Risk Advisory
A risk framework sized for a company your size. Registers, owners, appetite, and reporting that fit how you actually work. Built with your team, not dropped on them.
FRAMEWORKS
ISO 31000, COSO ERM and NIST CSF for the method. DORA and NIS2 for EU obligations.
PROPORTIONATE BY DESIGN
Scopes, registers and cadence sized for companies under 250 people, not scaled down from a bank.
AI TRACES, PEOPLE DECIDE
Every cascade path the analytics find is reviewed with your team before anything is prioritised.
THE PROBLEM
How one small risk becomes an avalanche.
A password is phished on a Tuesday. By Thursday it is downtime, then a breached SLA, and your largest client is rereading the exit clause. None of those steps announced themselves. Each one was only visible from the step before. Carminium exists for the space between the steps. We map how risk travels through your business, from a single event to the goals it can reach, so you see the whole path, not the surprise at the end of it.
WHAT WE DO
Three ways in. One method through.
Cascade Analytics
Our core craft. We model how single events chain through systems, suppliers, and processes until they reach your goals. Every scenario gets a path, a likelihood, and a cost.
DORA & NIS2 Readiness
A gap assessment against the articles that apply to you, then a plan that closes them in order of harm. Evidence the auditor can open, not a binder that gathers dust.
THE PLATFORM · IN DEVELOPMENT
Your risk network, as a working system.
Alongside the advisory, we are building a tool of our own. It lets you investigate cascade scenarios end to end and run the whole risk process in one place. And because your risks form a connected network, it doubles as an early warning system: when a treatment or preventive measure is missing, you see which goals are exposed before anything happens.
Ask about early accessSCENARIOS · Q3EARLY WARNING: 2 GOALS EXPOSED
Key supplier outage → SLA breach → top clientNO TREATMENT
Phishing → downtime → regulator letterTREATMENT DUE
Cloud cost spike → cash flow → growth targetCONTROLLED
Key person leaves → controls skipped → auditCONTROLLED
Illustrative interface. Final product design to follow.
APPROACH
Trace. Tie. Hold.
-
01 · TRACE
Trace
We sit with your team and map what matters: goals, systems, suppliers, obligations. Then our AI traces the cascade paths a risk can take to reach them, and we walk through every one with you.
-
02 · TIE
Tie
Every path gets an owner, a control, and a trigger. The loose ends get tied before they can travel.
-
03 · HOLD
Hold
A quarterly cadence keeps the map current: testing, monitoring, and one report your board can read in ten minutes.
WHAT YOU LEAVE WITH
- A living risk register your team actually uses.
- A cascade map from your systems to your goals.
- A DORA and NIS2 gap plan, ordered by harm.
- First access to our platform for investigating cascade scenarios.
- One system that will carry your whole risk process.
STRAIGHT ANSWERS
The questions we hear first.
Maybe, and maybe through the back door. Even a forty-person firm lands in scope when it supplies an essential entity or serves financial clients. We check your scope in the first conversation and tell you plainly either way.
Neither can most of our clients. That is the point. Fixed scopes, proportionate frameworks, and no fifty-page decks you will never open.
So we designed around it. Workshops in half days, drafts we prepare and you approve, and a cadence that costs your people hours a quarter, not weeks.
Good, that is a start. A list tells you what could go wrong. A cascade map tells you what it would break. We upgrade the first into the second.
Yes. The cascade method and the risk framework are regulation-neutral and built on ISO 31000 and COSO ERM. DORA and NIS2 readiness is an add-on for firms that fall under EU rules.
CONTACT
Start with one conversation.
Forty-five minutes. You bring how the company makes money and what concerns you. We bring a first sketch of your risk paths and a plain answer on your DORA and NIS2 scope. No deck, no obligation.