Home / Trace / Decision Defensibility Diagnostic

Trace · Decision Defensibility Diagnostic

Find out whether one high-stakes decision would hold up if it were questioned next month.

Bring one recent decision. A redacted extract is fine, and so is walking us through it. Over five to eight delivery days across three to four weeks, we map what your record shows today, find the gaps, and show you what a complete replay would take. At the end you decide: build it properly, narrow it, or stop.

One decision class. One bounded piece of work. No enterprise rollout. Fixed scope, fixed price.

Or see exactly what comes back →

What you bring, and what we do

One real decision, looked at the way a reviewer would

What you bring

  • One recent decision — a redacted extract, a live walkthrough, or access by an agreed date
  • The person who made the call
  • The IT, security, legal or records people who would need to look at it

We agree how it is shared before anything is sent.

What we do

  • Map where the evidence lives today and how it would be reconstructed now
  • Test what was known, who had authority, the reasoning, the conditions, the expiry, what changed, and whether a reviewer could follow it
  • Design the record that would hold, and what running it would mean for your environment

No product demonstration before the real job is clear.

What comes back

Every deliverable, and what is not included beside it

What you get back

  • A picture of the current record
  • A sample replay and gap view, with the examples marked
  • The records and deployment boundaries, in writing
  • A plain recommendation: build it properly, narrow it, or stop

See a sample replay pack →

What is not included

  • No legal opinion
  • No compliance certification
  • No scanning
  • No broad integration programme
  • No GRC replacement
  • Nothing runs on your live data before paid access is agreed

Who is involved, and how you will know

The people who ask the hard questions, early

Who needs to be involved

  • A sponsor
  • The decision owner
  • IT, security or architecture
  • Legal, privacy or records, where relevant
  • Procurement, for approval

How we will know it worked

  • Your reviewer says whether the record was usable
  • The gaps and the boundaries are explicit
  • You choose to build, narrow or stop

Questions and boundaries

What your reviewers will ask first

Where does Trace run, and what data moves?

The hosted service runs on Oracle Cloud infrastructure in the Sydney region. An optional gateway can run in your own environment, and every connection across the boundary starts on your side.

Deploying MyRISK Trace →

What about privilege and discoverability?

An item can be marked privileged and excluded from replay and from export. The records note sets out what a record holds, who can reach it, and how long it stays.

Your records →

Does it replace our GRC platform?

No. Trace complements your GRC, ITSM and collaboration systems and replaces none of them. It holds the decision record they were not built to keep.

What if the decision cannot be shared at all?

Then you walk us through it. A redacted extract or a walkthrough is how the first conversation works, and nothing is uploaded until the sharing is agreed.

Fields marked are required. Everything else helps us prepare and can be left blank.

One recent decision — a risk acceptance, exception, supplier approval, AI use case or similar. The Diagnostic works on something real, so this is the one thing we cannot start without.

Who might challenge it — board, auditor, regulator, insurer, customer — and when. This tells us whether it is live or theoretical.

ServiceNow, Jira, SharePoint, email, GRC — whatever applies. It lets us prepare the comparison honestly.

We can work with any of the three. Naming it now means you never have to refuse on the call.

The decision owner, and whoever would approve the work — so what we prepare answers their questions too, not just yours.

IT, security, records or legal — we would rather meet them early than late.

A month is fine. It lets us make sure we can actually start when you want to.

We reply within two business days with times. The call scopes a paid Diagnostic; it is not a legal opinion or a product demonstration.

The confirmation email will ask you to bring one recent decision, a redacted extract, or to offer a walkthrough. If there is no named decision class or no credible scrutiny consequence, we will say the Diagnostic is not the right step — and suggest what is.

Prefer to start smaller? Take the two-minute Decision Replay Check  ·  Or just call (02) 8213 9000.