other.