Practices

Five practices. One question: are the controls doing what you think they are?

Each practice answers a different failure mode. They are parallel, not sequential — nothing here needs to be bought in order.

Practice map · likelihood × impact Each of the five Rosewood practices is plotted against the likelihood and impact of the risk it addresses. Use the arrow keys to move between plotted practices, and Enter to open one.
Impact	Rare	Unlikely	Possible	Likely	Almost certain
Severe	Moderate risk, no practice plotted	Moderate risk, no practice plotted	High risk, no practice plotted	High risk, no practice plotted	SVC-02
Major	Low risk, no practice plotted	Moderate risk, no practice plotted	SVC-05	SVC-04	High risk, no practice plotted
Moderate	Low risk, no practice plotted	SVC-01	Moderate risk, no practice plotted	Moderate risk, no practice plotted	High risk, no practice plotted
Minor	Low risk, no practice plotted	Low risk, no practice plotted	SVC-03	Moderate risk, no practice plotted	Moderate risk, no practice plotted
Negligible	Low risk, no practice plotted	Low risk, no practice plotted	Low risk, no practice plotted	Low risk, no practice plotted	Moderate risk, no practice plotted

Likelihood

SVC-02 · High risk band Information security assuranceSecurity programmes, control reviews and CEH-led penetration testing.
SVC-04 · High risk band Business continuity managementRecovery strategies that have been tested, not just written.
SVC-05 · Moderate risk band Project risk managementAssurance over the technology programme while it can still change course.
SVC-01 · Moderate risk band Business system reviewsIndependent testing of the controls inside the systems you already run.
SVC-03 · Moderate risk band Technology governanceBoard-level accountability for technology risk, and the framework that carries it.

The matrix plots each practice against the likelihood and impact of the risk it addresses. It is the same instrument we hand to a board — the front page of a risk report, not a marketing device.

Detail

The five in full.

What each practice covers, and what arrives at the end of it.

SVC-01

Business system reviews

Independent testing of the controls inside the systems you already run.

Typical trigger Your auditors keep raising the same system finding and nobody has closed it.

Read SVC-01

SVC-02

Information security assurance

Security programmes, control reviews and CEH-led penetration testing.

Typical trigger You have a security policy nobody has opened since it was approved.

Read SVC-02

SVC-03

Technology governance

Board-level accountability for technology risk, and the framework that carries it.

Typical trigger The board asks about technology risk once a year and gets a status update instead of a risk position.

Read SVC-03

SVC-04

Business continuity management

Recovery strategies that have been tested, not just written.

Typical trigger Your DR plan has a version number from three years ago and has never been invoked.

Read SVC-04

SVC-05

Project risk management

Assurance over the technology programme while it can still change course.

Typical trigger You are replacing a core banking platform.

Read SVC-05

Scoping

Most engagements start with a phone call, not a proposal.

Tell us what changed — a system, a regulator, an incident, a board question — and we will say which of the five applies and what it would take.

Send an enquiry

+254 721 687846 taarifa@techrisk.co.ke