Home / Essentials / How it works
Essentials · how it works
Six flows, fourteen stages, one assessment.
This is the engine, for people who want to see it: what runs between the profile you fill in and the pack that reaches the meeting, what each stage records, and the point where a person decides rather than the machine. If you would rather see the output, the sample First Risk Baseline is a worked example end to end.
01 Observe 02 Name 03 Explain 04 Test 05 Consequence 06 Report
What you give it
The profile, and whatever already exists
A profile of the organisation — sites and operations, the dependencies you could not operate without, your obligations, and what worries you — plus whatever risk material already exists, in the state it is already in. Saved and resumable; nothing is created for the purpose.
Then fourteen stages run. Each one records six things besides its own output: a summary, its confidence, the assumptions it made, the evidence it used, the stages it was built from and what it recommends next. That is how any finding in the pack traces back to what it was built from, and it is on every stage rather than a chosen few.
Flow 01 · Observe
Patent Pending · AU 2026203360Read what you already have, and what is happening around you.
Your inputs are normalised into observations that keep their provenance, the current environment for your sector and geography is scanned under governed search, and the two are grouped into materially distinct clusters. Nothing is named a risk yet.
Reading your inputs
Normalises what you supplied into observation objects that keep their provenance and confidence, and records what was deduplicated and what matched an existing case.
Scanning the current risk environment
Establishes the organisation, sector, geography and dependencies, and the signals currently active in each — the one stage permitted to search the web.
What it records. the organisation, what kind of entity it is, sector, geography, a summary of the context, organisation signals, sector signals, geography signals, cross-domain candidates, key dependencies, key uncertainties
Grouping what we found
Groups the observations into materially distinct clusters and the links between them. It names no risks and carries no prior state: both are the next stage's job.
Flow 02 · Name
Patent Pending · AU 2026203360Decide what the register is, this round.
This is the stage that decides what your register is: which risks carry forward from last round, which are genuinely new, and which did not resurface — recorded as a verdict rather than a silent disappearance. Each is then mapped to its domains and to the typed relations that connect it to the rest.
Naming your risks
Decides the register for this round: what was carried forward, what is genuinely new, and what did not resurface — the last recorded as a verdict, because a carried risk disappearing from a board pack with nothing recording it is the failure this stage exists to prevent.
What it records. risks carried forward, the identity each carried risk keeps, a verdict on every risk that did not resurface
Mapping your risk domains
Maps each risk to its domains, the channels through which it couples to others, the dependencies underneath it, and the typed relations between them.
Flow 03 · Explain
Patent Pending · AU 2026203360Say why it is there, and what it would set off.
A risk with no cause is a label. These two stages separate root conditions from triggers, then follow the consequences outward — first-order, second-order, the loops that feed back, and the bottlenecks everything passes through.
Tracing root causes
Separates root conditions and structural drivers from the triggers that set them off, and names the dominant causal spine rather than listing causes.
What it records. root conditions, structural drivers, dependency origins, candidate triggers, the dominant causal spine, what is uncertain about the causes, the carried risks each explains
Following knock-on effects
Follows the consequences outward: first and second-order effects, feedback loops, bottlenecks, critical paths, and what damps them.
Flow 04 · Test
Patent Pending · AU 2026203360Ask whether it is structural, and who carries it.
Whether an exposure is transient, patchable or structural changes what you should do about it, and that judgement is made explicitly rather than implied by a rating. Alongside it, who is most exposed, where fragility sits, and what you currently cannot see.
Testing for structural weakness
Judges whether each exposure is transient, patchable or structural, and records the test that decided it.
What it records. threshold status, transient indicators, patchable indicators, structural indicators, the tests that decide structural breach, capacity constraints, what is uncertain about the thresholds, the risk each threshold belongs to
Checking who is most exposed
Identifies who is most exposed, where fragility concentrates, the triage tensions that follow, and what the organisation currently cannot see.
What it records. who is exposed, fragility factors, distributional and justice risks, triage tensions, what cannot currently be seen, what is uncertain about the exposure, the risk each cohort belongs to
Flow 05 · Consequence
Patent Pending · AU 2026203360Turn system stress into business consequence, then into a plan.
Four scenarios — downside, base case, adaptive, renewal — with the signposts that tell you which one you are in. Those become enterprise consequences against the operations that carry them, and then a ranked set of control priorities in which every risk has an action.
Building scenarios
Builds four scenarios — downside, base case, adaptive and renewal — and the signposts that say which one you are in.
What it records. the downside scenario, the base case, the adaptive scenario, the renewal scenario, signposts for which one you are in, what is uncertain about the scenarios, every risk against every scenario
Translating to business impact
Translates system stress into enterprise consequence families, the critical operations affected, and the obligations those touch.
Prioritising what to do
Ranks control priorities into sequenced bundles, with expected harm reduction and feasibility, and ensures every risk carries an action.
Flow 06 · Report
Patent Pending · AU 2026203360Put it in front of the people who decide.
Posture, ranking, the controls that matter, the thresholds that would change the answer, and the questions to carry into the next round. The narrative stage renders that package without re-analysing it, so the words on the page and the record behind them cannot disagree.
Assembling the board view
Builds the board view: posture, ranked risks, the controls that matter, decision thresholds, attention items and the questions for the next round.
What it records. board posture, status by risk category, executive risk summary, top risks, ranked, critical business functions, controls, ranked, management priorities now, decision thresholds, board attention items, questions for the next round, every risk with its action
Writing the report
Renders that package as the board narrative without re-analysing it, so the report cannot say something the record does not.
What it records. report title, executive summary, business exposure, status by risk category, top risks by impact, priority controls, management focus now, questions for the next round, other material risks, with actions, an overall judgement
Where a person decides, not the machine
Nothing enters the register undecided
The engine proposes. Every generated risk arrives in Risk Studio awaiting a decision, and the only ways out are accept it, change it, throw it out, or add the one it missed. Until that is done the leadership pack carries a draft banner saying so, in terms that do not let a reader mistake a proposal for an accepted risk.
And then it repeats
The next round is not a new assessment
A refresh re-runs the chain against what has changed. Risks that are still live are carried with their identity intact; risks that no longer surface are recorded as not resurfaced, with a verdict, rather than quietly vanishing. That is what makes a month's pack comparable to the last one, and it is why the register ages rather than resets.
Read this too
- This is management information — not assurance, not certification, not a compliance opinion, and never to be presented as one.
- The engine proposes; you decide. Nothing it generates reaches your register without a person accepting it.
- Six of the fourteen stages are described rather than set out field by field. Their output structure is the substance of a pending claim, AU 2026203360. Nothing they produce is withheld from you — only from the page.
Who asked you to prove something in the last 90 days?
Bring that request and the material you answered it from, however messy. The first Baseline is built from what you already have.