SWIFT ISO 31010: Structured What If Risk Assessment Technique | growGRC | growGRC
SWIFT: Structured What If Technique for Risk Identification
SWIFT (Structured What If Technique) is a systematic risk assessment technique that uses structured What If questions to identify threats, deviations, opportunities and potential consequences.
Published: 8/1/2026Updated: 8/1/2026By growGRC Editorial Team
Executive Summary
SWIFT is a qualitative risk assessment technique based on structured What If questions. It helps organizations identify scenarios, causes, consequences and treatment actions through collaborative analysis.
Key Takeaways
✓SWIFT stands for Structured What If Technique.
✓It is a recognized risk assessment technique described in ISO 31010.
✓It uses structured questions to identify possible risk scenarios.
✓It improves collaboration between business and technical experts.
✓SWIFT results can be integrated into GRC risk management workflows.
SWIFT: Structured What If Technique for Risk Identification
SWIFT (Structured What If Technique) is a risk assessment technique used to identify potential events, causes, consequences and existing controls through structured questioning sessions.
The technique helps teams explore possible scenarios using questions such as:
"What if...?"
SWIFT is widely used in enterprise risk management, operational safety, projects, industrial processes and system analysis.
Executive Summary
Early risk identification allows organizations to anticipate events that may affect their objectives.
SWIFT provides a collaborative approach where experts analyze hypothetical situations and determine:
SWIFT uses structured workshops where a facilitator guides participants through carefully prepared questions.
Example:
"What if the critical cloud provider becomes unavailable for 48 hours?"
The team evaluates:
possible causes;
likelihood;
impacts;
current controls;
response options.
SWIFT Process Model
SWIFT Objectives
The main objectives of SWIFT are:
discover unidentified risks;
validate existing controls;
explore future scenarios;
improve decision-making;
encourage multidisciplinary collaboration.
When to Use SWIFT
SWIFT is particularly useful for:
Situation
Application
New projects
Initial risk identification
Organizational changes
Impact analysis
New processes
Deviation analysis
Critical systems
Failure scenario exploration
Benefits of SWIFT
Benefit
Description
Easy to understand
Enables broad participation
Flexible
Adaptable to different contexts
Experience-based
Uses expert knowledge
Collaborative
Improves communication
Limitations of SWIFT
SWIFT also has limitations:
depends on participant expertise;
may miss unknown risks;
requires effective facilitation;
results may contain subjective judgments.
Key Elements of a SWIFT Workshop
1. Define the Scope
Before starting, organizations should establish:
process boundaries;
evaluated system;
objectives;
assumptions;
participants.
A clear scope prevents incomplete or excessive analysis.
2. Select Participants
A multidisciplinary team improves the quality of results.
Typical participants include:
Role
Contribution
Process Owner
Operational knowledge
Risk Team
Methodology expertise
Technology Team
Technical dependencies
Security Team
Threat identification
Audit
Independent perspective
3. Generate What If Questions
Questions are the foundation of SWIFT.
Examples:
Question
Risk Area
What if the main system fails?
Availability
What if a critical supplier cannot deliver?
Third-party risk
What if regulations change?
Compliance
What if demand increases unexpectedly?
Capacity
SWIFT: Structured What If Technique for Risk Identification
SWIFT (Structured What If Technique) is a risk assessment technique used to identify potential events, causes, consequences and existing controls through structured questioning sessions.
The technique helps teams explore possible scenarios using questions such as:
"What if...?"
SWIFT is widely used in enterprise risk management, operational safety, projects, industrial processes and system analysis.
Executive Summary
Early risk identification allows organizations to anticipate events that may affect their objectives.
SWIFT provides a collaborative approach where experts analyze hypothetical situations and determine:
potential events;
possible causes;
consequences;
existing controls;
improvement actions.
SWIFT at a Glance
Element
Description
Full Name
Structured What If Technique
Category
Risk assessment technique
Reference
ISO 31010
Analysis Type
Qualitative
Approach
Scenario-based analysis
Main Purpose
Risk identification
SWIFT Risk Record Structure
The output of a SWIFT session should be documented in a structured format.
Field
Description
Scenario
Hypothetical situation analyzed
Cause
Source of the event
Event
Risk occurrence
Consequence
Resulting impact
Existing Controls
Current safeguards
Recommended Action
Risk treatment
Causal Risk Modeling with SWIFT
SWIFT aligns well with modern risk taxonomy models.
Example:
Dimension
Description
Cause
Lack of technology redundancy
Event
Service outage
Effect
Operational disruption and financial impact
This approach improves consistency and enables better analytics in GRC platforms.
