Measuring Structure

Firms have spent years mapping the people, technology, processes, facilities, information and third parties that support important business services. That work matters: it reveals how the business operates and where disruption can travel. Regulators have reinforced the same expectation. Basel, the UK supervisory authorities and DORA require firms to understand the resources and dependencies behind important services and use that understanding in testing, recovery and third-party oversight.

But a connected view is not yet a risk measure. A map can show that several important services rely on the same component. It does not, by itself, establish how much exposure that component carries, whether apparent alternatives are genuinely independent, or which remediation would reduce the most consequential risk.

OneScor, Iroko Technologies’ risk and resilience platform, applies governed operational risk and resilience logic to that connected structure. It is built on what we call the Operational Topology. Neo4j provides the graph foundation that makes traversal, reachability and path analysis direct and scalable at enterprise depth.

Together they turn dependency information into a decomposable view of effective exposure: a component’s assessed condition combined with the structural risk inherited through its dependencies. The result is not another diagram but a governed model for finding concentrations, challenging redundancy, prioritizing treatment, directing testing and explaining every decision. It can also be tested against incident experience and recalibrated as evidence improves.

The map is the input. The decision requires measurement.