top of page
Search

How to Map Boundary-Violation Risk Before an Incident Using Risk Assessments.

Mar 25
5 min read

Most organizations learn where their boundary-violation risk sits only after something goes wrong. An investigation reveals the unsupervised room, the exception that nobody questioned, or the complaint that never traveled past a mid-level manager. By then the map is being drawn in hindsight.

This guide is for risk and compliance leaders, including those at multi-site employers in Mobile, Al and all across the Gulf Coast, who want to draw the map first. Risk mapping asks a different question from an investigation. It does not ask who did something. It asks where the organization's structure makes harm easier to commit, easier to hide, or harder to report.

What counts as a boundary violation, for risk purposes

For organizational purposes, a boundary violation is a crossing of a professional limit in a relationship where power, trust or dependency is present. That can include staff-to-staff conduct, staff-to-client conduct and client-to-staff conduct. The range runs from behavior that is merely inappropriate, through policy violations and civil liability, to criminal offenses. A risk map does not decide which category a particular act belongs to. It identifies where the conditions for any of them exist.

The concept of dependency matters here. Psychological research on institutional betrayal, by Carly Parnitzke Smith and Jennifer Freyd, describes harm that occurs when trusted institutions act in ways that damage people who depend on them for safety and well-being. Dependency is therefore a risk condition to map, and the organization's response to concerns is part of the exposure.

Step 1: Inventory authority and access

Start with relationships, not people. For each program, site and function, list where one role has authority over, or access to, another person. Look for:

  • Authority over pay, scheduling, grades, assignments, services, housing or references.

  • Unsupervised or one-to-one access, including transport, home visits, closed offices, travel and after-hours work.

  • Access to private information or to someone's personal devices and accounts.

  • Contact outside working hours or through personal channels.

  • Third-party contact, such as clients, customers, patients, vendors and volunteers, in either direction.

Document the control that currently governs each one, if any. The gap between "this access exists" and "this access is governed" is the first output of the map.

Step 2: Read the conditions around each relationship

The EEOC Select Task Force published a chart of workplace risk factors that serves as a useful set of prompts. The structural ones include:

  • Isolated workplaces, where employees work alone, harassers have easy access and there are no witnesses.

  • Decentralized workplaces, where managers far from headquarters may feel unaccountable or not know how to handle concerns.

  • Significant power disparities, where low-ranking employees are less likely to understand complaint channels.

  • High value employees, where management is reluctant to jeopardize a person's economic value.

  • Customer-service or client-satisfaction dependence, where fear of losing a sale or tip can lead employees to tolerate inappropriate behavior.

  • Alcohol at or around work, which can lower inhibitions and impair judgment.

The same chart also lists workforce characteristics, such as demographic makeup. Use these only to ask where people may be more exposed to pressure and need better information and support. Never use them to rate individuals. Behavioral risk in RMA's work means observable behavior and organizational conditions, never protected characteristics.

Step 3: Score exposure and control strength

RMA's Risk Vulnerability Matrix (RVM) organizes this work into predictive risk mapping, risk prioritization scoring, preventative action roadmaps and key risk indicators. To show the idea, here is a simple scoring approach that is illustrative, not a validated instrument.

  • Rate opportunity from 1 to 5: how easily could a boundary be crossed without anyone noticing?

  • Rate consequence from 1 to 5: how severe would harm be to affected people and to the organization?

  • Rate control strength from 1 to 5: how well do current controls prevent, detect and respond?

Prioritize relationships where opportunity and consequence are high and control strength is low. The numbers are less important than the discipline of rating every area against the same questions and writing down why.

Step 4: Validate with people, not only with documents

A map built from policies and complaint logs will be wrong. The EEOC task force found that roughly three out of four people who experienced harassment never spoke to a supervisor, manager or union representative. Complaint counts therefore undercount exposure, and a quiet log can describe silence rather than safety.

Add voices the documents miss:

  • Interviews with executives, to learn who is believed to own the risk and what they would do with a concern.

  • Conversations with supervisors and front-line staff across shifts and locations.

  • Review of how past concerns were routed, how long they took and what changed afterward.

  • Confidential, anonymous input from people who depend on the organization.

Step 5: Turn the map into a roadmap

Each high-priority area needs an owner, a specific control, a date and an indicator. Examples of controls include two-person rules where appropriate, defined escalation routes, supervisor check-ins at set intervals, and independent reporting options for roles that report to the person they would need to report.

Choose key risk indicators that reflect conditions, not individuals: the share of required reviews completed on time, exceptions to access rules granted and who approved them, and the time between a concern and a documented response. Review them on a schedule and refresh the map when programs, sites or leadership change.

Common pitfalls

  • Mapping once. A map is a living document. Reorganizations, new sites and remote work change exposure.

  • Confusing mapping with surveillance. The aim is better structure and clearer duties, not monitoring individuals. Intrusive monitoring can damage the trust that reporting depends on.

  • Ranking people instead of conditions. If a map names suspects, it has become something else.

  • Stopping at the score. A risk rating with no owner and no date changes nothing.

Limits and legal context

A risk map is a management tool and not a legal opinion. It cannot guarantee that misconduct will not occur. Legal duties differ by jurisdiction: federal law such as Title VII applies to covered employers, and state and local requirements in California, where San Diego sits, and elsewhere may add to them. Consult qualified counsel before relying on any assessment for compliance decisions.

How RMA can help

RMA's Risk Exposure Audit is designed to identify vulnerabilities before they become crises, using organizational risk assessment, executive interviews and the RVM approach described above. To see how an audit is structured, visit RMA's solutions page. You can also read about the team on the About page.

Related reading

Continue with these related RMA articles:

References

bottom of page