A 1:1 · a risk function of one or two

A whole department's job.
A team of one or two.

Everything that lands on your desk
📊 Risk register — review overdue 🔍 Internal audit — findings open 📄 Board pack — due Friday ⚖️ CPS 230 evidence 🗂️ Delegations — out of date 🛡️ Continuity plan — where is it? ✉️ Regulator query — waiting
all of it, every cycle — and it still has to arrive board-ready
The risk function
1–2
people carrying all of it
↓
This hour
How much of it the platform can carry — so you get the time back.
Certe
01
The bind you're in

Regulated like a big institution.
Resourced like a small one.

  • The obligations are written for organisations ten times the size.
  • The tooling built for those organisations is priced and administered for them too.
  • So the actual system of record defaults to spreadsheets and Word documents.
  • The transition periods have ended. The load is live — and all of it lands on you.
regulatory / board obligation → internal governance capacity → mutual banks small super funds small insurers aged care providers NDIS providers charities / NFPs you are here where enterprise GRC tools are aimed
APRA CPS 230 — non-SFI transition ended 1 July 2026 ACNC Governance Standards Aged care — strengthened standards swap to the regulator in the room
Certe
02
The frame

Four board questions.
Every one of them, on you.

The questions every board asks: What are our risks? · Are the actions getting done? · Who can approve what? · Are we ready for disruption? One module answers each.
What are our risks?RISK
Are the actions getting done?ACTIONS
Who can approve what?DELEGATIONS
Are we ready for disruption?CONTINUITY
Dashboard & Board Reporting
Five ways it takes the load
1. Dual ratings — inherent and residual, with control effectiveness.
2. Ownership trails — owners, due dates, slippage on the record.
3. Continuity you can action in minutes, not find in a drawer.
4. Snapshots — point-in-time evidence an auditor can rely on.
5. What's under the hood — hosting, security, data export, admin overhead.
Two things you'd want anyway on the way through: who can approve what · the AI's controls.
Certe
03
1
Dual ratings

Every risk rated twice — and the controls rated too.

  • Inherent rating, then residual after controls — auto-calculated across up to five measure areas; the highest combination governs.
  • Controls typed — policy, process, resource, assurance — each with a reviewed flag and an effectiveness rating.
  • The 5×5 matrix is yours: your consequence definitions, your likelihood scale, per measure area.
  • Lifecycle status on every risk: identified → analysed → evaluated → treated — and treatments for what remains, each with an owner, status and completion %.
Certe risk chart — layered inherent and residual rating cards
back layer inherent VERY HIGH →
front residual HIGH after controls
Certe board report crop — register rows with inherent and residual score chips
↳ both scores on the register — inherent beside residual, straight into the board report
Certe
04
2
Ownership trails

Ownership you can interrogate.

  • Actions from any source — internal audit, external audit, prudential review, board — recorded in one typed, dated inventory.
  • Owner, due date, and revised due date. When a date moves, both dates stay on the record.
  • Timestamped notes against each action — the why travels with the what.
  • Completion at a glance; updated in the meeting, not reconstructed after it.
Certe action management — detailed view with revised due date on the record
slippage is data, not embarrassment —
original 15/08 · revised 12/09, both preserved
the why travels with the action —
notes shown live in the demo
Certe
05
Detour · Who can approve what

Authority on the record — and auditable by role.

  • A searchable delegations manual, not a policy PDF nobody opens.
  • Graduated value thresholds per item — explicit ladders, explicit limits.
  • Pivot by authority: everything the board has reserved, or the CEO holds, on one page.
  • When the person who “just knows” leaves, the knowledge stays.
Certe delegations manual — graduated authority ladder and three-view tab strip
three views — Main · Category · Authorities (pivot by role):
the view an auditor asks for first — shown live in the demo
$50K → $250K → $1M →
Board: Unlimited
Certe
06
3
Continuity

A live continuity system, not scattered plans on paper.

  • A plan you can act on in minutes.
  • Every critical function: responsible person, impact level, the maximum outage you can tolerate, instructions, contingency, contacts.
  • Cloud-hosted — independent of your own infrastructure, reachable from any connected laptop or tablet — and exportable to PDF/ZIP for an offline copy.
  • Share read-only with an auditor or regulator: domain-restricted, PIN-verified, revocable.
Certe continuity visual view — colour-coded critical function cards with responsible person, impact and MAO
payments down? responsible · impact ·
MAO < 4 hours — one card, one click
Certe share modal crop — domain-restricted read-only guest access
share read-only — auditor access shown live in the demo
Telstra — 8 July 2026Optus — 2023CrowdStrike — 2024 A plan you can't access or action in minutes isn't a plan.
Certe
07
Detour · The AI's controls

The AI is reviewable, optional, and switchable off at the server.

