You Need an Independent Judgement
This family is for firms that have built risk and resilience capability and now need an independent view on whether it is doing what the board believes it is doing. The buyers are usually chairs and audit committees in the first year of a new chief risk officer, chief executives who have inherited a function from a predecessor, and boards who have read three internal reports that all conclude the same thing and want a fourth perspective from outside the system.
Five Reviews
Risk Maturity Diagnostic
Where the firm sits against ISO 31000 mandate and framework expectations, against good practice in the firm’s sector, and against what the board appears to assume. The deliverable is a written diagnostic with prioritised investment recommendations. We do not produce maturity heat-maps with five levels and a target of level four; we produce a written judgement that the board can debate. A typical engagement runs four to six weeks.
Critical Controls Assurance Review
Independent challenge to the proposition that the controls the board believes are protecting the firm are in fact protecting the firm. This is not internal audit. It is not second-line assurance. It is a third-party judgement on control adequacy and operation, written in language the board can act on. A typical engagement runs six to ten weeks.
Decision Quality Review
A structured audit of how a defined class of high-stakes operational risk decisions has been made over the preceding twelve to twenty-four months. We apply Rescherian canons of inquiry and Ulrichian boundary critique to surface the framing assumptions that shaped each decision. The output identifies decisions that were made well, decisions that were not, and the patterns that distinguish them. This review is unusual in the market. Buyers commission it when something has gone wrong and the board wants to know whether the failure was a single bad call or a pattern in how decisions are made. A typical engagement runs six to ten weeks.
Resilience Capability Review
Where the firm sits against operational resilience regulatory expectations and against severe-but-plausible scenario readiness. We test integration across business continuity, crisis management, cyber resilience, and third-party resilience. The deliverable is a written review with a capability scorecard and a remediation plan. A typical engagement runs six to ten weeks.
Risk Culture Review
A diagnostic on risk culture beyond survey instruments. We use ethnographic technique, structured observation, and systems-thinking dialogue to identify the gap between espoused and actual culture. We do not generate a culture score. We produce a written diagnostic of the cultural patterns the board needs to know about, with intervention recommendations the executive team can act on. A typical engagement runs eight to twelve weeks.
How this Family is Delivered
Reviews are time-boxed. The principal conducts the work personally. We work from documentary evidence (board papers, registers, prior reports), structured interviews with the people responsible for the capability under review, and where appropriate, observation of the function in operation. The deliverable is a written report with a single, named, defensible judgement. We do not deliver the kind of review that says nothing in fifty pages.
How We Differ from Internal Audit
Internal audit tests whether stated controls operate as designed. We test whether the design is the right design. The two functions are complementary, not competing. Where a firm has a strong internal audit function, our review is positioned to complement, not replace, what audit already produces.
Next Steps…
Kybernetix Risk and Resilience Advisory
First conversations are typically a thirty-minute call. The purpose is to understand the question the board is actually trying to answer and to test whether a review is the right way to answer it. In some cases it is not, and we will say so. Adjacent: see Counsel and Advisory if the issue is ongoing rather than reviewable in a defined window.