Executive overview

The SCO read-only thesis, pointed at enterprise risk: the register, appetite, indicators, mitigations, and loss events - plus the one thing point tools miss, a risk view synthesized across every other domain.

What this is, and what it is not. A preview of a planned domain, not a live product. In production it would sit read-only on top of your risk register / GRC, control and audit systems, and the other AssetShop domains - surfacing exposure, appetite breaches, overdue mitigations, and cross-domain risk signals. It does not own risk decisions, set appetite, or replace the risk committee or internal audit; it informs them. All figures here are synthetic.

62

Residual risk index

-12 YoY (improving)

48

Risks tracked

4

Above appetite

38

Open mitigations

9 overdue

5

KRIs in breach

of 24

22

Loss events (TTM)

$3.4M

Loss impact (TTM)

84%

Control coverage

Residual risk index & outlook synthetic

Composite residual exposure (lower is better), trailing 8 quarters with outlook.

Residual indexOutlookBand

Risks by category synthetic

Signals worth attention

4 risks are above appetite - led by single-source supplier concentration and customer-credit concentration; both also show up in SCO and Financial.

9 mitigations overdue - including a business-continuity plan refresh for the OSK-03 plant.

Residual index down 12 YoY - mitigation completion and tighter controls are reducing net exposure.

Synthetic preview. In production, derived read-only from GRC, control, and audit systems plus cross-domain AssetShop signals, with SHA-256-anchored lineage.

Risk register

The enterprise risks being tracked - by category, likelihood, and impact - and how the register moved.

48

Risks tracked

9

High / severe

12

New (TTM)

8

Retired (TTM)

Register movement (TTM) synthetic

Risks open at start to open now.

Risk	Category	Likelihood	Impact	Score
Single-source supplier (steel)	Supply chain	High	High	20
Customer-credit concentration	Financial	Med	High	16
Cyber breach (edge / OT)	Cyber / IT	Med	High	15
Uncapped contract liability	Legal	Med	Med	12
Key-person dependency (eng)	Operational	Med	Med	10

Risk appetite

Where current exposure sits against the appetite thresholds the board has set - and where it has breached.

4

Above appetite

7

Approaching limit

37

Within appetite

6

Appetite categories

Exposure vs appetite by category

Supply chain118% of limit

Financial / credit108% of limit

Cyber / IT94%

Legal / compliance85%

Operational68%

Strategic52%

Supply-chain and credit exposure both exceed appetite - the two breaches the board would want addressed first; each traces to a concentration AssetShop also surfaces in SCO and Financial.

Synthetic, aggregated. Appetite thresholds are illustrative; exposure measured read-only against board-set limits.

Key risk indicators

The leading indicators that warn before a risk materializes - which are green, which have breached.

24

KRIs tracked

5

In breach

6

In warning

13

Within tolerance

KRIs in breach - trend synthetic

Count of indicators past threshold, trailing 8 quarters.

Indicators worth attention read-only

Indicator	Domain	Status	Value vs threshold
Top-supplier spend share	Supply chain	Breach	34% vs 25%
DSO (days sales outstanding)	Financial	Breach	58d vs 45d
Critical vulns open	Cyber	Breach	14 vs 5
Engineering attrition	Workforce	Warning	14% vs 12%
On-time delivery	Operations	Warning	93% vs 95%

Synthetic, aggregated. KRIs computed read-only from the source domains; thresholds illustrative.

Mitigation & controls

The actions in flight to reduce risk - their status, ownership, and whether controls are actually covering the register.

38

Open mitigations

9

Overdue

84%

Control coverage

11

Risks w/o control

Mitigation status

On track21

At risk8

Overdue9

Overdue mitigations read-only

Mitigation	Risk	Owner
Second-source qualification	Supplier conc.	Procurement
Credit-limit review	Credit conc.	Finance
OSK-03 continuity plan	Plant outage	Operations
Service-key rotation	Cyber	IT / Security

11 tracked risks have no documented control - the gap between the register and what is actually being done about it.

