Identification finds what the register is missing.
-
A risk register is a photograph.
It was taken in a workshop, usually once a year, and it shows what the room already knew. The board never asks what is on it. The board asks what is missing from it.
This module exists to answer that question.
-
Your business is the lens.
Three kinds of input: external signals from public and subscribed feeds, your own risk data, and your operating reality: products, sites, suppliers, routes.
The third stream is the one that matters. Not better geopolitics than the specialists; world intelligence applied to what you actually run.
-
Five stages, one direction.
Assimilate the inputs. Detect candidate risks. Score them. Rank them. Surface the ones that earn attention.
The interesting part is the second stage, because we run it twice, two different ways.
-
The classical path is deterministic by design.
A model reads each signal and extracts one grounded, cited fact. Then the model steps out. Fixed logic joins facts that share an operational element into a scenario.
Same inputs, same scenario, every time. It lands in the language your auditors already read.
-
The generative path trades repeatability for breadth.
Detection runs many times, each from a deliberately different angle. Not random dice: the variation is designed, recorded and reproducible. A risk seen in k of N runs carries a signal strength of k over N.
A protected lane keeps rare-but-severe findings visible, because the risk you most need to see is often the one only a few runs noticed.
Illustrative Signal strength, as the deck shows it: a worked example from the platform deck, not a client’s figures. - Runs that saw the risk
- k = 5 of N = 8
- Signal strength
- s = 0.63 — a confidence weight, not a probability
- Protected weak-signal lane
- seen in 1 of 8 · severe if it happens · kept visible, not washed out by consensus
-
Scoring has two parts, both shown working.
Likelihood lands in a band, weighted by the quality of the source, with the phrase, the source and the count behind it. Impact is read on your rubric, in two layers: the dimensions you already run the business on, and the appetite thresholds you have already set.
Together they place the risk on the matrix. Management confirms or overrides, and the override is recorded too.
Illustrative One likelihood band, with its working: a worked example from the platform deck, not a client’s figures. - Band
- Likely · 50–80%
- The phrase
- “expected within weeks”
- The source
- regulator · high quality
- The count
- 3 independent signals
- The anchor
- your own example for this band
-
The delta is the product.
The two methods are never merged. Where they agree, the finding is validated. Where they diverge, that gap is your blind-spot set.
The risks your workshop never raised, and your framework could never have produced on its own.
-
Nothing becomes action without a person deciding it should.
What the module surfaces is a register that carries its own provenance, and a short list of risks that have earned the right to be simulated.
The next module picks up here.