Enterprise Risk Management
A risk rating is only as good as the evidence behind it. We connect the register to the systems where each exposure shows up first.
Questions we help answer
- Which of our top risks could we evidence today if the board asked?
- Are the risks we track the ones that have actually caused our incidents?
- Who owns each risk, and when was it last reviewed?
- How do we express risk appetite in terms managers can apply to daily decisions?
- What should the board see each quarter, and in how much detail?
What we do
Risk inventory and register
Known risks plus those found in system settings, logs and contracts, each with an owner, a source and a status.
Risk appetite in measurable terms
Appetite written as thresholds that can be checked in data, such as the share of a category bought from one supplier or the age of unreconciled balances.
Key risk indicators
Indicators calculated from operational and financial systems, each with an alert threshold and a named recipient.
Board and committee reporting
Quarterly risk reports that link each rating to its evidence and to the incidents of the period.
- How an engagement with THEFOCUS startsDiscuss this with us
How we approach it
- 01
Combine what is known with what the systems show
Interviews give the known risks. Reviews of settings, access, contracts and logs add the ones nobody mentioned.
- 02
Tie each rating to a source
Every rating cites the data behind it and the date it was measured, so a reviewer can check it.
- 03
Automate the indicators
Key risk indicators refresh from the source systems on a schedule instead of being typed into a spreadsheet.
- 04
Feed incidents back
Each incident is checked against the register, and ratings or controls change where the register missed it.
Relevant industries
How an engagement with THEFOCUS starts
A first conversation is about your situation. If there is a fit, we propose a scoped diagnostic with a fixed deliverable before any larger commitment.
Discuss this with us01
A working conversation
Forty-five minutes with the person who would lead the work. We ask about the decision, the systems behind it and the deadline.
02
A scoped diagnostic
Read-only access, a fixed timeframe and a written finding: what the records show, what it costs and what to change first.
03
A plan you can act on
Changes, owners, measures and exclusions in writing. The same team then builds and measures, or hands over cleanly.
- One accountable team
- The people who diagnose also build the systems and measure the result.
- Partners chosen per problem
- Independent specialists join for the parts that need them, under one contract.
- Records before dashboards
- Orders, ledgers and logs are reconciled before any recommendation depends on them.
Questions executives ask
Is this an internal audit?
No. We build and maintain the register, indicators and reporting. Internal and external auditors review them independently, and we do not issue audit opinions.
Does the register need a new software platform?
Rarely. We usually build it in your existing workspace, BI or risk tool and connect indicators from the source systems. A new platform is recommended only where the existing tools cannot hold the evidence.
Discuss this with us
A few details help us route your enquiry to the right partner. Fields marked optional can be left blank.