Synthetic, aggregated. Reads mitigation and control status read-only; ownership routed to the responsible function.

Loss & events

What actually went wrong - operational loss events and near-misses - by category and financial impact.

22

Loss events (TTM)

$3.4M

Total impact

41

Near-misses

-38%

Impact vs prior yr

Loss-event impact trend ($K / quarter) synthetic

Losses by category read-only

Category	Events	Impact
Supply disruption	6	$1.3M
Quality / scrap	5	$0.8M
Process / downtime	5	$0.7M
Compliance / penalty	3	$0.4M
Cyber / fraud	3	$0.2M

Loss impact is down 38% year over year - supply disruption remains the largest category and the one most tied to the supplier-concentration risk.

Synthetic, aggregated. Reads loss/event records read-only; impact figures illustrative.

Cross-domain synthesis

The differentiator: risk seen across every domain at once. The same concentration shows up as a supplier risk, a delivery risk, and a credit risk - one picture instead of three.

6

Source domains

3

Compounding risks

$8.2M

Linked exposure

1

Unified view

Risk exposure by source domain synthetic

Compounding signals read-only

Signal	Seen in	Net
Steel supplier concentration	SCO + Financial + Risk	High
Retail-customer credit	Revenue + Financial	High
OT cyber + EOL assets	Security + Operations	Med
Contract liability + vendor	Legal + Security	Med

This is what no single system sees: one supplier relationship is simultaneously a supply risk, a delivery risk, and a credit risk. Reading across the domains is the whole point.

Synthetic preview. In production, risk signals are synthesized read-only from the other AssetShop domains with lineage to each source.

Scenario & resilience

How the business holds up under downside scenarios, and how ready continuity plans are.

5

Scenarios modeled

72%

BCP readiness

2

Plans overdue

$14M

Worst-case impact

Scenario impact (illustrative)

Key supplier failure$14M

Major plant outage$11M

Large customer default$8M

Cyber outage (5 days)$6M

Demand shock (-15%)$5M

The two highest-impact scenarios both involve single points of failure - the steel supplier and the OSK-03 plant; second-sourcing and the continuity-plan refresh address both.

Synthetic, aggregated. Scenario impacts are illustrative and combine read-only signals across domains; not a forecast.

Compliance & assurance

How well controls are tested, where audit findings remain open, and which obligations are coming due.

84%

Controls tested

14

Open audit findings

11

Obligations due 90d

3

Frameworks tracked

Open audit findings by area read-only

Area	Findings	Highest severity
Vendor / third-party	4	High
Access management	3	Med
Segregation of duties	3	Med
Change management	2	Low
Business continuity	2	Med

Vendor and access findings echo the same themes as Security and Legal - one remediation effort closes findings across functions.

Synthetic, aggregated. Maps control testing and audit findings read-only; this is assurance reporting, not an audit opinion.

Connectors & data

Where Risk Management would read from - dedicated GRC systems plus, uniquely, the other AssetShop domains.

Read-only, and partly powered by the other domains. These connectors are scaffolded, not built - each reports 0/12 conformance until a tenant integration is done. Risk is the domain where the cross-domain advantage is sharpest: much of its signal is synthesized read-only from SCO, Financial, Legal, Security, and Workforce, with SHA-256-anchored lineage to each source.

Risk & GRC connectors

System	Category	Mode	Status
ServiceNow GRC / IRM	GRC	Read-only	Scaffolded 0/12
Archer (RSA)	GRC	Read-only	Scaffolded 0/12
LogicGate / AuditBoard	Risk / audit	Read-only	Scaffolded 0/12
Workiva	Reporting	Read-only	Scaffolded 0/12
AssetShop domains	Cross-domain	Read-only	Internal feed

How it stays trustworthy

Read-only, advisory - it informs the risk committee; it does not set appetite or accept risk.

