Back to Research
Risk Management Framework · White Paper
CORE©: A Better Way for Decision Making Under Uncertainty
Beyond the traditional: embedding velocity and acceleration into the risk calculation.
CORE© Continuous Opportunity and Risk Dynamics Engine A Framework for Dynamic Risk Forecasting — Introducing RiskTime.
Risk management has always asked the wrong question. Not "how uncertain is this risk?" but "how long do we have before uncertainty becomes irrelevant because the outcome is locked in?" That single shift in perspective is the starting point for CORE©.
CORE© (Continuous Opportunity and Risk Dynamics Engine) is a novel enterprise risk management framework that reconstitutes risk and time as a single, inseparable dimension — RiskTime. Traditional approaches treat risk as a static snapshot: a severity score, a likelihood estimate, a point on a heat map. CORE© treats risk as a trajectory — moving, accelerating, and operating within a causal structure that constrains what can still be done and when.
The framework draws on conformal diagram mathematics — originally developed in theoretical physics to map the complete causal structure of spacetime — and adapts them to the organisational context. The result is a unified visual and quantitative system that embeds velocity, acceleration, appetite, and decision horizons into a single coherent picture: the Clements-Causal-Opportunity-Risk-Diagram (CCORD).
CORE© is the first of three papers in the framework trilogy. Part 2 (RADAR©) extends it for probabilistic early warning detection of emerging risks. Part 3 (FORGE©) extends it for deterministic response management of crystallised risks. Both build directly on CORE's mathematical foundation without repeating it.
Validated against eight major historical crises — including Enron, the 2008 financial crisis, Boeing 737 MAX, and Silicon Valley Bank — CORE© achieves 92% accuracy in identifying escalation patterns, with early warning lead times averaging 3–6 months before traditional metrics would trigger alerts.
RiskTime: The Foundational Shift
Risk and time are not two separate columns in a register. They form a single fabric. A cybersecurity breach that could occur in five years and one that could occur next Tuesday are not the same risk at different times — they are fundamentally different events. CORE© formalises this through the RiskTime continuum, making temporal dynamics constitutive of every risk metric rather than an afterthought.
The Five Gaps CORE© Closes
Conventional enterprise risk management fails at five critical points: temporal blindness (treating risks as static); independence assumptions (ignoring correlations and cascade effects); linear thinking (missing non-linear escalation); missing system context (ignoring criticality thresholds); and detection blindness (point estimates that cannot identify emerging risks). CORE© addresses all five.
The Threat-Trajectory Score (TTS)
The mathematical engine of CORE© extends traditional Likelihood × Impact into a dynamic, four-component formula that captures velocity, amplification, information inertia, and system criticality. A cybersecurity risk that traditional methods would score 5.6 (L×I) can produce a TTS of 274 — not because the formula is inflated, but because it captures what the traditional formula ignores: how fast the risk is moving, how it compounds, and how close the system is to a tipping point. Step-by-step accuracy improvements from baseline L×I to full TTS range from 38% (adding velocity alone) to 92–97% with full calibration.
Risk-Opportunity Duality
Risk-Opportunity Duality: CORE© treats opportunity as the mathematical mirror of risk. The Opportunity-Trajectory Score (OTS) parallels TTS with critical inversions that reflect the asymmetric nature of upside vs. downside. The CCORD diagram places both sides of this duality in one visual, ensuring that every risk conversation simultaneously surfaces the opportunity dimension. A formally grounded asymmetric appetite framework provides the basis for being conservative on downside while being genuinely selective — not merely cautious — on upside.
Dynamic Risk Appetite
Dynamic Risk Appetite: In traditional frameworks, risk appetite is a static threshold that does not move unless the board explicitly updates it. In CORE©, appetite is a surface in RiskTime. A risk can breach appetite through acceleration alone — with no change to its severity score. This transforms appetite from a compliance label into a live strategic boundary.
Decision Horizons
Decision Horizons and Freedom: The CCORD diagram makes visible three decision horizons — Detection, Prevention, and Crisis — as curves within the conformal space. The distance between a risk's current position and the Prevention Horizon is a direct measure of remaining decision time. Freedom — the product of structural options and temporal window — is expressed as a single calculable number. When freedom drops, uncertainty increases. When it reaches zero, the decision has already been made for you.
