Decision Infrastructure Diagnostic
A structured review for senior leaders whose risk work is not yet producing decisions that hold.
This is for leaders under pressure. Not for teams collecting more slides.
If you are reading this, the problem is almost certainly not that your organisation is ignoring risk.
The problem is that the risk work already underway is not converting into the three things the board actually needs: clear decisions, funded action, and evidence that holds under scrutiny.
You have more committees than you did three years ago. More dashboards. More reports. More escalations. And yet:
- Different teams describe the same exposure in different language, and nobody knows which version is correct.
- Executives receive updates, but leave meetings unsure of what was actually decided.
- Committees review activity, but cannot see whether anything moved.
- Audit evidence arrives late, rebuilt under pressure, and often from memory.
- You sense something structural is wrong — but cannot tell whether the problem is language, ownership, cadence, or proof.
You do not need another reporting cycle.
You need the missing layer between risk work and decision quality.
The reframe — You do not have a risk effort problem.
The organisations I work with are not under-resourced. They are not uninformed. They are not inattentive.
That is not a culture problem or a talent problem. It is a structural problem. And it does not resolve itself by adding another committee, another dashboard, or another framework refresh.
The structural blockage sits in one of three places — and almost always in a place leadership is not currently measuring.
Without mutually exclusive categories, comparable signals, and named ownership, every downstream decision inherits ambiguity. You cannot aggregate what you cannot classify consistently.
Without defined decision rights, evidentiary standards, and appetite boundaries, governance produces discussion rather than decision. Escalation becomes the default because no layer below feels empowered to act.
Without a system of record, a cadence that closes loops, and evidence generated in the course of decisions rather than reconstructed after them, the architecture exists on paper but never actually runs.
These three layers are load-bearing in sequence. A weakness in the lowest layer compromises everything above it. The layer that is actually failing in your organisation is rarely the one you would name first.
What the Diagnostic is
The Decision Infrastructure Diagnostic is a structured executive review of your three layers, conducted against the integrated model, producing a clear finding of where the constraint actually sits and what the highest-value next move is.
It is not a maturity assessment. It is not a framework presentation. It is not a benchmark report.
It is a focused diagnosis — built for leaders who need to act, not leaders who need to be educated.
What you receive
We examine whether your current risk language supports comparability, aggregation, prioritisation, and funding decisions. The review tests the taxonomy against the nine event domains of the integrated model and the three-level structure that makes classification defensible under scrutiny. We test the taxonomy in the hands of business-unit controllers, not the risk team — because if non-risk owners classify the same event three different ways, the taxonomy is not yet doing its work. You leave with a clear view of whether Layer 01 is the constraint, and where the boundary rules are weakest.
We map your existing governance against the five sequential moves and eight decision attributes of the integrated model. A decision that carries all eight attributes is durable under scrutiny; a decision missing any one of them has a specific, predictable failure mode. You leave with a clear view of where authority is diffuse, where escalation is reflexive, and where the CRO is carrying load that should sit elsewhere.
We examine your operating rhythm against the four tests that separate an installed infrastructure from an aspirational one: evidence freshness, decision closure, exception tracking, and reproducibility. A decision is only as strong as the system that carries it forward — and most organisations discover at audit that their infrastructure cannot reconstruct decisions made twelve months earlier without interviewing the people who made them. You leave with a clear view of whether Layer 03 is installed or aspirational.
A concise, board-grade document that states:
- Which of the three layers is the actual constraint
- What that constraint is costing you in decision quality, time-to-decision, and audit defensibility today
- The single highest-value structural move available to you in the next 90 days
No theoretical maturity model. No generic recommendations. A diagnosis executives can act on in the next committee cycle.
Who this is for
- You sit on a board, audit committee, or risk committee and want the function reporting to you to produce decisions, not activity summaries.
- You are a CRO, Head of ERM, or senior risk leader whose function is producing more output than ever — and still being asked by the board what to actually do.
- You are a CISO, CIO, or CTO trying to convert persistent cyber and technology concern into funded, defensible action.
- You are a Chief Audit Executive or Head of Internal Audit trying to strengthen traceability and evidence quality before the next regulatory review.
- You lead operational risk, supply chain risk, third-party risk, or people risk and are trying to resolve fragmentation across parallel risk taxonomies.
- You want a system that holds under scrutiny — not another exercise that produces artefacts nobody uses.
- You want a heatmap refreshed rather than a decision system corrected.
- You want a framework deck to present, rather than a diagnosis to act on.
- You are seeking validation of the current operating model rather than a candid assessment of where it is failing.
- You expect a structural problem to be resolved without leadership engagement.
The Diagnostic is deliberately not positioned for organisations at the beginning of their risk journey. It is for organisations mature enough to have built the activity — and now mature enough to notice that activity is not the same as decision.
Not ready for the Diagnostic yet?
Before commissioning a structured review, some leaders prefer to first understand the integrated model in their own time, against their own organisation.
The free executive briefing Why Boards Lose Confidence Even When Reporting Improves is the right starting point. It covers the mechanism by which critical issues stall in governance rooms, the five hidden blockers of board confidence, how taxonomies shape funding decisions, how strong leaders shorten decision cycles, and the one system that converts risk activity into action.
It is the same structural vocabulary used inside the Diagnostic, presented as a self-contained read for boards, CISOs, CIOs, CROs, and audit leaders.
Why this matters now
Regulatory expectations on board-level risk oversight have risen in every major jurisdiction over the past 24 months. Audit committees are being asked to defend not just what was decided, but how — the reasoning, the evidence, the authority chain, and the record.
Most risk functions were not built for that standard of scrutiny. They were built for an earlier era, when activity was the deliverable and defensibility was assumed. That era has ended.
The organisations that will hold up under the next regulatory cycle, the next material incident, and the next board-level challenge are the ones installing the integrated model now — before it is requested of them under pressure.
The outcome
After the Diagnostic, you will know — with specificity, not in generalities — which of the three layers is the binding constraint in your organisation, what it is costing you, and what to do about it first.
The downstream outcome is what the integrated model exists to produce:
Risk work that produces decisions, delivery, and proof.
Not aspirationally. Reliably.
Availability is limited by calendar, not by marketing.
A small number of engagements are taken on each quarter to protect the depth of the work.