Assess
Understand the environment. Who is the client, what do they actually do, where do they go, who has access, what has already happened, and what constraints — legal, practical, financial, personal — define the space we are working in?
09 / Risk management
Risk Management
A five-stage framework for turning an unclear sense of exposure into a documented, proportionate and reviewable set of controls.
Risk Work Is Judgement, Made Visible
Risk management is not prediction. It is a method for making judgement explicit: what could reasonably happen, how much it would matter, what we are doing about it, and who decided. Written down, that judgement can be challenged, improved and handed over. Left unwritten, it disappears with the person who held it.
We do not attach invented probabilities to security events. Where a number cannot be honestly supported, we use structured qualitative assessment instead — and say so.
BasisLawful, client-provided & open information
MethodStructured qualitative assessment
OutputDocumented, owned, reviewable controls
02 / Framework
The Five-Stage Framework
Applied to a person, a residence, a site, an event or a whole organization. The stages do not change; the depth does.
Identify
Identify relevant risks. Not every conceivable threat, but the ones with a credible connection to this client, this environment and this period — recorded specifically enough to be acted on.
Prioritize
Determine probability and impact using a consistent qualitative scale, so that finite attention goes to the things that would matter most. Disagreements about priority are resolved on the record.
Mitigate
Develop proportionate controls: prevention first, then detection, then response. Each control has an owner, a cost in effort, and an honest statement of what it does not address.
Review
Continuously improve the security plan. Environments change, people change, and controls decay quietly. A defined review point is part of the plan, not an afterthought.
03 / Prioritisation
A Qualitative Risk Matrix
Likelihood and impact are assessed on a five-point qualitative scale and plotted to produce a priority rating. The matrix is a tool for structuring a conversation, not a calculation — the words in each cell are the output, and the reasoning behind the placement is recorded alongside it.
| Likelihood against impact | Minor | Limited | Moderate | Major | Severe |
|---|---|---|---|---|---|
| Almost certain | Moderate | High | High | Critical | Critical |
| Likely | Low | Moderate | High | High | Critical |
| Possible | Low | Moderate | Moderate | High | High |
| Unlikely | Low | Low | Moderate | Moderate | High |
| Rare | Low | Low | Low | Moderate | Moderate |
Each cell states its rating in words as well as in shading, so the matrix remains readable without relying on colour.
Prevention First
The cheapest control is almost always the one that removes the opportunity — a changed routine, a corrected habit, a closed access route.
Proportionate Always
Controls that are disproportionate get abandoned within weeks. A measure nobody sustains is not a control; it is a liability with paperwork.
Owned Explicitly
Every control has a named owner and a review date. Unowned measures decay silently and are discovered only after they were needed.
Next step
Put Structure Around Your Exposure
A first assessment usually takes a single scoped engagement and produces a documented baseline you keep, whether or not you continue with us.