Practice 01 / Risk advisory / For boards, executives and governments
Know where you stand. Then decide.
Boards get a green dashboard. Executives get five different answers. Regulators get a binder. None of it says what's really going on. We find out, and write it down in words a board can act on.
- Who it’s for
- Boards, audit committees and investors who need the real state of security. Executives running a business under rules in more than one country. Governments and public bodies answering for systems the public depends on.
Sound familiar?
- “The security report has been green for three years and nobody can say whether green means safe or means nobody looked”
- “We operate in five countries and each one has its own rules on data, AI and security. Nobody in the building can draw the whole picture”
- “Our risk register rates everything high, medium or low. The board asks what it would actually cost and the room goes quiet”
- “Something is hitting our service at scale: fake accounts, bot farms, coordinated campaigns. We're winning every battle and we can't tell the board whether we're winning the war”
How it goes wrong
Risk registers add risks up. Real failures multiply them. A missed rule in one country, an over-trusted supplier and a plan nobody has tested are each survivable. On the same afternoon they are the headline. A list sorted into high, medium and low never shows that, so we draw the picture instead.
What we do
Where you really stand, what it could cost, and what to do next. Written for the people who decide.
- 01
State analysis
An independent read of where you really stand: your systems, your data, your suppliers, your AI, and every rule you answer to. With the evidence, not the org chart's opinion.
- 02
Put a number on it
What each risk would cost you in money, time and standing, so the board can weigh it against everything else it has to fund.
- 03
The roadmap
What to do, in what order, who owns each step, and how you'll know it worked. Short enough to be read. Specific enough to be run.
- 04
Keep it honest
We stay on as the board's second opinion while the roadmap runs: a regular, plain read on whether the plan is working and what has changed since.
What you get
- A state analysis the board can read in one sitting
- Your risk surface, mapped, with what each exposure would cost
- A roadmap with owners, order and proof points
- A standing advisor the board can call before deciding
Standards and tools
We use the standards your auditors and regulators use, applied to how you really run. We don't sell certification; we tell you how far away you are.
- FAIR · ISO 31000
- Putting money on risk instead of colours
- NIST CSF 2.0 · ISO 27001
- The security checklists regulators and customers ask about
- ISO 42001 · NIST AI RMF
- The same, for AI
- SOC 2 · SOX
- What North American customers and public markets require
- PIPEDA · GDPR · DORA · NIS2
- The privacy and resilience rules across the countries you work in
Need the fixes built? We don't do the engineering. Our sister company, Graphite & Moss (graphiteandmoss.ca), does, and we'll say plainly when you need them and when you don't.
The rest of the practice
- 02
AI safety
For organizations adopting or building AI
Before AI is everywhere in your business, we test it. You find out what it does under pressure, not what the vendor promised.
- 03
Research
Behind both practices
We watch the ground under the other two: what's moving, who's moving it, and what it means for you. Most of it isn't published. Some is.
Start here
Not sure where you stand? Let's find out.
Tell us what the board is asking, or what you wish it would ask. We'll tell you plainly what we'd look at first.
We’ll reply in writing: what we’d look at first, and a quote.
