Find the single sub-domain most holding back the others, so the work fixes the cause rather than a symptom.
The five sub-domains sit in a dependency order. Upstream weakness constrains everything downstream, so it is fixed first. The rule: your binding constraint is the lowest-scoring sub-domain that sits highest in this order. If two are tied, the one higher in the order is the constraint. One override: an imminent critical risk is addressed immediately regardless of sequence.
| Order | Sub-domain | Why it sits here |
|---|---|---|
| 1 (most upstream) | Risk identification and assessment | You cannot reduce, plan for, or fortify against risks you have not found. |
| 2 | Key-person risk | Usually the sharpest structural risk, reduced by distributing across the team. |
| 3 | Concentration and dependency risk | Diversifying the dangerous concentrations, structural reduction. |
| 4 | Continuity and contingency | Planning for the risks that remain after reduction. |
| 5 | Resilience and monitoring | The sustaining layer, buffers and ongoing watch. |
| Sub-domain | Your level (1 to 5) | Dependency order |
|---|---|---|
| Risk identification and assessment | 1 | |
| Key-person risk | 2 | |
| Concentration and dependency risk | 3 | |
| Continuity and contingency | 4 | |
| Resilience and monitoring | 5 (imminent risk = immediate) |
The upstream constraint caps everything below it. Carry the constraint and all five scores into the Prioritized Resilience Action Plan.
Your answers stay in your browser on this page and are never sent anywhere.