Home / Essentials / Sample Risk Report
MyRISK Essentials · illustrative example
What a Risk Report actually looks like.
A first Risk Report for Example Foods, a fictional food manufacturer, and the Method and Evidence behind it, both as the product produced them. Then a month on, in a second fictional business: the refresh, the owners, what aged and the questions still open.
Read this first
- Both businesses on this page are fictional. Example Foods and HealthCo, their people, suppliers and numbers are invented. No customer material is reproduced here.
- The downloads are the product's own output for Example Foods. The ratings and actions are the assessment's proposals, shown as they print once your team has reviewed them.
- The HealthCo screens are illustrations. We drew them in the product's real layout using HealthCo's invented data. They are not screenshots of any customer's system.
- It shows the structure of a Baseline and the monthly refresh that follows. It is not a case study and makes no claim about results anyone achieved.
- This is management information — not assurance, not certification, not a compliance opinion, and never to be presented as one.
The first report
Example Foods: the Risk Report, and the Method and Evidence behind it
ASSESSMENT 9002 · FOOD MANUFACTURER, 120 STAFF · BASELINE · 8 NOV 2026
Example Foods — a family-owned chilled food manufacturer in regional Victoria (fictional)
Built from a short written description:
- What the business does, where, and its size: chilled ready meals, soups and sauces; one production site and a cold-storage warehouse; 120 staff
- What it could not operate without: its blast chillers and freezer, one refrigerated carrier, a labour-hire agency, an ageing on-premises planning server
- Who it depends on: two supermarket chains, about 60% of revenue
- Where its controls are weak, and what has gone wrong before: a labelling withdrawal, a refrigeration stoppage, a payment-redirection attempt
- What is pressing now: the largest customer's supplier review, the insurer's cyber questionnaire and the bank's covenant review
Nothing was prepared for the purpose: the description is what the people running a business already know. The run took about fifteen minutes.
Then fourteen stages ran on that description, in six steps. Every stage records what it produced, what it assumed, what it was built from and what it is uncertain about.
Observe
Reading your inputs
Scanning the current risk environment
Grouping what we found
Name
Naming your risks
Mapping your risk domains
Explain
Tracing root causes
Following knock-on effects
Test
Testing for structural weakness
Checking who is most exposed
Consequence
Building scenarios
Translating to business impact
Prioritising what to do
Report
Assembling the board view
Writing the report
Patent pending · Australian application 2026203360. How it works, stage by stage →
- The Risk Report, two pages. Where it stands, the one decision for management, the highest-rated risks with their first action and owner, every risk rated Moderate or above, the themes, what is already working, and the questions to answer before the next report.
- The Method and Evidence, 22 pages. How every finding was reached: what the assessment read, each domain tested or set aside, how the risks connect, each risk's trail from evidence to action, and every public source it consulted.
The organisation is fictional. Ratings and actions are the assessment's proposals, shown as they print once your team has reviewed them. Both documents are management information, not assurance.
After the first report
A month on: the refresh
A first report shows where an organisation stands. What a month of running it looks like is easier to see in a second fictional business: HealthCo, a private pathology and diagnostic services provider with 145 staff across four NSW sites, one refresh in.
ASSESSMENT #121 · SERVICES ORG, 145 STAFF · REFRESHED
- What the business does, where, and its size: pathology and diagnostics, four NSW sites, 145 staff
- What it could not operate without: the laboratory information system, the courier network, its top suppliers
- How sensitive its data is: health records
- Where its controls are weak, and what has gone wrong before
- What is pressing now: the insurance renewal and the next accreditation cycle
26 Aug, 12:53 — Baseline built, decisions taken. Fourteen risks in, each decided by a person before it entered the register.
The assessment generated eleven candidates. It does not seat them. Every one waits for one of four answers, and the register only holds what somebody chose:
- Accept — nine, taken as generated.
- Change — one, where the consequence was right but the wording named the wrong site.
- Throw it out — one, generated and rejected. It did not apply to this business at all.
- Add the one we missed — four, put in by the people who run the business and not produced by the run.
Ten of the eleven entered, four were added: fourteen risks owned.
