Risk, Impact & Harm Analysis

Overview

The register gets the attention the reasoning deserves

Most risk work produces a register and stops there. The register is the artefact, so it gets the attention: fields filled, scores assigned, review dates set, and a colour that moves when somebody argues for it.

A register is only as good as the reasoning behind it, and the reasoning is rarely written down: the exposure someone thought of and the one nobody raised look identical once both are rows. The test is whether the analysis has ever changed a decision that had already been made.

Academy

Each module can be taken on its own and trains the calls a practitioner has to make without being prompted. Our professional tracks bundle these modules into role- and discipline-specific curricula, with a final exam and capstone project.

HAM-AG-C-04 · Cross-disciplineGovernance DesignBuild the decision rights, governance meetings, escalation paths and evidence trails that make management systems work in practiceView details →

HAM-AG-C-07 · Cross-disciplineRisk ManagementBuild the capability to surface, structure and act on risk while action is still possibleView details →

HAM-AG-C-12 · Cross-disciplineSupplier ManagementManage suppliers and outsourced processes across requirements, selection, onboarding, oversight, change and exitView details →

Advisory

We support you in building a structured approach to risk and foresight that identifies what truly matters, assesses potential impact, and enables informed prioritisation and preparedness in uncertain and evolving environments.

The four phases below are the life of a management system, and an engagement can begin at any one of them.

1. 01

   Design

   Establishing structured risk and foresight capabilities

   –Establish risk management frameworks and processes

   –Define risk categories, criteria, and risk appetite

   –Design scenario analysis and uncertainty approaches

   –Integrate risk practices into strategy and planning

   –Design risk reporting and decision-support structures

2. 02

   Operate

   Applying risk and foresight in daily operations

   –Perform risk identification, assessment, and prioritisation

   –Conduct scenario analysis and uncertainty assessments

   –Maintain and update risk registers

   –Integrate risk practices into projects and operations

   –Provide risk reporting and decision support for management

3. 03

   Assure

   Assessing risk and foresight effectiveness

   –Conduct independent reviews of risk management frameworks and practices

   –Evaluate risk identification, assessment, and prioritisation quality

   –Review scenario analyses and underlying assumptions

   –Assess integration of risk into decision-making and planning

   –Prepare risk maturity assessments and management reporting

4. 04

   Evolve

   Developing risk and foresight capabilities for future readiness

   –Monitor risks and emerging developments continuously

   –Refresh scenarios and forward-looking risk analyses

   –Adapt risk frameworks to organisational and external change

   –Integrate foresight into strategy and decision-making

   –Provide executive sparring on uncertainty, resilience, and preparedness

Audit

An audit of risk reasoning tests what produced the register rather than the register itself: whether exposures were identified by a method or from memory, whether significance was argued rather than scored, and whether the output has ever changed a decision.

Audits are organised by discipline rather than by capability domain, because the criteria they test against live in the standards.

Insights

29 May 2026Deepwater Horizon: When Barriers Become AssumptionsHow a controlled well operation became a disaster when barrier evidence, contractor interfaces and stop authority failed21 min readRead more →

25 May 2026Chernobyl: When Decisions Outlive Their AssumptionsWhen changed conditions do not force a new decision, organisations can continue into danger while the warning signs are already visible16 min readRead more →