Lineage across domains - every synthesized signal traces to its source record via SHA-256 anchoring.

Systems of record stay authoritative - the register and GRC tools remain the source of truth.

Planned domain. Connectors are scaffolds; functional conformance (12/12) is verified per tenant at integration, never assumed.

Signals & opportunities

Enterprise risk signals across supply, governance, and cyber - read-only from the risk register, GRC, and incidents. Surfaces and quantifies; mitigation is owned by your teams. Figures synthetic (Meridian Industrials).

12

Open signals

3 critical

Exposure

3

High severity

7 in-flight

Addressable

Detected signals synthetic

Each signal is an observation with a source lineage; confidence reflects how directly the data supports it.

Signal	Area	Severity	Magnitude	Conf.	Source
Supplier concentration risk	Supply	high	34% top-1 spend	med	AP + master
Single-source components	Supply	high	6 critical parts	high	BOM + master
Overdue mitigations	Governance	medium	8 past due	high	register
Control gaps - access	Cyber	medium	4 controls	med	GRC
Incident recurrence	Operational	medium	3 repeats QoQ	med	incidents
Residual-risk drift	Governance	medium	+0.4 avg	low	register
Emerging - FX volatility	Financial	low	EUR exposure	med	treasury

Opportunities the signals point to

What the observation suggests. AssetShop quantifies; your team decides and acts in the source systems.

6 parts

Dual-source qualification for single-source critical components.

8 items

Clear overdue mitigations on high and critical risks.

4 ctrls

Close access-control gaps flagged in the cyber category.

How to read this

High signals are concentrated, well-evidenced, and material - act on these first.

Confidence separates observed facts from modeled estimates.

Every figure traces to a read-only source. Nothing here is written back to any system.

Synthetic. Signals computed from read-only risk register / GRC / incidents data; magnitudes labeled modeled are estimates, not posted figures. Operational signal, not advice; AssetShop never writes back to source systems.

Risk register detail

The full register behind the risk signals - likelihood, impact, status, owner.

12

Open risks

3

Critical

8

Overdue mit.

7

In-flight

Detail records synthetic

Score is likelihood times impact; critical rows carry impact of 5. Use Export above to download exactly these rows as CSV.

Risk	Category	Likelihood	Impact	Status	Owner
RK-1 Supplier concentration	Supply	4	5	open	Procurement
RK-2 Single-source parts	Supply	3	5	mitigating	Procurement
RK-3 FX volatility	Financial	3	3	open	Treasury
RK-4 Access control gaps	Cyber	3	4	mitigating	IT
RK-5 Incident recurrence	Operational	4	3	open	Ops
RK-6 Key-person dependency	Workforce	2	4	open	HR
RK-7 Contract lapse	Legal	3	3	mitigating	Legal
RK-8 Demand volatility	Commercial	4	2	open	Planning
RK-9 Quality escape	Quality	2	5	mitigating	Quality

Synthetic (register + GRC). Read-only detail; AssetShop never writes back to source systems. Figures illustrate Meridian Industrials.

Executive overview

Residual risk index & outlook synthetic

Risks by category synthetic

Signals worth attention

Risk register

Register movement (TTM) synthetic

Top risks by score read-only

Risk appetite

Exposure vs appetite by category

Key risk indicators

KRIs in breach - trend synthetic

Indicators worth attention read-only

Mitigation & controls

Mitigation status

Overdue mitigations read-only

Loss & events

Loss-event impact trend ($K / quarter) synthetic

Losses by category read-only

Cross-domain synthesis

Risk exposure by source domain synthetic

Compounding signals read-only

Scenario & resilience

Scenario impact (illustrative)

Compliance & assurance

Open audit findings by area read-only

Connectors & data

Risk & GRC connectors

How it stays trustworthy

Signals & opportunities

Detected signals synthetic

Opportunities the signals point to

How to read this

Risk register detail

Detail records synthetic