A deeper look at the mechanics and methodology of the CORE© Framework.
Three-Tier Delivery: Executive Dashboard: Traffic-light TTS zones, Freedom Index gauge, Phase Alert notifications. Five-minute review for CEO, Board, and C-Level. Manager Workbench: Full TTS calculations, milestone tracking, urgency categories, and backcasting tools. Thirty-minute monthly review for VPs, department heads, and risk managers. Specialist Engine: Complete Monte Carlo ensembles, density matrix operations, conformal mapping visualisations, and parameter calibration. Continuous analysis for risk analysts, quantitative modellers, and data scientists.
The four multiplicative components are calculated sequentially:
Step 1 — Base Risk Score (L × I × V): Extends traditional likelihood-impact scoring with velocity (V = 1/Time-to-Impact). A risk with TTI of 6 months and L=0.6, I=7 produces a base score of 8.4 vs the traditional 4.2 — the velocity doubles the urgency.
Step 2 — Amplification (1 + A × exp(α·t)): Captures network cascade potential and exponential feedback. A risk with amplification coefficient A=1.5 and growth rate α=0.15 over three quarters triples in severity through cascade alone.
Step 3 — Information Inertia (1/√(1−(v/v_max)²)): Represents management commitment and stress. As risk propagation speed approaches its organisational maximum, response capability compresses non-linearly — reflecting the impossibility of outrunning a crisis that spreads faster than the organisation can respond.
Step 4 — Criticality Multiplier (1+β×(ψ/ψ_c)^γ): Captures self-organised criticality — the sandpile effect where accumulated stress causes systems to become hypersensitive to small triggers. A system at 120% of its critical threshold produces a multiplier of 4.46, not 1.25.
Directly emerging from the risk trajectory is the opportunity trajectory.The key mathematical inversions from TTS reflect asymmetric realities: difficulty dampens opportunity scores rather than amplifying them toward a singularity; readiness acts as a positive multiplier rather than a friction factor; urgency is defined by the closing of the opportunity window rather than proximity to impact.
The CCORD (Clements-Causal-Opportunity-Risk-Diagram ) replaces the traditional risk heat map in board presentations. Rather than a grid of coloured squares treating each risk as an independent, static point, the board sees trajectories with direction, speed, and mutual influence. The conversation naturally shifts from "What is the risk score?" to "Where is this risk heading?" and "How much decision time do we have?" CORE© integrates with existing enterprise systems through risk register imports, financial system feeds for impact calibration, incident management system connections for velocity data, and business intelligence dashboards for executive reporting. The framework is designed to be calibrated to specific organisational contexts and industrial sectors. Parameters (α, β, γ, ψ_c, v_max) are calibration points tuned through historical stress testing, not fixed constants. This calibration process itself generates valuable insight into the organisation's risk dynamics and decision-making patterns. The Resilience Index (measuring organisational defensive capacity) and its opportunity-side counterpart, the Strategic Momentum Index, emerge directly from the framework calculations — not as add-on assessments but as natural outputs of the quantitative model. Risk culture, in terms of decision inertia, becomes transparent and measurable.
What practitioners and organisations should take away from this research. CORE© provides a unified mathematical foundation that addresses fundamental questions traditional risk management has been unable to resolve. The key conclusions are:
RiskTime is not a metaphor — it is the correct geometry for enterprise risk. Risks do not have a severity and a time. They have a position in RiskTime, and that position determines everything: urgency, appetite breach, freedom, and causal reach. Dynamic appetite replaces static thresholds. A risk can breach appetite through acceleration alone, without any change to its severity score. Appetite discussions become forward-looking: "This risk's TTS is currently 12 against our horizon of 16.67, but its acceleration means it will breach within two months." Decision horizons make the question "How much time do we have?" answerable with precision. The CCORD diagram shows not just whether a risk exceeds appetite but whether there is still time to prevent it from doing so. The symmetry between TTS and OTS ensures that risk management and strategy are not separate activities. Every downside assessment simultaneously surfaces the upside dimension. The asymmetric appetite framework provides quantitative — not merely rhetorical — support for being conservative on downside risk while being selective on upside opportunity.
CORE© is the starting point for a fundamentally different kind of conversation between risk managers and decision makers: not "What is the risk score?" but "Where is this risk heading, how fast is it moving, how much time remains, and what freedom of action exists?"