Home / Industries / Growing organisations
MyRISK Essentials · growing and multi-site organisations
Build practical risk management without the enterprise overhead.
Insurance, customers, lenders, a new board or growth across sites has made informal risk handling visible — and made you rebuild the same proof more than once.
Why now
Nothing broke. You just outgrew holding it in your head.
Risk sits in people's heads, a few spreadsheets, branch managers, supplier relationships, insurer notes and adviser conversations. That worked at forty people. At a hundred and twenty, across three sites, the same question gets a different answer depending on who you ask.
The symptom isn't ignorance — it's repetition. The same proof assembled again for a new requester, while the actions agreed in the last meeting quietly stop moving.
You don't need a risk register. You need a rhythm that survives a busy month.
What usually starts the conversation
- An insurance renewal that asked for more than last year
- A customer or lender assurance request you had to build from scratch
- A new board or investor asking what the top risks actually are
- Growth into a second or third site, with no shared view
- A senior person leaving, and taking the only copy with them
- Sale or acquisition diligence putting a deadline on all of it
Where it bites first
Six things that keep coming back
01
Insurance renewal
The annual questionnaire, answered from memory and last year's file, with the gaps quietly carried forward.
02
Customer or lender proof
A major client or financier asks how you manage risk. The answer exists, but not in a form you can send.
03
Multi-site visibility
Each site knows its own issues. Nobody has the picture across all of them in one place.
04
Key-person risk
One or two people hold the operational knowledge, the relationships and the workarounds.
05
Supplier and dependency map
Which suppliers you actually depend on, what happens if one stops, and who has thought about it.
06
Audit action follow-through
Findings agreed, owners assigned, and a list that has aged for two quarters without moving.
Cyber usually arrives here through an insurance renewal or a customer request, rather than on its own. This is about all risk, not one kind of it.
What you already have
Your adviser is not the gap either.
Most growing organisations already have a broker who knows the insurance position, an accountant who sees the numbers, an IT provider handling the technical side, and a leadership team that discusses the real issues most months. All of that works.
What none of it produces is one current picture — priorities, owners, dates, what moved and what didn't — that a leadership meeting can use and a requester can be sent. That is what the Baseline and the rhythm are.
What a First Risk Baseline gives you
- Priority themes, in your own language rather than a framework's
- Named owners against each one, and dated actions
- Blockers and stalled items, stated rather than buried
- Evidence gaps — what you'd be asked for and couldn't produce
- A monthly pack that goes to a real meeting
The proof
What goes to the meeting
Three pages, and the four questions it answers
- What changed this month — new issues, and ones that shifted
- What closed, with the evidence attached rather than asserted
- What aged — actions that have not moved, and for how long
- What is blocked, and who can unblock it
- Evidence gaps still open, so a request never arrives as a surprise
- The decisions leadership actually has to make this cycle
The rhythm is the point, not the document. A pack nobody reviews is a report; a pack that drives a monthly decision is a rhythm.
The first step
One baseline, three review dates, one owner
The Baseline is built from what you already have — however messy. The setup runs inside two weeks, then three monthly reviews with real dates in the calendar, and a decision at ninety days: continue, adjust, or stop.
Bring one thing: your current list, or the last proof request somebody sent you. A redacted version is fine.
One question decides whether this works
Who, inside your organisation, would keep it current? Not who owns risk on paper — who would actually chase the owners and update the pack each month.
If there is no answer to that, a recurring rhythm is the wrong thing to buy, and we would rather find out now than at month two. MyRISK is not the permanent operator.
For your reviewers
The boundaries, in writing
What this is not
- Not assurance, certification or a compliance opinion. It is management visibility, and what it produces is yours rather than an accreditation.
- Not a cut-down enterprise GRC platform, and not a free risk register. The value is the operating rhythm, not the template.
- Not MyRISK running your risk function indefinitely. There is an internal operator, or there is no recurring sale.
- Nothing here is automated assurance. A person reviews, decides and chases; the system holds the record.
Who asked you for proof in the last ninety days?
Name them, and whether they'll ask again. If the answer is yes, that recurrence is the whole reason this is worth doing once properly.