Each risk carries its traceability: the assessment it came from, the domain, the cause, and the version of the analysis that produced it. Where deeper source provenance was not carried, none is inferred — the gap is shown rather than filled.
Fourteen risks, grouped into five themes. Each theme names what would actually happen, not a severity score.
- Access to patient and referral information. Practice management, identity and connectivity all sit with external providers, and there is no tested manual fallback. An outage in any one of them stops results reaching referrers, and the workaround has never been run. Owner: Practice Manager.
- Supplier concentration — cold chain and reference testing. One courier moves every specimen and one reference laboratory covers the send-away panel, both on rolling terms. A failure at either interrupts diagnosis, not just delivery, and no alternative is qualified. Owner: Operations Manager.
- Key-person dependency — operations. One person holds rostering, the referrer relationships at two sites, and the workarounds. If they leave with four weeks' notice, two sites lose delivery certainty for a quarter. Owner: Managing Director.
- Site-level consistency. Two of four collection sites follow the documented process; the others have local variations nobody has reviewed. An incident at either would be handled differently than assumed. Owner: Operations Manager.
- The assurance burden itself. Referrers, the insurer and the accreditation cycle ask for overlapping evidence, and each was answered from scratch. Roughly two weeks of senior time a year, and inconsistent answers between them. Owner: Finance Director.
24 Sep, 16:40 — Refresh: closed, aged, stalled. Four closed. Two aged past due, owner named. One blocked on supplier evidence.
- Closed — four actions, each with evidence attached rather than asserted. The scheduling process documented; two alternative suppliers qualified; a client assurance pack drafted and used once; one duplicate retired.
- Aged past due — the business continuity plan review, now 15 months and never started. Owner named rather than left to the meeting to work out.
- Aged past due — reconciling the two site process variants against the documented one. Second month flagged.
- Blocked on supplier evidence — substantiating the two insurance answers. The IT provider has not responded in three weeks; escalation owner named.
- Nine actions carried forward from the 22 on the original list. Thirteen were closed, duplicated or no longer relevant — which is itself part of the output.
Drift stops hiding in meetings when the number of months sits on the page next to the owner's name.
Nine open. A question the business could not answer is carried to the next refresh and put again — not closed, and not quietly dropped.
- Which staff have completed which required training? No current record.
- Where are the supplier agreements for four of the top 20? Cannot be located.
- When was the last business continuity test? Nobody is certain one occurred.
- What sits behind the two insurance renewal answers? Nothing, so far.
- Who approved the two local site process variations, and when? No record.
Four more of the same kind sit behind these. They are the questions an insurer, a client or a tender will ask, arriving before the request does.
- What moved: four closed, with evidence attached.
- What stalled: the continuity plan review, 15 months, and the site reconciliation.
- Where evidence is thin: the two insurance answers, still blocked on the supplier.
- The proof request this month: a client asked for evidence of supplier due diligence. Answered from evidence already held, with no rebuild.
- The one decision for this meeting: whether to replace the concentrated supplier now that two alternatives are qualified, or hold and accept the exposure for another year.
The pack goes to the meeting once every risk in it has been decided by a person, so nothing in it can be read as accepted before someone accepted it.
One page, one decision. After three cycles comes the day-90 review: how the rhythm is actually being used — cycles completed, how the pack is used — and whether the plan still fits, or a smaller one would. A pack that asks leadership for nothing gets read once and then stops being read.
For your reviewers
- Management information, not assurance. Not certification and not a compliance opinion. Acceptance of a proof pack is your insurer's, customer's or auditor's, not ours.
- Not automatic. Follow-through improves because the rhythm runs, not because software promises it.
- Not a managed service by stealth. Advisers and brokers introduce Essentials and stay in the review, but a named person on your side keeps the rhythm running. We do not sell a rhythm nobody will run.
- Uses enterprise-grade Oracle technology — no separate purchase required, licensed by organisation. Your material stays yours.
Who asked you to prove something in the last 90 days?
Book a First Risk Baseline: a short form about your organisation, then about fifteen minutes to run, and a person reviews it before it is released — the first one is free until 31 December 2026, and A$495 from 1 January 2027. Your own Risk Report is more useful than any example, including these.