The Framework

IRIS

A strategic risk intelligence framework built for synthesis, not just risk detection and reporting, for organizations whose risks don't respect the boundaries between security, operations, and enterprise risk.

Looking for the Practitioner's Guide? See the editions ↓

Start Here

IRIS: One-Page Overview

The framework's two mandates, its theoretical foundation, and where it sits relative to the enterprise risk register, on a single page.

The Problem

Most risk registers only catch what's already been named.

Across the risk domains, the languages aren't the same, the platforms in use are different, and performance metrics and risk assessment methodologies are different. And yet everything gets catalogued in a register and considered managed. But what about what isn't named?

A transboundary risk, per Blondin & Boin's framework for transboundary crisis cooperation, is one whose defining characteristic is its potential to cross functional, institutional, and policy boundaries in a way that cannot be fully assessed, owned, or resolved by any one risk domain: security, legal, financial, geopolitical, operational, or otherwise. The risk's cause, its consequences, or its path to escalation cross the boundaries that separate how those domains define, measure, and report risk. The deciding factor is not which domain the risk originates in. It's whether the risk's trajectory outpaces the institutional capacity of any single owner to see it, define it, or act on it in time.

The Shadow Layer

At the core of IRIS are two functions: discovering undetected or unexplored cross-domain risks that don't fit neatly into existing categories, and auditing existing register entries for misdefinition, not just staleness.

Led by a team of interdisciplinary professionals with relevant domain experience, the IRIS functional layer operates beneath the formal risk register. This layer draws on a boundary framework (transfer, translate, transform) to move risk signal across the divides that typically separate security, risk, and operational teams.

Academic Grounding

"IRIS represents a rare and welcome application of rigorous boundary-crossing theory to real-world enterprise risk intelligence practice. Jay has identified the key insight: mistaking a pragmatic boundary for a syntactic one is costly, but mistaking a syntactic boundary for a pragmatic one can be fatal to an organization. IRIS translates that diagnostic power into the hard, sustained work of building the organizational architecture to address it."

Prof. Paul Carlile
Senior Associate Dean, Research & Innovation, Boston University Questrom School of Business

In Practice

Synthesis, not just detection.

IRIS sits downstream of an organization's existing intake and domain-level triage, synthesizing across domains after they've each done their risk assessment and reporting, so nothing that crosses a boundary gets lost in the handoff.

Discovery

Surface the unnamed

Cross-domain risks that don't fit any single team's register.

Audit

Test what's already there

Translation

Cross the boundary

Signal carried across the syntactic, semantic, and pragmatic divides between teams.

Go Deeper

The IRIS Practitioner's Guide

The IRIS methodology, written for where you sit. Each edition applies the same framework to a different seat: the executive who can build a cross-domain function, and the leader who owns one risk domain and works at its edges.

Flagship

Executive Edition

For decision-makers with budget authority: the full methodology, staffing architecture, and six composite case studies. Ten core sections, plus appendices covering the interview process, an analyst scorecard, a glossary, and the framework's theoretical foundation.

Read the one-page primer first →

$199

Buy →

New

Risk Domain Owner Edition

For the CISO, CSO, Head of Supply Chain, Chief Compliance Officer, or senior ERM leader. Examine your own domain's evidence, map where it meets the others, name its limits, and make a one-page escalation brief land. Eleven sections, seven field notes from practice, a self-assessment, and a 90-day plan, all built to work inside the authority you already hold.

Read the one-page primer first →

$149

Buy →

Practitioner and Small Business editions are in development.

Free Reading

The IRIS essays.

Standalone essays on the framework and where risk intelligence is headed. Free to download, no signup required.

Part 1 of 3

Enterprise Risk Was Built Within a Constraint That's Lifting

Why enterprise risk integration has stalled for a generation, and the structural constraint behind it. Download →

Part 2 of 3

One Constraint Lifts. Another Endures.

AI is closing the old constraint, but a deeper one, organizational architecture, remains. Download →

PDF · Free · Part 3 of 3

What It Takes to Lift the Enduring Constraint

What the new synthesis function must be capable of, and what the organization has to provide. Download →

More essays and regular writing on the Resources page.