BoxGovernance Risk MatrixIBMLive · controls × risk tiersGovernance Risk Matrix
Controls vs. Risk Tiers
Maps each governance control to the risk tier it mitigates and the enterprise domain it enforces. Cell color and status chip show where mitigation stands — audited (in place), in build, still a gap, or operating under exception.
20
Total Controls
10
Mitigated (Audited)
6
In Build
3
Mitigation Gaps
1
Exceptions Active
50%
Coverage
...
Mitigation StatusDesign· Not yet enforced — mitigation gapIn Build· Control under constructionAudited· Enforced & validated — mitigation in placeException· Excepted — compensating controls required
Tier 1
Critical83%mitigated · 5/6 controls
0 agents at this tierStrong
Tier 2
High43%mitigated · 3/7 controls
1 agents at this tierIn progress
Tier 3
Medium20%mitigated · 1/5 controls
1 agents at this tierExposed
Tier 4
Low50%mitigated · 1/2 controls
0 agents at this tierIn progress