Your risk report says you're covered. Could you prove it?
Most boards can say how big their risks are. Very few can show whether the controls behind them will hold, or whether their due diligence would stand up.
Confidence isn't protection.
Stephen Covey made the point decades ago: effective people put their energy into what they can influence, not into everything they're concerned about. Most risk management does the opposite. It stays in the circle of concern, scoring what might happen by likelihood and consequence.
Those scores are abstract and hard to test. In 2008, Tony Cox showed that risk matrices can rate risks worse than chance. Yet nearly two decades on, we still lean on them, largely because no practical alternative has been on offer.
The result: a register that glows green, and an organisation still caught out by risks it believed were controlled.
On the day Deepwater Horizon exploded, BP and Transocean executives were on board to celebrate seven years without a lost-time injury. Eleven people died. The direct cost to BP passed US$60 billion, and the full cost was far higher. The investigations pointed past the drill floor: schedule and cost pressure, decisions made to save time and money, warnings that never crossed between companies, and gaps in what people knew. None of it showed up in an injury rate. They were looking the wrong way.
…see where your protection actually sits?
CAM, the Control Architecture Matrix, starts from a clear understanding of what's out there, then turns the focus inward to the controls you own. It shows which of four ways each risk is really protected. Same rating, very different protection.
It gives a plain answer to the question every board should be asking: are we as protected as we think we are? And because the board, the risk function and operations are all looking at the same picture, the conversation turns to building better controls, not adding more checks and more clutter.
Could you say which quadrant most of your controls sit in? Most organisations can't. CAM makes it visible.
Does this sound familiar?
- You sign off on risk reports you can't see behind.
- Likelihood is rated on what's happened before, but the events that do the most damage rarely have a history.
- Risks look lower on paper because of "effective controls" that mostly rely on procedures, training, or responding after the event.
- Your weakest risks attract more audits and checks, but the controls themselves never change.
Then let's talk.
Twenty minutes, no cost, no pitch deck. CAM works alongside the risk matrix you already have. We'll look at where your organisation stands and where to start.
Controls I've had to rely on.
Army, counter-terrorism tactical operations with NSW Police, and leading risk and operations across a range of industries. I hold a Master of OHS and lecture in Risk Management at the University of Wollongong. CAM is what I built from that work.
“Brendan is an inspiring leader and great mentor.”
Brendan created and delivered the leadership development program to all managers and supervisors across Thredbo. This achieved a massive increase in employee reporting up 420%. A 20% drop in the rate of workers’ comp claims year 1 and a further 25% drop year 2. Thanks for everything you do Brendan!
Stuart Diver, General Manager, Thredbo
Real human-centred risk management is about protecting people, not focusing on them.
When protection depends on people holding every control together, all their attention goes into not slipping. Build the protection in, and that attention goes back into their core work, and into noticing and speaking up when something isn't right.
Read your own controls.
CAM Introduction
The Matrix: two hours with people from across industries on the four quadrants and what they reveal. The first session of the Control Architecture Series, and it counts towards it.
Register your placeCAM Online $250 AUD
The CAM workbook and guided lessons, to start whenever suits you.
Register interestPrograms
Rating, assurance, governance and the people side of every control, built on what CAM shows.
See programsWant your own people delivering it?
License CAM and the programs, accredit your own trainers, and keep the capability in-house or take it to your clients.