Risk Acceptance Office, the one-page version
The business. A company that runs the risk acceptance loop for organisations. Every material risk is established on facts, held by a named person, accepted for a stated interval, and at the end of that interval accepted again, escalated, funded or fixed. It works in the gaps of the client's existing GRC platform, and keeps each material risk's evidence and decisions in a vault of its own.
The idea underneath. Every risk is already accepted. The exposure exists whether or not anybody signs for it, so the only real questions are who accepts it, and for how long. There is no deny button. Today most organisations carry most of their risk unsigned, reviewed quarterly, and disconnected from the facts that make it true.
Why now. Regulation increasingly assumes that residual risk has been judged acceptable by somebody accountable. The EU AI Act's Article 9(5), for providers of high-risk AI systems, requires residual risk to be "judged to be acceptable" and never defines the word. Boards are being asked to own decisions that their registers cannot show them.
Why it is a service, not a product. The hard part is not software. It is establishing risks on facts, connecting them to the people who hold them, running the clocks, and helping executives through a change that most of them will resist at first. RiskMandate.ai's experience is the evidence: taken to market as a product feature, acceptance met resistance from the people who run risk programmes, because it is a governance change.
What you sell.
| Price, as a hypothesis | |
|---|---|
| Acceptance audit | Free: one hour, five risks |
| Foundation engagement | £18,000, about eight weeks, one business unit |
| Acceptance Office | £2,500 a month, plus £60 per material risk per month |
| Incident and escalation support | £1,200 a day, on demand |
| Partner licence for consultancies | £15,000 a year |
The economics, as hypotheses. A risk engineer runs about 150 material risks. Twelve clients with forty material risks each bring about £58,800 a month against about £34,000 of delivery cost.
What already exists. The method is published: risks.sgit.ai, RiskMandate.ai, graphs.sgit.ai's fractal risk registers, and the Risk Graph Explorer vault, which computes the chain to the board today. Much of the model is stated as not yet built in code, and the plan does not pretend otherwise.
Reading order
01-the-idea.md: every risk is already accepted.02-the-method.md: the principles and the ladder, with their sources.03-operating-model.md: the loop, the vault per risk, the roles, the rhythm.04-in-the-gaps-of-grc.md: what GRC platforms do well, where the gaps are, and why the vendors should sponsor this.05-services-and-pricing.md: what you sell, and the numbers.06-go-to-market.md: who buys, the free thing that opens the door, and the resistance.07-execution.md: the first ninety days.08-why-invest.md: the case for backing it.09-risks.md: what could sink it.10-open-questions.md: what the published method has not settled.