Risk Evaluation Using SWIFT
After identifying scenarios, teams evaluate:
Likelihood
The expected probability or frequency of occurrence.
Impact
The consequences affecting:
financial performance;
operations;
customers;
reputation;
compliance obligations.
Risk Level
Organizations commonly calculate:
Risk Level = Likelihood × Impact
SWIFT Risk Matrix Example
Likelihood
Low Impact
Medium Impact
High Impact
Low
Low
Medium
High
Medium
Medium
High
Critical
High
High
Critical
Critical
Risk Treatment After SWIFT Analysis
Identified risks should result in decisions.
Common strategies include:
Strategy
Description
Avoid
Remove the risky activity
Reduce
Implement additional controls
Transfer
Share risk with another party
Accept
Retain risk within appetite
Practical Example: SaaS Platform
Context
A SaaS company depends on an external cloud provider.
SWIFT Question
What if the cloud provider experiences a prolonged outage?
Analysis
Element
Result
Cause
Technology dependency
Event
Service unavailability
Effect
Customer disruption
Existing Control
Service Level Agreements
Action
Implement redundancy
SWIFT Applications by Industry
Financial Services
Applications:
operational resilience;
fraud scenarios;
third-party risk.
Healthcare
Applications:
patient safety;
clinical availability;
medical data protection.
Manufacturing
Applications:
production failures;
supply chain disruption;
maintenance risks.
Technology
Applications:
cybersecurity;
availability;
architecture resilience.
Government
Applications:
public services;
regulatory compliance;
operational continuity.
Advanced SWIFT Applications
SWIFT can be combined with other ISO 31010 techniques to increase analysis depth.
Organizations can use SWIFT as an initial discovery method and then apply additional techniques for deeper analysis.
SWIFT Combined With Other Techniques
Technique
Relationship With SWIFT
Combined Use
FMEA
Detailed failure analysis
Process risk analysis
Bow Tie
Barrier visualization
Preventive and recovery controls
HAZOP
Deviation analysis
Complex processes
Monte Carlo
Quantitative simulation
Financial scenarios
Fault Tree Analysis
Root cause analysis
Critical systems
SWIFT Integration With ISO 31000 Risk Management
SWIFT supports several activities within the ISO 31000 risk management process:
1. Communication and consultation.
2. Risk identification.
3. Risk analysis.
4. Risk evaluation.
5. Risk treatment.
SWIFT Within a GRC Program
In a modern Governance, Risk and Compliance (GRC) environment, SWIFT results can be transformed into managed risk objects.
SWIFT Output
GRC Object
Identified scenario
Risk
Cause
Risk cause category
Consequence
Risk impact
Existing safeguard
Control
Improvement action
Treatment plan
Assigned person
Risk owner
Governance of SWIFT Workshops
A mature SWIFT implementation requires clear governance.
Activity
Responsible Role
Methodology definition
Risk Management
Workshop facilitation
Risk Manager
Technical input
Process Experts
Business validation
Process Owners
Treatment approval
Risk Committee
SWIFT Responsibility Model
Activity
Risk Team
Business
Audit
Executive Management
Define scope
Responsible
Accountable
Consulted
Informed
Conduct workshop
Responsible
Responsible
Consulted
Informed
Validate results
Consulted
Accountable
Consulted
Informed
Approve treatments
Consulted
Responsible
Informed
Accountable
Recommended SWIFT Metrics
Organizations can measure SWIFT effectiveness through:
Metric
Description
Number of identified risks
Discovery capability
Treatment completion rate
Response effectiveness
Average analysis time
Process efficiency
New risks discovered
Method sensitivity
Business participation rate
Collaboration level
SWIFT Implementation Best Practices
Prepare the Workshop Properly
Before execution:
define objectives;
establish scope;
select participants;
collect relevant information;
prepare initial scenarios.
Use Experienced Facilitators
A skilled facilitator helps prevent:
uncontrolled discussions;
bias;
superficial analysis;
inefficient sessions.
Document Results Immediately
Risk scenarios should be captured during the workshop.
Avoid relying only on memory or post-meeting summaries.
Convert Findings Into Actions
Risk identification must generate:
owners;
deadlines;
treatments;
monitoring indicators.
Common SWIFT Implementation Mistakes
Mistake
Impact
Improvement
Generic questions
Low-value results
Create specific scenarios
Missing experts
Incomplete risks
Include multiple disciplines
Poor documentation
Information loss
Use formal repositories
No follow-up
Untreated risks
Integrate with GRC workflows
SWIFT Implementation Checklist
[ ] Define workshop objectives.
