Reflection ToolPDF · 4 KB
After Something Goes Wrong: A No-Blame Review Guide
A structured way to review an incident that looks at the conditions that produced it, not the person who happened to be there.
Resource Library
Tools for the conversations, diagnostics, and reflections real GRC work calls for. Enter your email to unlock a download and join the newsletter.
Diagnostic ToolPDF · 5 KB
Before You Ask Whether You're Ready for AI
A diagnostic for examining what your organization is actually prepared to hand to an automated system, before the readiness question gets asked and answered by someone else.
Diagnostic ToolPDF · 4 KB
Is Your Zero Trust Actually Trust, or Just an Inherited Default?
A diagnostic for testing whether the trust built into your systems and vendor relationships was ever actually decided, or just inherited.
Conversation ToolPDF · 5 KB
Talking to Leadership About the Risk You Can't Put a Number On
A framing guide for the conversations where the risk is real but the data is thin, built so the discussion doesn't stall out waiting for a number that isn't coming.
Reflection ToolPDF · 4 KB
The Near-Miss Nobody Reported
A guide for reconstructing a close call after the fact, when the record of what almost happened lives only in someone's memory.
Conversation ToolPDF · 4 KB
The Questions to Ask Before You Trust a Third-Party Assessment
The questions worth asking before a vendor's self-reported assessment becomes the basis for a decision, framed as a conversation rather than a form.
Conversation ToolPDF · 5 KB
The Reporting Conversation Nobody Wants to Start
A discussion guide for the moment right before someone decides whether to say something, built to make the first sentence easier to say and easier to hear.
Reflection ToolPDF · 4 KB
What Happens After the Training?
A reflection guide for the weeks after a training program ends, built to catch whether anything about how people actually work has changed.
Diagnostic ToolPDF · 5 KB
Where Your Policy and Your Practice Quietly Diverge
A structured way to find the gap between what your policy says and what actually happens, without treating every gap as a violation.