Pattern
Risk bearer map
This note gives a map of who carries each risk and who controls it, with the rule that responsibility should not move away from control. It matters because a party asked to carry risk needs the information, authority and intervention path to manage it. Show who carries clinical, product, data, implementation, cybersecurity, financial, operational, and reputational risk.
Map
For each risk, name the party carrying it now, the party controlling it, how the intervention changes exposure, available evidence, contractual treatment, insurance, and escalation path.
Rule
Responsibility should not move away from control. A party asked to carry risk needs the information, authority, and intervention path needed to manage it.
Review
Test whether the arrangement remains defensible to patients, clinicians, regulators, boards, and independent investors.