CAMP 02 · RISK & REGULATORY INTELLIGENCE
Start with one business activity. Build a clear picture of what could go wrong and what to do next.
HOW TO READ YOUR MAP
Suggested scenarios help you think through a situation. They are not findings about your organization. Keep and edit only those that fit, and add risks the prompts do not cover.
Record laws, contracts, policies or commitments with their sources. Applicability is confirmed by your team. This version does not look up regulations, monitor changes or infer requirements from a country name.
Rate likelihood and impact from 1–5. Their product gives a working priority: 1–4 low, 5–9 moderate, 10–15 high, 16–25 very high. These are Sherpa’s illustrative bands, not legal thresholds or an ISO-prescribed scale.
Inherent risk is your estimate before controls. Residual risk is your separate estimate with current controls; it requires an explanation and is never reduced automatically. Planned actions do not count as operating safeguards. Entries and optional saved drafts remain in this browser. Downloaded files contain the information you enter. No evidence or legal applicability has been independently verified.