Risk taxonomy & scenario library
A structured taxonomy covering cyber, privacy, AI, cloud, third-party, resilience and regulatory risk, with a starter library of scenarios relevant to your sector.
Loading page content
Executive summary
The typical risk register is two hundred rows, most rated medium, none ever closed. It consumes senior attention and produces no decisions. This engagement rebuilds risk management so exposure is stated as a financial range, appetite is numeric, and the register can be shown to have changed an investment decision within one quarter.
The typical enterprise risk register is a colour-coded spreadsheet of two hundred rows, most of them rated "medium", none of them ever closed. It absorbs effort and produces no decisions.
We rebuild risk management so it earns its place. Risks are described as scenarios with an event, a cause and a consequence. Exposure is quantified as a loss range rather than a heat-map colour. Appetite is stated numerically, so the register can tell you which risks are actually out of tolerance.
The test we hold ourselves to is simple: within one quarter, the register should have caused at least one investment decision to change. If it has not, it is decoration.
Where risk management loses credibility
Each capability below is a discrete workstream with its own owner, deliverables and definition of done.
A structured taxonomy covering cyber, privacy, AI, cloud, third-party, resilience and regulatory risk, with a starter library of scenarios relevant to your sector.
FAIR-aligned quantification producing annualised loss-exposure ranges, so risk can be compared against the cost of the control that would reduce it.
Board-level appetite statements translated into operational thresholds that give teams a clear, testable line for escalation.
Evidence-based testing of whether the controls you are relying on are actually operating, feeding measured effectiveness back into residual risk.
BIA across critical processes with recovery objectives, dependency mapping and validated continuity plans for the scenarios that would stop the business.
Dashboards and board packs that show exposure trend, treatment velocity, appetite breaches and the top movers since last quarter.
Each benefit is stated with the commercial consequence attached, because a capability without a consequence is a feature list.
FAIR-aligned quantification producing annualised loss-exposure ranges with stated confidence.
Allows a control investment to be compared directly against the exposure it removes.
Scenarios described as event, cause and consequence, with calibrated estimates and documented inputs.
Ends the pattern where everything is amber and nothing is sequenced.
Board-level appetite translated into operational thresholds teams can test against.
Removes the informal, inconsistent judgement calls that create inconsistent exposure.
Owners are the executives who control the budget and the decision, not the risk function.
Each treatment carries a date and a named executive, tracked to close rather than left open on a register.
Phases overlap deliberately — design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–2
Agree the taxonomy, the quantification method and the reporting audience before a single risk is logged.
Weeks 2–5
Facilitated workshops with each function to surface scenarios, followed by consolidation and de-duplication into a single register.
Weeks 5–8
Calibrated estimation sessions producing frequency and magnitude ranges, validated against internal loss data and sector benchmarks.
Weeks 8–12
Treatment options costed and compared on risk-reduction-per-rupee, then assigned to accountable executives with dates.
Ongoing
Quarterly reassessment, control testing and reporting, with the register maintained as a live decision tool.
Named artefacts, listed in the statement of work. If it is not on this list, we will tell you before you sign rather than after.
Sector constraints change the delivery approach more than they change the obligations. These are the sectors this methodology is built around.
Fixed fee for defined scopes, retainer for ongoing services. We do not price advisory work on time and materials, because that misaligns our incentive with your outcome.
4 weeks
Organisations testing whether quantification works for them
Commercial basis: Fixed fee
12 weeks
Organisations building a full quantified register
Commercial basis: Fixed fee
Rolling
Organisations that want the cycle operated for them
Commercial basis: Monthly retainer
Every proposal states what is included, what is not, and what would trigger a change request. If the scope we recommend is smaller than the one you asked for, we will say so.
One implementation, cross-mapped. Each framework below links to its own obligations and control domains.
Specific answers about scope, timeline and what we will and will not do.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a questionTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityCombining capabilities reduces cost — the second framework typically lands at about half the price of the first.