Risk technology and advisory · Sydney
Build risk management you can rely on.
MyRISK helps organisations make important decisions defensible and keep risk ownership and action moving — starting with the pressure point that matters now, not a broad GRC rollout.
Supplier exception — what was known, who approved it, what conditions applied
- Evidence at the timeSOC 2 report, DPIA and policy version preserved as the decision was made.
- Challenge and revisionSecurity review added two compensating controls. Both recorded.
- Authority and conditionsApproved by the CISO and Head of Procurement, with owners and expiry.
- Drift viewReview due 14 Feb 2027. Nothing has changed that unsettles the approval.
First Risk Baseline — what matters, who owns it, what has not moved
- Baseline builtFrom the spreadsheets and action lists that already exist. Within minutes of standard inputs.
- First refreshThree actions closed, two aged, one new owner named.
- Second refreshThe leadership pack goes to the monthly meeting. Evidence gaps shrinking.
- Review decisionThe rhythm holds. That person runs it from here.
In your own words
Which of these have you said recently?
Trace · defensible decisions
We could not show how that was decided, or who approved it.
First stepDecision Defensibility Diagnostic on one recent decision. Fixed scope, fixed price.
Replay, not reconstruct →Essentials · practical risk management
We rebuild the same proof every few months and the actions never move.
First stepFirst Risk Baseline from what you already have, within minutes of standard inputs.
Know where you stand →Core / MCDS · higher education
Every reporting cycle is assembled by hand from the same sources.
First stepOpportunity Scan on one MCDS-aligned use case that is painful now.
Turn MCDS into assurance operations →Consulting · GRC assessment
We bought the platform, wrote the policy, and it still does not work.
First stepGRC maturity assessment against a named scope, then rebuild what fails.
Assess how risk work runs →Honestly, more than one of those? Tell us your most recent example and we will route it. Send the example or call (02) 8213 9000.
How every engagement works
Start small. See it work. Then decide.
Start with something real
A live decision, your current risk list, or the last proof request you received. Not a questionnaire about maturity.
One clear first step
You will know the scope, the price and the date you decide by. Built around the systems you already use.
Prove it before expanding
The first step has written success criteria. What happens next is decided by the result, not by a roadmap pitch.
Two products, two different jobs
Trace and Essentials are deliberately not one thing
Trace preserves how and why high-stakes decisions were made so they can be defended later. It is for scrutiny.
Essentials gives growing organisations a practical rhythm for priorities, ownership and follow-through. It is for momentum.
Core operationalises sector assurance in higher education, and Consulting rebuilds workflows that fail around tools you already own. Every route starts bounded.
What MyRISK will not do
- Position anything as generic GRC, a risk register or compliance automation.
- Require you to replace the systems you already use.
- Claim legal sufficiency, certification or assurance outcomes.
- Run your risk function for you indefinitely.
- Pitch software inside a consulting engagement. Anything relevant becomes a separate conversation you choose to have.
Start with the pressure point that matters now
A live decision for Trace. Your current risk list for Essentials. A named use case for Core. A failed workflow for Consulting.