Home / Industries / Resources & industrial
MyRISK · resources and industrial operations
Site evidence does not roll up into visibility the executive trusts.
Industrial environments are digitally connected and still carry safety, environmental, contractor and operational consequence. The site knows what is happening. What reaches the executive is a summary nobody can trace back.
Why now
Risk is no longer isolated by function.
A contractor, maintenance, OT, safety or environmental issue can become a continuity and assurance event. Each function reports up its own line, on its own cycle, in its own format — and the connections between them only become visible after something goes wrong.
Sites generate detailed evidence: inspections, permits, incident reports, contractor assessments. What thins out on the way up is the decision — what management concluded, what was accepted, and under what conditions.
Site records prove the work. They do not prove the trade-off was reasonable.
What usually starts the conversation
- A site incident, and the review that follows it
- A contractor assurance failure, or a near miss with one
- A safety or environmental review with findings attached
- Cyber or OT uplift work touching operational systems
- Operational dependency mapping already under way
- A board request, or an audit by a customer or major operator
Where it bites first
Five decisions worth being able to replay
01
A safety or environmental trade-off
Production against a safety or environmental consequence. Carefully reasoned, and usually recorded only as an outcome.
02
A contractor assurance decision
Why this contractor was accepted on site, what was verified, and which conditions were attached.
03
A maintenance or asset deferral
Work deferred for operational or budget reasons, on what basis, and whether the assumptions still hold.
04
An OT or legacy risk acceptance
A constraint accepted because replacement is not yet feasible — for how long, and reviewed by whom.
05
An incident decision trail
Who had authority during the event, what was known at each point, and what was decided on that basis.
—
Not a cyber story
Cyber arrives through OT and contractors and is inseparable from safety and environmental risk. Treat it as one input to an operational trade-off, not a standalone programme — most of what is listed above raises no cyber question at all.
What you already have
The site systems are not the gap.
Operators have a safety management system, permit-to-work, asset and maintenance management, contractor management, incident reporting and board reporting. Each is capable and each holds part of the record.
What none of them holds is the management decision as it stood: the evidence in front of the people who made it, the alternatives weighed, the authority exercised, and what has drifted since. Trace sits alongside and holds that.
What a Trace record preserves
- The evidence that existed at the time, and the policy version that applied
- The rationale, assumptions and alternatives considered
- Who had authority, and what exactly was approved
- Conditions, expiry and review dates
- Drift — whether changed circumstances unsettle the approval
The proof
What a replay actually produces
The comparison, gaps included
- The decision as evidenced, dated when it was made rather than when it was written up
- Each evidence item found, where it was held, and how long retrieval took
- Evidence that should exist and does not — named individually rather than summarised
- The approvals that were verbal and cannot now be confirmed
- The conditions attached at approval, and which have been reviewed since
- What a reviewer would ask that the current record cannot answer
The Diagnostic runs this against one decision you choose. The output includes what is missing, which is the part that makes it worth having before someone else asks.
Who this is for, and who it isn't
Operators and their supply chain need different things
Large operators
The functions and the reporting exist. The pressure is scrutiny — showing that a specific operational trade-off was reasonable at the time, to a board, a customer or an investigator.
Contractors, suppliers and mid-tier operators
The demand is coming from your customers. What is needed is practical governance and multi-site action follow-through you can evidence on request — not an enterprise programme.
For your reviewers
The boundaries, in writing
What this is not
- Not a safety, engineering or environmental assurance opinion, and not a substitute for your safety management system. MyRISK does not assess technical or safety adequacy.
- Not an OT security product and not a monitoring tool. It records decisions, not plant conditions.
- Not a compliance claim against any safety, environmental or critical-infrastructure obligation. Replayability is a property of the record; acceptance is your regulator's.
- Trace complements your asset, permit, incident and contractor systems. It replaces none of them.
Pick the trade-off you would least like to explain to an investigator.
Not the worst outcome — the one where the reasoning was sound and the record is thinnest. That is the one worth replaying now.