Aligned with ISO 31000

Most strategic failures aren't sudden.

They're visible weeks in advance — to anyone who knows where to look. De-Risk Matrix gives your leadership team exactly that visibility, built into how you manage goals every day.

Goals. Risk States. Culture. A repeating cycle that turns uncertainty into structured, actionable intelligence.

What most organizations do — and why it fails

The problem isn't that leaders don't care about risk. It's that the tools they use were never designed to catch it early.

Typical approach
  • Single-number targets
    No floor means no early warning — drift is invisible until it's a miss.
  • Quarterly reviews
    By the time risk appears in a report, the window to act has already closed.
  • Separate risk registers
    Risk lives in a spreadsheet, disconnected from the goals it threatens.
  • Gut-feel escalation
    Problems surface when someone is brave enough to raise them — not systematically.
  • Culture as afterthought
    Leadership behavior is never linked to risk state. Silence is the default.
De-Risk Matrix
  • Goal spans with explicit floors
    Threshold makes the risk appetite visible — drift is detected the moment it starts.
  • Continuous risk state per goal
    Every goal always has a state. Leadership always knows what needs attention.
  • Risk embedded in goal management
    No separate register. Risk is part of how every goal is tracked, every period.
  • Structured escalation by state
    Dire triggers an escalation protocol automatically — not when someone is willing to speak up.
  • Prescribed cultural responses
    Each risk state specifies the leadership behaviors required. Culture becomes manageable.

Core philosophy

Most risk frameworks ask: what could go wrong? De-Risk Matrix asks: what effect is uncertainty having on your specific objectives, right now?

By anchoring risk to goals — not abstract threat lists — organizations gain immediate, context-specific visibility. Every goal always has a risk state. Every state has a recommended leadership response.

This is ISO 31000 applied practically: risk as “the effect of uncertainty on objectives,” captured at the level where it actually matters.

The core insight
“A target number alone tells you nothing about risk. The threshold — the minimum acceptable level — is what defines exposure. The span between them is your risk appetite, made explicit.”

Five principles most risk frameworks ignore

These are not optional enhancements. Each one is a prerequisite for the system to work.

01

Goals must be spans, not points

Every goal needs both a target (ambition) and a threshold (minimum acceptable). A single number is not a goal — it's a wish. Without the threshold, you cannot define exposure, and you cannot detect drift until it's too late.

02

Risk is forward-looking, not historical

"Risk is the effect of uncertainty on objectives." (ISO 31000) This definition captures upside and downside — not just what went wrong, but what uncertainty is doing to your goals right now. Reporting actuals is not risk management.

03

Evidence quality changes the diagnosis

The same goal position means different things with strong vs weak evidence. Exceeding target with no data is not success — it's an unverified assumption. Evidence strength is what separates a real forecast from optimism.

04

Culture is a strategic variable

Leadership behavior determines whether risk is surfaced or suppressed. Every risk state prescribes specific leadership actions — because the cultural response is as important as the analytical one. Ignore this and the system breaks.

05

Urgency gradients must be explicit

Not all risk states demand the same response speed. Dire demands immediate escalation. Harmonious demands maintenance. Without explicit urgency gradients, everything becomes equally urgent — which means nothing is.

The 6 risk states

A 2×3 matrix. Y-axis: goal position (beyond target / on track / below threshold). X-axis: evidence strength (strong / weak). Every goal is always in exactly one state.

Right now, every goal in your organization is in exactly one of these states. The question is whether your leadership team knows which — and whether they know what to do about it.

DefensiveRaise
Beyond targetStrong evidence

Performing above ambition with solid evidence. Raise the target — staying here breeds complacency.

PotentExplore
Beyond targetWeak evidence

Exceeding target but without strong data. Explore whether this is real performance or a measurement gap.

HarmoniousEnsure
On trackStrong evidence

On track with strong evidence. Ensure the conditions that got you here continue to hold.

OptimisticProve
On trackWeak evidence

On track but without enough data. Prove this trajectory is real before treating it as certain.

DireLower
Below thresholdStrong evidence

Confirmed underperformance. Lower uncertainty — escalate immediately and take structured action.

PessimisticIntervene
Below thresholdWeak evidence

Below threshold with insufficient data. Intervene now — you cannot afford to wait for better evidence.

The repeating process

Four steps. Repeated each period. Each cycle builds better calibration — and each cycle makes the next one faster and more accurate.

1

Set goal spans

Define target + threshold for every strategic goal. This makes risk appetite explicit and drift detectable.

2

Forecast outcomes

Update forecasts based on current data and evidence quality. Know where you're heading, not just where you've been.

3

Read risk states

Every goal surfaces its state automatically. Leadership sees what's Dire, Harmonious, or Defensive — instantly.

4

Act on culture

Apply the leadership behaviors prescribed for each state. Culture stops being passive — it becomes a structured response.

Ready to see it?

Find out what state your goals are in — right now.

The platform implements the full methodology — goal spans, risk states, cultural practices, actions, and forecasting — in a single workspace. Start in minutes.

No credit card required · All features included · Cancel anytime