The honest picture of what your risks rest on.
CAM, the Control Architecture Matrix, sits at the centre of Control-Focused Risk Management. It moves the focus from everything that might happen to the controls you own, and turns a risk register into a clear view of the protection you can rely on, and the protection you're only assuming.
Same rating. Very different protection.
Two risks can carry the same rating and be protected in completely different ways. CAM places every control in one of four quadrants, so you can see how each risk is really held.
Every organisation needs all four. What matters is the balance, and whether it matches the confidence in your risk ratings.
Much of what's sold as resilience, including business continuity, is about recovering well. CAM shows how much of your protection only starts once something has already gone wrong.
Rated as controlled. Resting on people and paper.
What a large Australian organisation's risks were really resting on.
of the controls relied on people getting it right, or only kicked in after something had gone wrong.
Yet these risks were rated down by half, from Extreme and High to Moderate, for "effective controls".
of the controls depended on people, or on picking up the pieces afterwards.
Yet the risk was rated down by a quarter for "effective controls".
The organisation thought it was protected. CAM showed just how exposed it was.
“The observable footprint of an organisation's cultural maturity is not what its people say. It is what its people have built.”
Brendan May, creator of CAM
Answers a board can act on.
CAM changes the question from "how big is this risk?" to "what is actually stopping it, and will that work?"
- What each critical risk depends onNot everything ever written against a risk, but the controls it really rests on.
- How much relies on people getting it rightWhere protection depends on someone remembering, noticing or choosing correctly every time.
- Where you think you are, and where you areThe gap between recorded protection and reliable protection, set out plainly.
- Where to invest nextThe changes that make the biggest difference, so spending follows protection rather than activity.
One picture, read at every level.
Confidence you can test
Information that supports your due diligence: what your critical risks rest on, and whether you should be satisfied with it.
Decisions, not dashboards
Clear choices about where to invest, what to accept and what to fix, framed by the protection they buy.
A method, not a template
A practical way to look at controls with the people who do the work.
From learning it to owning it.
Start small. Each step counts towards the next, and most of it is delivered live online.
- CAM Online The core ideas, at your own pace. $250 AUD. Coming soon.
- CAM Introduction: The Matrix Two hours, live online, with people from across industries. Includes CAM Online to take home.
- Control Architecture Series Six live online sessions, from reading your controls to reporting the gap, then applying it to your own documents.
- Licensed delivery Train your own people to deliver CAM, so the capability stays in your organisation.
Want any of it run for your own team? Book a call and we'll run it in-house.
CAM shows where you stand. The programs build from there.
Common questions
Does CAM replace our risk matrix?
No. But once you see what CAM shows, you'll find it's CAM you turn to when decisions need making. Your matrix stays, because registers, insurers and certifications still need it, and CAM sits alongside it with a much better picture of the controls behind each rating.
Isn't this taking people out of the picture?
The opposite. Asking people to get it right every time, under pressure, is what puts them at risk. CAM finds where protection depends on no one ever slipping, so it can be built in instead. That frees the attention people spend holding controls together, for their core work and for noticing and speaking up when something isn't right. Real human-centred risk management is about protecting people, not focusing on them.
Is this a safety program?
No. CAM works across risk domains: operational, strategic, financial, people and safety. Safety did much of the hard thinking on controls decades ago; Control-Focused Risk Management brings it to the whole organisation.
Can we run it ourselves?
Yes, that is the aim. Your people learn CAM through the Introduction and the Series, then apply it to your own documents. With licensed delivery, your own trainers can teach it from then on.
Is it online or in person?
Mostly live online, in sessions of up to two hours, so people can join from anywhere. In-house sessions can also run in a room.
See what your risks really rest on.
Start with a 20-minute conversation.