What a First Risk Baseline actually looks like.

One month of a 145-staff pathology provider, in the form the leadership meeting receives it: fourteen risks, each decided by a person before it entered the register, with owners, ageing, blockers and the questions still open. Illustrative example, not a customer record.

Book a First Risk Baseline → Take the two-minute check

Read this first

Every section below is marked EXAMPLE. The business, the people, the suppliers and the numbers are invented. No customer material is reproduced here.
It shows the structure of a Baseline and the monthly refresh that follows. It is not a case study and makes no claim about results anyone achieved.
This is management information — not assurance, not certification, not a compliance opinion, and never to be presented as one.
The product views are drawn, not captured. They show this example's own assessment in the real layout, rather than a screenshot of somebody else's data.
The gaps and stalled items are deliberate. A real Baseline surfaces them, and a sample without them would misrepresent what the first one finds.

1 · What it was built fromExample

ASSESSMENT #121 · SERVICES ORG, 145 STAFF · REFRESHED

HealthCo — a private pathology and diagnostic services provider, four locations across NSW (constructed)

Built from what already existed:

An existing risk spreadsheet, 31 rows, last updated 14 months ago
The most recent insurance renewal questionnaire and its answers
Two years of leadership meeting minutes
A list of the top 20 suppliers by spend
An open action list from an internal review, 22 items

Nothing was created for the purpose. This is the material the business already had, in the state it was already in — which is why the first Baseline is free. It is built from what is there.

Step one, the profile: sites, the dependencies you could not operate without, obligations, and what worries you. Saved and resumable. Illustrative example · seeded data.

2 · Nothing enters the register undecidedExample

26 Aug, 12:53 — Baseline built, decisions taken. Fourteen risks in, each decided by a person before it entered the register.

The assessment generated eleven candidates. It does not seat them. Every one waits for one of four answers, and the register only holds what somebody chose:

Accept — nine, taken as generated.
Change — one, where the consequence was right but the wording named the wrong site.
Throw it out — one, generated and rejected. It did not apply to this business at all.
Add the one we missed — four, put in by the people who run the business and not produced by the run.

Ten of the eleven entered, four were added: fourteen risks owned.

Risk Studio for HealthCo, assessment 121: a heading reading eleven risks awaiting your decision, with the instruction to accept it, change it, throw it out, or add the one we missed. The first risk, R-01, is loss of access to patient, referral and pathology information during cloud, identity or telecommunications unavailability, marked accepted and in the live register, owned by the Practice Manager. Three buttons offer accept, change and throw it out. — Every generated risk waits on a person: accept it, change it, throw it out, or add the one we missed. Illustrative example · seeded data.

Each risk carries its traceability: the assessment it came from, the domain, the cause, and the version of the analysis that produced it. Where deeper source provenance was not carried, none is inferred — the gap is shown rather than filled.

3 · Priority themes, with consequenceExample

Fourteen risks, grouped into five themes. Each theme names what would actually happen, not a severity score.

Access to patient and referral information. Practice management, identity and connectivity all sit with external providers, and there is no tested manual fallback. An outage in any one of them stops results reaching referrers, and the workaround has never been run. Owner: Practice Manager.
Supplier concentration — cold chain and reference testing. One courier moves every specimen and one reference laboratory covers the send-away panel, both on rolling terms. A failure at either interrupts diagnosis, not just delivery, and no alternative is qualified. Owner: Operations Manager.
Key-person dependency — operations. One person holds rostering, the referrer relationships at two sites, and the workarounds. If they leave with four weeks' notice, two sites lose delivery certainty for a quarter. Owner: Managing Director.
Site-level consistency. Two of four collection sites follow the documented process; the others have local variations nobody has reviewed. An incident at either would be handled differently than assumed. Owner: Operations Manager.
The assurance burden itself. Referrers, the insurer and the accreditation cycle ask for overlapping evidence, and each was answered from scratch. Roughly two weeks of senior time a year, and inconsistent answers between them. Owner: Finance Director.

4 · The refresh — owners, ageing and blockersExample

24 Sep, 16:40 — Refresh: closed, aged, stalled. Four closed. Two aged past due, owner named. One blocked on supplier evidence.

Closed — four actions, each with evidence attached rather than asserted. The scheduling process documented; two alternative suppliers qualified; a client assurance pack drafted and used once; one duplicate retired.
Aged past due — the business continuity plan review, now 15 months and never started. Owner named rather than left to the meeting to work out.
Aged past due — reconciling the two site process variants against the documented one. Second month flagged.
Blocked on supplier evidence — substantiating the two insurance answers. The IT provider has not responded in three weeks; escalation owner named.
Nine actions carried forward from the 22 on the original list. Thirteen were closed, duplicated or no longer relevant — which is itself part of the output.

Drift stops hiding in meetings when the number of months sits on the page next to the owner's name.

5 · Questions carried forwardExample

Nine open. A question the business could not answer is carried to the next refresh and put again — not closed, and not quietly dropped.

Which staff have completed which required training? No current record.
Where are the supplier agreements for four of the top 20? Cannot be located.
When was the last business continuity test? Nobody is certain one occurred.
What sits behind the two insurance renewal answers? Nothing, so far.
Who approved the two local site process variations, and when? No record.

Four more of the same kind sit behind these. They are the questions an insurer, a client or a tender will ask, arriving before the request does.

6 · The monthly pack, cycle two of three

What goes to the meeting

Monthly leadership summary · 14 risks owned · 9 questions openExample

What moved: four closed, with evidence attached.
What stalled: the continuity plan review, 15 months, and the site reconciliation.
Where evidence is thin: the two insurance answers, still blocked on the supplier.
The proof request this month: a client asked for evidence of supplier due diligence. Answered from evidence already held, with no rebuild.
The one decision for this meeting: whether to replace the concentrated supplier now that two alternatives are qualified, or hold and accept the exposure for another year.

The pack says plainly when risks still await a decision — a draft pack marks itself as one, so nothing in it can be read as already accepted. Illustrative example · seeded data.

One page, one decision. Three cycles, and then a decision about the rhythm itself: continue, adjust, or stop. A pack that asks leadership for nothing gets read once and then stops being read.

For your reviewers

Management information, not assurance. Not certification and not a compliance opinion. Acceptance of a proof pack is your insurer's, customer's or auditor's, not ours.
Not automatic. Follow-through improves because the rhythm runs, not because software promises it.
Not a managed service by stealth. Advisers and brokers introduce Essentials and stay in the review, but a named person on your side keeps the rhythm running. We do not sell a rhythm nobody will run.
Uses enterprise-grade Oracle technology — no separate purchase required, licensed by organisation. Your material stays yours.

Who asked you to prove something in the last 90 days?

Bring that request and the spreadsheet you answered it from, however messy, and redacted if you prefer — the first Baseline is free. The comparison against your own material is more useful than any example, including this one.

Book a First Risk Baseline → Not ready? Take the two-minute check