Certe Fill out with AI modal — organisation profile the AI draws from, with Edit details and Generate
the profile the AI draws from —
visible and editable before anything generates
Three layers of control, in order
1 · Per suggestion: every AI proposal sits behind an explicit accept / edit / reject step. Nothing is saved unreviewed.
2 · Per organisation: one owner-controlled switch. Off blocks AI at the server, not just in the interface.
3 · Platform-wide: a kill switch above that, held by us.
Grounded by design: generation is blocked until the organisation profile it draws from is completed.
What it does today: drafts continuity structure and narratives from an org profile you can see and edit.
Where it stops: Continuity module only. Anything further is roadmap, not shipped.
Whose it is: All Certe AI is in-house and on-prem — Certe's own models on Certe's own infrastructure. No third-party AI services.*
* On-premises deployment of Certe — including its AI services — is available for client organisations.
Certe
08
4
Evidence, not spreadsheets

Point-in-time evidence: what the board saw, when it saw it.

  • Named, attributed snapshots freeze the record: “Q2 2026 Board Meeting” — saved by, dated.
  • Historical versions open read-only.
  • Reports — seven types, including Control Effectiveness — generate from any historical snapshot: evidence for internal audit and regulator review, not reconstruction from emails.
  • Board packs export branded and dated, straight from live data. Per-document access extends to individual directors.
Certe snapshots — named point-in-time versions with saved-by attribution and dates
↳ named, attributed, dated — saved by Sarah Chen · 30/06/2026
→
reports generate from any snapshot
Certe board report — branded cover and risk register page generated from a snapshot
Certe
09
5
Under the hood

Under the hood: straight answers — including what's not there.

⬢

Access

Org-enforceable MFA. Per-document viewer / collaborator permissions.

◇

External access

Guest links token-gated, revocable; domain-restricted with one-time PIN.

▤

Data export

Branded PDF from every module; continuity plan plus attachments as one ZIP; reports from any snapshot.2

◆

Admin overhead

Browser-based, nothing to install or host; runs on a risk function of one or two.

✦

Hosting & residency provided in writing

Answered precisely, in writing — cybersecurity & technical disclosure available upon request.1

—

Not there today

No public API or third-party integrations.

¹ Hosted on AWS in Sydney (ap-southeast-2) — encryption at rest, daily encrypted backups, and high availability with replication across data centres. Cybersecurity and technical disclosure is available upon request — or visit certe.net.au for more information.  ² Data is retained as per Australian cybersecurity standards and remains available for ejection or export at the organisation's request — including after the subscription ends. Guest links apply to continuity plans; other documents are shared by inviting read-only viewers.
Certe
10
The honest ledger

Shipped, roadmap, known limits — before you find them.

Shipped and verified
✓ dual inherent/residual ratings with control effectiveness
✓ named snapshots with reporting from history
✓ action sources, owners, revised due dates
✓ authorities pivot
✓ one-click continuity plans with MAO
✓ AI drafting in Continuity behind three control layers — all AI in-house and on-prem.*
✓ organisation-enforceable MFA
✓ domain-restricted guest shares
Roadmap, stated as roadmap
→ AI beyond Continuity
→ pre-configured sector standard editions (the concept we're shaping for teams like yours)
Known limits, before you find them
– owners and responsible persons are free-text roles, not linked user accounts — deliberate for small teams, but no system-enforced accountability yet
– no automated reminders or approval workflows
– no public API
– desktop and tablet only
Built on the founder's 35+ years of governance consulting (Wyndarra) to boards of small regulated organisations. Enterprise-grade governance at small-entity pricing — current pricing at certe.net.au/pricing1.
* On-premises deployment of Certe — including its AI services — is available for client organisations.  ¹ Enterprise pricing options are available, with special exceptions for small organisations, charities and not-for-profits.
Certe
11
The idea

The standard the sector needs.

A standard edition for the small end of the sector — so you populate, not build. What it gets right out of the box:
Loaded, not blank — the register categories, continuity templates and delegation ladders a small entity actually needs, ready on day one.
A board pack that assembles itself — covers, dates and snapshots, straight from live data.
Pricing structured for small entities — including collective procurement.
Built for exactly your seat — one or two people, a department's worth of obligations. No endorsement asked, no name used without written consent.
RISK ✓
ACTIONS ✓
DELEGATIONS ✓
CONTINUITY ✓
Dual ratings
Ownership trails
Continuity in minutes
Snapshots
Under the hood
the load, carried.
Risk
Snapshots
Certe
12
← → navigate · N notes · P print · Esc menu
Speaker notes