DAYS 01–03
Intake & document review
Review the AI policy environment, model and use-case inventory, vendor agreements, prior incidents or near misses, and risk-committee terms of reference.
AI GOVERNANCE & DECISION SUPPORT / FIXED-SCOPE DIAGNOSTIC
The Institutional Crisis
Compass Diagnostic.
A fixed-scope, three-week AI governance exposure assessment that gives your board a defensible answer before failure becomes consequence.
For boards, general counsel, risk leaders, and executive teams in banking, insurance, energy, utilities, telecom, and other high-consequence institutions.
ASSESSMENT OUTPUTA defensible view
A defensible view
of institutional exposure.
The Diagnostic returns a board-ready view of the five decision domains: governance, technical controls, third-party exposure, incident readiness, and board visibility—alongside clear priorities and accountable next actions.
01 / Governance & decision rights
02 / Technical controls
03 / Third-party exposure
04 / Incident readiness
05 / Board visibility
THE BOARD QUESTION
Most institutions can describe what their AI systems do. Few can tell their board what happens when one fails.
The ICC Diagnostic is a fixed-scope assessment designed to turn an abstract AI governance conversation into a visible institutional exposure picture, clear decision rights, and a prioritized action plan. It is not a generic maturity-model exercise. It is a board-facing review of what your institution can defend under pressure.
THE THREE-WEEK SCOPE
A defined engagement.
A decision-grade output.
DAYS 03–10
Structured stakeholder interviews
Conduct five to eight structured conversations with the leaders who carry the decision: board, executive, legal, technology, security, and AI-deployment owners.
DAYS 08–14
ICC scoring
Apply the Institutional Crisis Compass across governance, controls, third parties, incident readiness, and board visibility—where AI risk becomes institutional consequence.
DAYS 14–18
Board-ready written report
Deliver a concise board-ready report: exposure heat map, sector context, and five to seven prioritized recommendations tied to practical remediation effort.
DAYS 19–21
Live board or executive session
Present the assessment in a 90-minute board or executive session, clarifying decision rights, action owners, and the next control cadence.
THE ICC LENS
Where AI risk becomes
institutional exposure.
Governance structure
Can the institution show who approves, challenges, pauses, overrides, and accepts residual AI risk?
Technical controls
Do policy, testing, monitoring, and escalation create an operating control record—not a paper program?
Vendor / third-party exposure
Where do models, vendors, data, cloud, access, and concentration risk create dependencies outside the institution’s control?
Incident-response readiness
What happens when a system fails, a vendor changes terms, a regulator asks, or an AI-enabled event reaches the board?
Board visibility
Can directors see the exposure clearly enough to exercise informed oversight before the decision window closes?
THE DECISION TO BUY
No open-ended retainer.
No hourly ambiguity.
The scope is intentionally fixed so a board chair, general counsel, or executive sponsor can approve a serious diagnostic without beginning a broad consulting procurement process.
- Five to eight structured stakeholder conversations
- Board-ready written assessment and exposure heat map
- Five to seven prioritized actions linked to control effort
- 90-minute board or executive findings session
THE CONTINUITY OPTION
The diagnostic is
the beginning, not the binder.
OPTIONAL / COMPASS MONITOR
For institutions that need continuing board visibility, the Compass Monitor provides a quarterly re-score and a standing line for board questions between cycles.
$3,000/monthQUARTERLY RE-SCORE / BOARD-QUESTION ACCESS / EVOLVING CONTROL RECORD
KHAOS HOLDINGS / INSTITUTIONAL CRISIS COMPASS
Three weeks to give the board
a defensible answer.
REQUEST A SCOPING CONVERSATION The Institutional Crisis Compass Diagnostic provides advisory and decision support. It is not legal advice, a compliance certification, or a substitute for an institution’s own legal, regulatory, security, or risk obligations.
REQUEST A SCOPING CONVERSATION
Start with the decision
that cannot wait.
Share the institution, the question, and a few times that work. Khaos will review the request and respond directly to arrange the right conversation.