A risk map ready for senior management, and risks tracked through indicators
Every month, our team maintains your risk register with your risk owners: scoring, reviews, treatments, incidents and indicators. Your management decides, on the basis of an up-to-date risk map.
- ISO 9001 · 21001 · 37301
- Accredited by the CGEM for the assessment of the Label PME Responsable
Risks known to a few people, a risk map rebuilt in a rush
An organisation's major risks are seldom written down, and even more seldom reviewed. The day you are asked for the risk map, it is pieced together in haste, with no named owner for each risk and no treatment plan being followed up.
This request often comes about like this:
- your board of directors or your parent company wants to see your risks and how they are treated;
- a financial partner, a donor or a contracting client asks for your risk map;
- an auditor asks you how your risks are reviewed;
- a serious incident, or an organisational change, means starting all over again.
Who it is for
Your organisation has no risk function, and your management must be able to show at any time what its risks are, how serious they are and how they are being treated.
Where we already run your quality or QHSE system, its risks are monitored within that framework; the Risk Office is only added for a scope separate from it.
Our team maintains your register. Your management decides.
A managed service: we do the monitoring work, your risk owners contribute their knowledge of the ground, and your management makes the calls.
At the start
A scoring method with impact criteria specific to your organisation, and risk appetite thresholds approved by your management. Risks are identified in remote workshops, each with its owner. You receive a register, an annotated risk map, a treatment plan and risk indicators chosen with your management.
Every month
We maintain the register and review each risk when it falls due, with its owner. We follow up treatment actions, record the incidents you pass on to us and take indicator readings. A report gives you a summary of the risks.
Every quarter
A review with your management: the risks that exceed the accepted level, and the decisions to treat or accept them.
Every year
An assessment of the year, to decide on next steps with you.
What you receive
- The method note and the risk appetite statement, as controlled documents
- The initial risk register
- The initial risk map, printed by the platform and annotated by our team
- The treatment plan
- A report every month, with the summary of risks
- The report of each quarterly review, and the annual assessment
What we do not do
- Deciding on your behalf: treating or accepting a risk remains your management's decision
- Carrying out treatment actions, which remain with your teams
- Auditing the system we run: internal audit falls under our Audit Office, with a separate auditor
- Attesting compliance, whether with ISO 31000 or with a regulation
- Giving legal, financial, actuarial or insurance advice
- Managing a crisis, business continuity or technical IT security
- Consolidating the risks of several companies: each company has its own register
What you will see in a demonstration
The platform is operated by our team, on an instance dedicated to your organisation. It is not sold separately: it supports the service. In a demonstration, using fictitious data, it shows the following.
A living register
Each risk has a reference, a category and an owner. It is the entry point for all monitoring.
Priorities that follow from a known grid
Likelihood and impact give a score and a level, according to the risk appetite thresholds approved by your management.
What the treatment must reduce
The target residual risk is written down. The ‘treated’ status requires an action carried through to closure, with supporting evidence.
Indicators that flag a drift
Each indicator has an alert threshold and a critical threshold. Its status is calculated from the last validated reading, the most severe status is carried up to the risk, and a filter isolates the risks to watch.
The field feeds the register
An incident is linked to the risk it concerns. Root cause analysis starts from the incident, and the effectiveness of the action is checked by another person.
The management view
The printed risk map shows, side by side, the risk as it stands and the risk that should remain once treatment is completed. For each of the highest residual risks, it gives the owner, the treatment and the indicators, and it bears the statement ‘management tool’.
An indicator without a validated reading remains at ‘no reading’: the status displayed is not a real-time measurement.
How your Risk Office is set up
The pace of the workshops depends on your teams' availability; we set it together at the launch.
- 01
No-obligation diagnostic
A consultant from the Systems team reviews the situation with you: the risks already known, your management's expectations, your deadlines.
- 02
Written proposal
The scope, the deliverables and the pace of reviews, set out in black and white. You decide.
- 03
Launch
We agree with you on the workshop schedule and the list of documents to gather.
- 04
Method and risk appetite
We draft the scoring method and the risk appetite statement. Your management approves them.
- 05
Identification workshops
Remotely, with your risk owners. Each risk is described, scored and assigned to its owner.
- 06
Risk map and treatment plan
The platform prints the risk map; we annotate it and propose the treatment plan.
- 07
Sign-off and getting started
Your management signs off. The risk indicators are finalised, and your contact person takes charge of the follow-up with us.
- +
Then
Every month, the reviews and the report. Every quarter, the review with your management. Every year, the assessment.
A trading name of TARGETUP CONSULTING SARL AU
TargetUp Systems is a trading name of TARGETUP CONSULTING SARL AU, based in Rabat. The credentials below belong to this firm; they extend neither to the platform nor to the organisations we support.
ISO 9001 · ISO 21001 · ISO 37301
Accredited by the CGEM for the assessment of the Label PME Responsable
We never assess a company that we have supported; it is the CGEM that awards the label.
Our role: to prepare, maintain and audit internally. Certification is a matter for accredited bodies, and TargetUp Control, a management tool, does not attest to any compliance.
Risk mapping and monitoring: your questions
What is a risk map, and what is it for?+
What is the difference between inherent risk and residual risk?+
What is a risk indicator?+
How do you build the risk map with us?+
Does the Risk Office make us compliant with ISO 31000?+
Do our teams have to enter data in the platform themselves?+
Find out within a few days where you stand and where to start
A TargetUp Systems consultant gets back to you, reviews your risks and deadlines with you, then gives you an initial written assessment with recommendations. You then decide, with no obligation.
- A starting point, neither an audit nor a legal opinion
- Recommendations reviewed and signed off by a person
- A referral to the appropriate service, or to nothing if nothing is needed
Your request
Fields marked with an asterisk are required.
Request a no-obligation diagnostic
A few fields are all it takes. A TargetUp Systems consultant will contact you to arrange the scoping interview.
- A scoping interview with a consultant
- An initial written statement of gaps
- Recommendations ranked by priority
TargetUp Systems privacy policy
After you submit the form, a page confirms that your request has been received.
Prefer to write? systems@targetupconsulting.com