Risk registers are a ritual of humanitarian work - a list of everything that might go wrong, colour-coded by likelihood and impact. Completing one feels orderly. Comforting, even.
At Here I Am, we’ve made hundreds. But over time, we realised they no longer describe - or protect - the world we work in. The risk register was built for predictable systems: factories, supply chains, budgets. But humanitarian systems aren’t predictable; they’re alive. A single data leak, mistranslated message, or network outage can ripple across lives, trust, and politics in minutes. A spreadsheet can’t see that. A system can.
A register can only list risks. It can’t show how they behave, evolve, and connect. Today’s risks don’t sit neatly in rows or boxes. They’re social, digital, political, human - able to escalate from a small error to large-scale harm in moments. A single security breach exposes names from an aid database. Within minutes, that data is weaponised. A technical flaw becomes a life-threatening protection crisis.
A chain reaction no spreadsheet can predict.
So instead of asking what might go wrong, we’re asking how risks evolve and behave together.
We call this Systems Risk Mapping.
Systems Risk Mapping is a rapid, participatory way to understand how risks move through complex systems - social, digital, political, and human. Instead of listing threats in isolation, teams map relationships, feedback loops, and dependencies. It turns risk management from a static document into a shared act of sense-making - showing how a single design decision can ripple across lives, data, and institutions.
Where a risk register asks “What could go wrong?”, Systems Risk Mapping asks “What happens next?”
When It’s Created
The output isn’t a spreadsheet. It’s a shared visual model of the system - a living map of how risk behaves, evolves, and connects. Teams leave with:
- At project inception, to anticipate how risks interact before design choices lock in.
- During prototyping or rollouts, to revisit assumptions as the system comes to life.
- After pilots or incidents, to learn from real-world feedback and close ethical loops.
Unlike a risk register - updated once a quarter and filed away - Systems Risk Mapping is regenerative. It evolves with the project, revisited at key decision points to reflect changing realities. Each map is a snapshot of understanding at a moment in time, co-created by those who design, deliver, and are affected by the system.
It helps teams:
- See the whole system, not just the part they control.
- Identify where harm travels, across people, platforms, and policies.
- Find leverage points, small design or governance shifts that prevent large-scale failure.
- Build shared accountability, so ethics and protection aren’t left to one function or phase.
How It Happens
A two-hour, facilitated session replaces the static register with a systems view of risk, impact, and responsibility. The conversation follows five steps.
- Map the System
Who and what are connected?
Teams identify the actors, data flows, and dependencies - from users to intermediaries to unseen technical systems. - Surface the Assumptions
What has to go right for this to work?
What happens if it doesn’t?Participants expose fragile assumptions holding the system together - technical, social, and ethical. - Trace the Ripples
If one element fails, who feels it first? Who feels it next?
Teams follow cause-and-effect chains across human, digital, and political layers to reveal how harm propagates. - Find the Leverage Points
Where can small design shifts, features and nudges prevent large-scale harm?
They identify interventions - in design, governance, communication, or consent - that strengthen resilience. - Define Responsibility Objectives
What commitments will we make? How will we be accountable?
Each team translates insights into tangible, trackable actions - embedded in delivery plans, not parked in documents.
The outputs
The output isn’t a spreadsheet. It’s a shared visual model of the system - a living map of how risk behaves, evolves, and connects. Teams leave with:
- A clear view of cascading risks.
- Concrete leverage points for prevention.
- Defined responsibility objectives with owners and timelines.
Systems Risk Mapping works because it sees the whole picture. It reveals how risks interact and amplify one another, how small shifts can create and prevent large failures. It’s still risk management - just redesigned for the complexity of today’s world.
If you’re rethinking how your organisation approaches risk, we’d love to talk: hello@hereiamstudio.com
