DecisionOS — Control · module
Risk
Which of the things that could go wrong we would find out about in time to do something, and which control would change the most of the ones we would not.
When you reach for it
Alongside Governance, quarterly or before a risk committee. After a near miss. When a regulator asks.
What it asks you
5 blocks, in this order. Each one exists for a stated reason, and the run tells you that reason as you answer it.
- 01
The scenarios
One row per way something could go wrong. Assume it has already happened — the premortem framing is what licenses the pessimism that 'what could go wrong' does not.
- 02
What kind of scenario this is
The capability tag and the library class. Both are asked so the report can tell you which classes typical for your capabilities your register left out — the one completeness check available from inside a self-declared register.
- 03
Four facts and a history
No probabilities, anywhere. Nobody can estimate the annual chance of an AI incident, and a number invented here would be multiplied by another invented number to produce a score with two significant figures. These are facts about your organisation instead: how you would find out, how long that takes, how long stopping takes, and how long you have.
- 04
The controls
From the same list of fifteen the Governance module uses, so the two cannot disagree about what a control is. Asked after the timings deliberately: a respondent who lists their controls first anchors every timing to the controls they have, and the timings are the part of this instrument that has to be honest.
- 05
Who has accepted this
Proceeding is legitimate. Proceeding with a named executive and a date recorded is a different act from proceeding quietly, and this module only supports the first.
The method
How the result is produced
Every scenario is classified by one comparison: the time it would take you to find out, plus the time it would then take you to stop it, against the time you have before the harm cannot be undone. Inside the window is bounded; outside it is unbounded; no detection route at all is blind, because the sum has a term that does not exist; and inside the window on a stop nobody has exercised in six months is untested, because the figure it rests on is an estimate. Nothing is multiplied by anything and no likelihood is estimated anywhere. Controls are then ranked not by how important they sound but by how many blind or unbounded scenarios each would address, taking the binding delay — whichever of detect and stop is the larger — as the thing a control has to move. Scenarios rated C1 or C2 are collected into one summary line, because the register is not trying to be complete; it is trying to be right about the top of the list.