They're visible weeks in advance — to anyone who knows where to look. De-Risk Matrix gives your leadership team exactly that visibility, built into how you manage goals every day.
Goals. Risk States. Culture. A repeating cycle that turns uncertainty into structured, actionable intelligence.
The problem isn't that leaders don't care about risk. It's that the tools they use were never designed to catch it early.
Most risk frameworks ask: what could go wrong? De-Risk Matrix asks: what effect is uncertainty having on your specific objectives, right now?
By anchoring risk to goals — not abstract threat lists — organizations gain immediate, context-specific visibility. Every goal always has a risk state. Every state has a recommended leadership response.
This is ISO 31000 applied practically: risk as “the effect of uncertainty on objectives,” captured at the level where it actually matters.
“A target number alone tells you nothing about risk. The threshold — the minimum acceptable level — is what defines exposure. The span between them is one operational expression of your tolerance for that particular objective.”
These are not optional enhancements. Each one is a prerequisite for the system to work.
Every goal needs both a target (ambition) and a threshold (minimum acceptable). A single number is not a goal — it's a wish. Without the threshold, you cannot define exposure, and you cannot detect drift until it's too late.
"Risk is the effect of uncertainty on objectives." (ISO 31000) This definition captures upside and downside — not just what went wrong, but what uncertainty is doing to your goals right now. Reporting actuals is not risk management.
The same goal position means different things with strong vs weak evidence. Exceeding target with no data is not success — it's an unverified assumption. Evidence strength is what separates a real forecast from optimism.
Leadership behavior determines whether risk is surfaced or suppressed. Every risk state prescribes specific leadership actions — because the cultural response is as important as the analytical one. Ignore this and the system breaks.
Not all risk states demand the same response speed. Dire demands immediate escalation. Harmonious demands maintenance. Without explicit urgency gradients, everything becomes equally urgent — which means nothing is.
Behind every forecast is a set of beliefs about what must be true for a goal to succeed: market conditions, team capacity, competitor behavior. When those beliefs are invisible, managers react to symptoms rather than causes. Naming and monitoring the assumptions behind each forecast is what separates predictive risk management from reactive reporting.
A 2×3 matrix. Y-axis: goal position (beyond target / on track / below threshold). X-axis: evidence strength (strong / weak). The two dimensions are independent and the cut-offs are defined, so every goal falls in exactly one state at any moment — a property of the construction, not a claim about how well the states predict outcomes.
Right now, every goal in your organization is in exactly one of these states. The question is whether your leadership team knows which — and whether they know what to do about it.
Performing above ambition with solid evidence. Raise the target — staying here breeds complacency.
Exceeding target but without strong data. Explore whether this is real performance or a measurement gap.
On track with strong evidence. Ensure the conditions that got you here continue to hold.
On track but without enough data. Prove this trajectory is real before treating it as certain.
Confirmed underperformance. Lower uncertainty — escalate immediately and take structured action.
Below threshold with insufficient data. Intervene now — you cannot afford to wait for better evidence.
Four steps. Repeated each period. Each cycle builds better calibration — and each cycle makes the next one faster and more accurate.
Define target + threshold for every strategic goal. This makes risk appetite explicit and drift detectable.
Update forecasts based on current data and evidence quality. Know where you're heading, not just where you've been.
Every goal surfaces its state automatically. Leadership sees what's Dire, Harmonious, or Defensive — instantly.
Apply the leadership behaviors prescribed for each state. Culture stops being passive — it becomes a structured response.
Every forecast is a set of assumptions projected forward. A revenue target of $100M is only realistic if certain conditions hold — market growth, product delivery, team capacity. When those assumptions are invisible, risk management is reactive by design. The question is never just why are we off track — it is which assumption failed first.
Without visible assumptions, the chain breaks before the forecast is even made.
Assumptions are not binary. They degrade over time — a belief that was valid in January may be uncertain by March and failed by May. De-Risk Matrix tracks each one continuously.
The assumption still holds. The forecast basis is intact. No action required — continue monitoring.
The assumption is under pressure. The forecast may be optimistic. Investigate before the next review cycle.
The assumption no longer holds. The forecast basis has changed. Reassess the goal's risk state immediately.
When you add an assumption to a goal, you also define its impact: if this assumption fails, does it push the goal toward a worse risk state, a better one, or is the direction unclear? And how severely — on a scale of 1 to 5?
Failure undermines the forecast. The goal is likely to move toward a worse risk state — Optimistic becomes Pessimistic, Harmonious becomes Dire.
Failure affects the context but not the direction of the goal's trajectory. Monitor, but no immediate re-forecast required.
Failure is actually a positive signal. A conservative assumption proved unnecessary — the goal may outperform its original forecast.
Magnitude 1–5 quantifies severity. A failed assumption with Negative direction and magnitude 5 is an immediate escalation trigger — even before the data moves.
Each goal carries the explicit beliefs that justify its target and forecast. When conditions change, you know which goals are affected — before the numbers move.
Assumptions are not set-and-forget. Status is tracked continuously — Valid, Uncertain, or Failed. A failed assumption is a leading indicator, not a lagging one.
Most indicators warn too late because they measure outcomes. Monitoring assumptions means you see risk before it appears in the forecast — not after.
A register of valid assumptions does not mean the forecast is reliable.
It means only that none of the assumptions you explicitly identified has yet been invalidated. There will always be uncertainty that was never written down as an assumption, a scenario, or a dependency in the first place — and that uncertainty is not measured here, because it cannot be.
This is a constraint in the software, not a footnote in the documentation. The fragility indicator has a floor: it cannot return zero, and its best available reading is no identified fragility — never no fragility. A system that makes uncertainty visible must not imply it has made uncertainty go away.
The six-state model makes two very different claims. We keep them apart deliberately, because conflating them would overstate what we know.
The 2×3 grid is built from two independent dimensions with defined cut-offs, so every goal falls in exactly one state at any moment. This follows from the construction.
Whether the six states discriminate between later outcomes — whether goals in Dire really do end below threshold more often than goals in Optimistic — has not been demonstrated with data. The platform now records a persistent state history precisely so this becomes testable. We would rather publish the open question than imply it is closed.
The states are intended to help a team decide what to do, not to predict outcomes. A model can be predictively modest and still change decisions for the better. Both propositions are worth testing, and they require different evidence.
An open question we have put to ourselves: does a six-state model perform materially better than a simpler three- or two-state model built on the same variables? Complexity should earn its place, and we have committed to reporting the answer either way.
Written and published before any results were examined, including the conditions under which we would consider the model refuted.
De-Risk Matrix draws on three different kinds of authority. They are not equally established, so we label them separately rather than presenting them in one voice.
Aligned with ISO 31000:2018, the international guideline for risk management. Where you see this, the concept follows the standard’s definitions — including risk as "the effect of uncertainty on objectives".
Grounded in published work by others — Edmondson on psychological safety, Cyert & March on aspiration levels, Kahneman & Tversky on framing. The cited research supports the underlying concept; it does not by itself validate how we apply it.
Our own proposed practice — the six states, the state-to-leadership-behaviour mapping, the assumption impact scale. Offered because we believe it is useful and because it can be tested, not because it has been validated. Treat it as a hypothesis you are entitled to challenge.
One distinction worth stating plainly: Amy Edmondson's research supports the importance of psychological safety. It does not validate our mapping from six risk states to six leadership responses. That mapping is ours, and it becomes a validation target itself once enough state history exists.
Ready to see it?
The platform implements the full methodology — goal spans, risk states, cultural practices, actions, forecasting, and assumption monitoring — in a single workspace. Start in minutes.
No credit card required · All features included · Cancel anytime