[ ] Establish analysis scope.
[ ] Select appropriate participants.
[ ] Prepare What If questions.
[ ] Identify scenarios.
[ ] Analyze causes.
[ ] Evaluate consequences.
[ ] Review existing controls.
[ ] Define treatments.
[ ] Assign owners.
[ ] Monitor progress.
Practical Case Study 1: Banking Digital Transformation
Context
A financial institution launches a new digital customer platform.
SWIFT Question
What if the platform cannot support expected growth?
Results
Element
Result
Cause
Insufficient capacity testing
Event
Service degradation
Effect
Customer impact
Control
Load testing
Action
Improve architecture scalability
Practical Case Study 2: Supply Chain Resilience
Context
A manufacturing company depends on international suppliers.
SWIFT Question
What if a critical supplier stops delivering materials?
Identified Actions
The organization defines:
alternative suppliers;
minimum inventory levels;
contingency agreements.
Practical Case Study 3: Cybersecurity Risk
Context
An organization evaluates technology risks.
SWIFT Question
What if an attacker obtains privileged access?
Recommended Treatments
multi-factor authentication;
continuous monitoring;
privileged access management;
network segmentation.
SWIFT Integration With ISO 31000 Risk Management
SWIFT supports several activities within the ISO 31000 risk management process:
1. Communication and consultation.
2. Risk identification.
3. Risk analysis.
4. Risk evaluation.
5. Risk treatment.
SWIFT Within a GRC Program
In a modern Governance, Risk and Compliance(GRC) environment, SWIFT results can be transformed into managed risk objects.
SWIFT Output
GRC Object
Identified scenario
Risk
Cause
Risk cause category
Consequence
Risk impact
Existing safeguard
Control
Improvement action
Treatment plan
Assigned person
Risk owner
Governance of SWIFT Workshops
A mature SWIFT implementation requires clear governance.
Activity
Responsible Role
Methodology definition
Risk Management
Workshop facilitation
Risk Manager
Technical input
Process Experts
Business validation
Process Owners
Treatment approval
Risk Committee
SWIFT Responsibility Model
Activity
Risk Team
Business
Audit
Executive Management
Define scope
Responsible
Accountable
Consulted
Informed
Conduct workshop
Responsible
Responsible
Consulted
Informed
Validate results
Consulted
Accountable
Consulted
Informed
Approve treatments
Consulted
Responsible
Informed
Accountable
Recommended SWIFT Metrics
Organizations can measure SWIFT effectiveness through:
Metric
Description
Number of identified risks
Discovery capability
Treatment completion rate
Response effectiveness
Average analysis time
Process efficiency
New risks discovered
Method sensitivity
Business participation rate
Collaboration level
SWIFT Implementation Best Practices
Prepare the Workshop Properly
Before execution:
define objectives;
establish scope;
select participants;
collect relevant information;
prepare initial scenarios.
Use Experienced Facilitators
A skilled facilitator helps prevent:
uncontrolled discussions;
bias;
superficial analysis;
inefficient sessions.
Document Results Immediately
Risk scenarios should be captured during the workshop.
Avoid relying only on memory or post - meeting summaries.
Convert Findings Into Actions
Risk identification must generate:
owners;
deadlines;
treatments;
monitoring indicators.
Common SWIFT Implementation Mistakes
Mistake
Impact
Improvement
Generic questions
Low - value results
Create specific scenarios
Missing experts
Incomplete risks
Include multiple disciplines
Poor documentation
Information loss
Use formal repositories
No follow - up
Untreated risks
Integrate with GRC workflows
SWIFT Implementation Checklist
[] Define workshop objectives.
[] Establish analysis scope.
[] Select appropriate participants.
[] Prepare What If questions.
[] Identify scenarios.
[] Analyze causes.
[] Evaluate consequences.
[] Review existing controls.
[] Define treatments.
[] Assign owners.
[] Monitor progress.
Practical Case Study 1: Banking Digital Transformation
Context
A financial institution launches a new digital customer platform.
SWIFT Question
What if the platform cannot support expected growth ?
Results
Element
Result
Cause
Insufficient capacity testing
Event
Service degradation
Effect
Customer impact
Control
Load testing
Action
Improve architecture scalability
Practical Case Study 2: Supply Chain Resilience
Context
A manufacturing company depends on international suppliers.
SWIFT Question
What if a critical supplier stops delivering materials ?
