Risk Discovery
A full day of discovery, a written assessment, and a walkthrough.
Your IT person or your MSP knows your systems. What they do not do is translate them into risk language the owner and the board can act on. That is the day: I ask the questions, I write down the answers, and I turn them into something you can act on. £950.
Where this sits on the ladder
There are four rungs, and this is the third.
1. The free guide: ten checks for operational continuity, on one page, free. The guide covers the morning the till stops.
2. The Guided Session (£450, ninety minutes). The ten checks filled in for your kit: one page of answers, a backup test, and you leave knowing what to do first. For an owner with no IT.
3. Risk Discovery (£950, a full day). The wider technology risk landscape opened up: the suppliers you depend on, the data flows you don't see, the regulatory gaps, the things that could break next quarter. For a firm with one IT person or an MSP, where I do the asking and the translating.
4. The Technology Risk Framework (£1,900): the European Technology Risk Assessment framework worked through for your organisation, domain by domain, and in depth. For a firm with a real IT team and a board that asks.
The difference between this and the framework above it is the depth and the document. Risk Discovery gives you the picture, in your language, in a short assessment. The Technology Risk Framework gives you 15 to 30 pages, a remediation plan with owners and dates, and a document you can show to a board, an insurer, or a customer who asked.
What happens
I spend a day with your firm, or two half-days if that is easier to get the right people into the room. I interview the owner and your IT person or your MSP, and I sit with them long enough for the answers to go past the rehearsed version. Then I look at the systems themselves: what you run, where the data sits, who can reach it, what happens when a supplier goes down, and what you would do if the answer you have relied on turned out to be wrong.
I review your suppliers and their concentration risk, your backups and whether anyone has actually restored one, your accounts and who holds admin on them, and the regulatory obligations that reach you as a business. Most of it is things you already know once somebody asks them in the right order. The point of the day is that somebody asks, and the answers end up written down rather than in someone's head.
We do it on site in the North East, or on a call with the right people dialled in. At the end you get the findings written down and a walkthrough so the assessment is useful rather than filed.
What you get
- A written assessment, normally 5 to 10 pages, in plain English, with the findings ranked by likelihood and impact so the first things come first.
- A walkthrough session, so you are not handed a document and left with it.
- The picture of your technology risk in your own words: the suppliers you depend on, the data flows you do not see, and the gaps that matter for a firm your size.
- A short list of what to do next, in order, so the day turns into a plan rather than a file.
- A note of what was out of scope, so nothing is implied that we did not cover.
Who this is for
Owner-run firms with one IT person, or with an MSP relationship and nobody internally who thinks in risk language. The business is doing well enough that technology risk has started to matter, but there is no risk function and nobody is going to be appointed to one. The owner wants to know where the exposure sits without buying a framework engagement.
It also suits a firm that has been asked a question it cannot answer: a customer doing due diligence, an insurer who wants to know what happens if their policy is triggered, or a tender that asked for something.
Who this is not for
- Firms that already have a business continuity function, or a risk owner who does this properly.
- Firms that need the full Technology Risk Framework: the whole European framework worked through domain by domain, 15 to 30 pages, with a remediation plan. That is the rung above.
- Anyone after a penetration test or a technical security audit. This is a risk review, and it is not a test of your defences.
- Firms that want a certification. This does not certify you against any standard.
- Owners with no IT at all. The Guided Session (£450, ninety minutes) is the right size for that, and it is a better use of a morning.
Price
£950 fixed fee, payable on delivery. No subscription and no retainer. Remote, or on-site in the North East.
If £950 is more than you need yet, the Guided Session is £450 for continuity only. If £950 is not enough, the Technology Risk Framework is £1,900 for the framework worked through in depth, with a document you own.
Ask about Risk Discovery
Tell me about your firm and what is worrying you, and I will tell you whether a day is the right way to find out.
Need the framework worked through in depth instead? Technology Risk Framework is £1,900, a written assessment with the findings ranked and walked through.
The framework behind all of it is the European Technology Risk Assessment, the free ebook, free to download.
Common questions
Is this the same as the Technology Risk Framework? No. That is the whole European Technology Risk Assessment framework worked through domain by domain, normally 15 to 30 pages, with a remediation plan with owners and dates. Risk Discovery is the day of asking the questions and the short written assessment at the end of it, 5 to 10 pages. If you need the framework in full, go to the Technology Risk Framework.
Is this the same as the free guide? No. The guide is free, ten checks for continuity, and it stays free. This is me asking the questions for a day and writing down the answers.
Who needs to be in the room? The owner, and whoever holds the answers: your IT person, your MSP, or both. The day works best when the person who can answer is there rather than relaying.
Do you need access to our systems? Only what you choose to share, and mostly this is a structured conversation. I do not take copies of your data away.
How long does it take? A day, or two half-days if that is easier to get the right people into the room. We agree the scope and the dates before we start, so there is no moving target.
What if we already have a continuity plan? Then this is probably not the right rung. Look at the Technology Risk Framework, or start at the Guided Session if you just want the checks refreshed.
Is this anything to do with insurance? Not directly. I do not sell insurance and I am not a broker. But a lot of what an insurer asks about after a claim is what gets written down here, and finding out where you stand before anyone needs to ask is the cheaper way to find out.
If the question is continuity rather than the wider picture, the Guided Session is the smaller first step at £450. The framework behind this work is the European Technology Risk Assessment, the free ebook, free to download.