Human Risk Graph · organization.yaml

FCritical risk

Main driver: key-person risk — Bus factor 1. Losing Alice cuts off 2 people and 67% of connections.

Severe human dependency risks that need immediate attention.

5 people5 dependencies 3 errors · 2 warningsmodel hrg-22026-11-13 09:26

Key-person risk High

Bus factor 1

Losing Alice cuts off 2 people and 67% of connections.

Approval concentration High

1.5 effective approvers

of 2; Alice holds 77% of approval weight.

Override exposure High

2 of 3 critical approvals

can be overridden through a bypass.

Top fixes

Remediations simulated on your data, ranked by how much they raise the score.

Doing all 3 raises the score from 25 to 76 (grade F → C).

1
Bypass control
Require a second person for Bob's bypass of Alice

bypass involving a critical person

+20 25 → 45
2
Deputy
Add a deputy for Alice

single point of failure, cuts off 2 people

+26 45 → 71
3
Deputy
Add a deputy for Bob

single point of failure, cuts off 1 person

+5 71 → 76

Simulated on the model: a deputy shares the person's approvals and escalations; a bypass control means no single person can override, so the bypass is removed.

Dependency map

Who approves, escalates to and can bypass whom. Select a person for details.

Critical single point of failure Single point of failure Critical (≥ threshold) Other Approval Escalation Bypass Moving dots run from who approves, escalates or bypasses to whom · Select a key person: the people cut off without them pulse red · Node size: criticality and impact · Drag to pan when zoomed

People

Impact is the share of connections between the others that depend on the person.

Person	Criticality	Impact	Cuts off	Approval share	Flags
Alice Head of Platform	0.90	67%	2	77%	SPOFcritical
Bob SRE	0.70	50%	1	23%	SPOFcritical
Carol Security Engineer	0.60	50%	1	—	SPOF
Dave Developer	0.40	—	—	—
Erin Developer	0.30	—	—	—

Findings

3 errors · 2 warnings, with related ISO/IEC 27001, SOC 2 and DORA controls.

Related controls are informative pointers for audits, not an assessment of compliance.

HRG001 Single point of failure 3

errorAlice (alice) is a single point of failure (criticality 0.90): losing them cuts off 2 people and 67% of the connections between the others.
errorBob (bob) is a single point of failure (criticality 0.70): losing them cuts off 1 person and 50% of the connections between the others.
warningCarol (carol) is a single point of failure (criticality 0.60): losing them cuts off 1 person and 50% of the connections between the others.

Remediation. Name a deputy, cross-train them, and document the approvals and emergency procedures this person handles.

ISO/IEC 27001:2022A.5.29A.5.30

SOC 2 (2017 Trust Services Criteria)CC1.4CC9.1

DORA (Regulation (EU) 2022/2554)Art. 10(1)Art. 11(2)(a)

HRG002 Concentrated approval authority 1

errorApproval authority is concentrated (1.5 effective approvers of 2); Alice (alice) holds 77% of the approval weight.

Remediation. Add secondary approvers for sensitive workflows and spread ownership of high-impact decisions.

ISO/IEC 27001:2022A.5.2A.5.3

SOC 2 (2017 Trust Services Criteria)CC1.3CC5.1

DORA (Regulation (EU) 2022/2554)Art. 5(2)(c)Art. 6(4)

HRG003 Bypass involving a critical person 1

warningBob (bob) can bypass Alice (alice) and override the controls they enforce; one of them is critical.

Remediation. Require a second person for the bypass, log every use, and review each use after the fact.

ISO/IEC 27001:2022A.5.3A.8.2A.8.32

SOC 2 (2017 Trust Services Criteria)CC5.1CC6.3CC8.1

DORA (Regulation (EU) 2022/2554)Art. 9(4)(c)Art. 9(4)(e)

How the score is calculated

Model hrg-2.

Key-person risk K: the largest criticality × impact, where impact is the share of connections between the others that are lost without the person.
Approval concentration D: Herfindahl-Hirschman index of approval weight; 1/D is the effective number of approvers.
Override exposure B: weighted share of critical approvals whose approver can be bypassed.

Composite risk = (1 − (1 − 0.4·K)(1 − 0.3·D)(1 − 0.3·B)) / (1 − (1 − 0.4)(1 − 0.3)(1 − 0.3)) = 0.750; score = 100·(1 − risk) = 25

Metric	Value	Weight
Key-person risk	0.600	40%
Approval concentration	0.649	30%
Override exposure	0.773	30%
Composite risk	0.750

Grades: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 50, F below 50. Full definitions and properties: docs/model.md.

Audit trail

Enough to reproduce this result.

Input file	`organization.yaml`
Input SHA-256	`dc4c28c2224efd83d8e141c3573876660282f40ef2113fb3fdc7904c32516618`
Generated	`2026-11-13T09:26:36`
Tool	`human-risk-graph 0.14.0`
Model	`hrg-2`
Weights	`α 0.4 · β 0.3 · γ 0.3`
Critical threshold	`0.7`
Config	`none`
Unconfirmed dependencies	`0`
Data gaps	`0`
People / dependencies	`5 / 5`