Skip to content
Centriu
Centriu Oracle

Risk Formulation and Classification Quality Automation: A Vague Risk Never Makes It Into the Register

"The project might be delayed" feels like a risk statement, but it names nothing a team could actually act on: not why it might happen, not what specifically would occur, not what it would cost. Centriu Oracle checks every risk statement for three required parts — a cause, an uncertain event, and a consequence — and separately scans the text against seven specific vague phrasings the methodology names as inadequate on sight (including that exact delay example) plus three patterns that blame a person or team instead of describing a verifiable condition. A second, independent check reads the same text for tense and modality: something written in the present tense ("is already happening") gets redirected toward the diagnosis as a current problem, an assumption gets redirected toward the plan's stated premises, a known budget ceiling gets redirected toward constraints, and a "depends on" statement gets redirected toward dependencies — because a future risk register that quietly fills up with present-tense problems and unstated assumptions stops being a reliable picture of what could still go wrong.
A problem is never filed as a risk
Cause, event and consequence required
Team collaborating around a table with a laptop
A vague risk never makes it into the register.

Why a risk register quietly fills with things that are not risks

A risk register invites whatever a consultant is worried about at the moment they open it, and under that pressure, three different kinds of entries tend to blur together: a genuine future uncertainty, a problem that is already happening today, and an assumption being quietly treated as a fact. Each of those needs a different response — a risk needs a probability and a contingency, a current problem needs the diagnosis and an immediate fix, an assumption needs to be tested before it is relied on — but nothing about a blank text field stops them from landing in the same list, worded the same way, with the same apparent urgency.

How the underlying problem shows up before you fix it

A risk statement reads "the project might be delayed" or "sales could drop" — technically about the future, but naming no cause, no specific event, and no consequence anyone could plan around.

A statement that is really a current problem ("we are already losing three days per approval cycle") gets logged as a future risk, and the diagnosis that should own it never sees it.

A stated assumption ("assuming the client approves within a week") gets treated as a settled fact rather than a premise someone should be actively watching.

A risk description quietly blames a person or team ("the team lacks the will to deliver on time") instead of describing an observable, verifiable condition anyone else could check.

A probability gets rated "very high" or "imminent" in a client-facing document with no stated reason anyone could point to if challenged in the room.

Why formulation quality rarely gets checked in the moment

Distinguishing a risk from a problem, an assumption, or a blame statement requires reading for tense and intent, not just topic — a discipline that is easy to state as a principle and easy to skip under the pressure of writing something down quickly during or right after a client meeting. And a probability rating typically gets chosen by feel in the moment, with no separate step forcing anyone to write down where that number actually came from before it goes into a client-facing register.

How Centriu Oracle checks formulation and redirects misclassified entries

Every risk statement is assessed against three required components — a cause ("why might this happen"), an uncertain event ("what exactly could occur"), and a consequence ("what does it cause, and to whom") — each needing a minimum length before it counts as present; missing all three scores the statement "vague," missing some scores it "partial," and only a statement with a genuine cause, event and consequence scores "adequate." Separately, the exact text is checked against seven specific vague-phrasing patterns named as inadequate on sight — including the literal "the project might be delayed" example — and three patterns that attribute incompetence, blame, or unwillingness to a person or team rather than describing a condition anyone could independently verify. A second, independent classifier reads the same text for tense and modality markers: present-tense language ("is already happening," "has been since [month]," "recurringly") redirects the entry toward the diagnosis as a current problem instead of a future risk; "we don't know" or "it's unclear" language redirects it toward critical uncertainties; "assuming that" language redirects it toward the plan's stated premises; a declared budget ceiling or hard limit redirects it toward constraints; and "depends on" language redirects it toward dependencies — each redirect naming exactly where the entry actually belongs and why, not simply rejecting it. On the numbers side, any probability rated above "moderate" is silently capped back down to "moderate" unless a declared basis exists — a named source, a rationale of real length, linked evidence, or a linked anticipatory signal — and "imminent," the single strongest rating on the scale, specifically requires an observed signal, downgrading to "very high" without one. Every financial or numeric estimate is checked for a stated formula, source, assumptions, time period, and limitations, and a single point value with no declared low-high range is flagged and automatically presented with an explicit hedge rather than as a bare number.

What is actually built today

A three-part formulation check (cause, uncertain event, consequence) that scores every risk statement vague, partial, or adequate — confirmed running live as the consultant types in the risk-creation dialog, not only on final submission.

Seven named vague-phrasing patterns and three blame-attribution patterns checked verbatim against the risk text, matching the exact inadequate examples the underlying methodology calls out by name.

A deterministic tense-and-modality classifier that redirects a present-tense problem, an information gap, an assumption, a known constraint, or a dependency away from the risk register and toward its correct destination — with a stated reason for every redirect.

A probability-basis requirement: any rating above "moderate" is capped back to "moderate" without a declared source, rationale, evidence, or signal — and "imminent" specifically requires an observed signal.

A mandatory five-part structure on every numeric estimate (formula, source, assumptions, period, limitations), with a missing low-high range automatically flagged and hedged in the generated presentation text rather than shown as a bare, precise-looking number.

The same classification logic runs identically server-side on save and client-side in the creation dialog — a consultant sees the same verdict while typing that the server would enforce on submission, confirmed in both `risk-create-dialog.tsx` and `saveRisk()`.

Per-organization access control on every risk read and write.

One sentence, three different destinations (illustrative scenario, not a real client)

A consultant types three notes in a row during a client call. The first — "sales could drop if the main competitor launches a promotion, cutting this quarter's revenue by a meaningful margin" — is accepted as a well-formed risk: it names a cause (a competitor promotion), an uncertain event (a sales drop), and a consequence (reduced quarterly revenue). The second — "we are already losing about three days per approval cycle" — is flagged by the tense classifier as a present-tense problem, not a future risk, and redirected toward the diagnosis with an explanation of why. The third — "assuming the new pricing page ships by month-end" — is redirected toward the plan's premises, because it describes a condition being assumed true for planning purposes, not something uncertain that might occur.

What changes operationally

A risk register stops silently absorbing present-tense problems, untested assumptions, and vague worry statements that nobody could actually act on. A probability rating carries a stated, checkable reason instead of sitting on a feeling, especially at the top of the scale, where the language gets used to justify the most urgent client conversations. And a numeric estimate is never handed to a client dressed up as more precise than the data behind it actually supports.

When this is not the right fit

A team that wants a completely freeform notes list, with no structure enforced on how a worry gets written down, will find this formulation gate adds friction rather than value — it is built specifically for a consultant maintaining a formal, client-facing risk register, not a scratch pad for unstructured brainstorming.

A freeform worry list vs. a formulation-and-classification gate

A freeform list accepts whatever gets typed, so a present-tense problem, an untested assumption, and a genuinely vague worry all sit indistinguishably next to a well-formed risk. Centriu Oracle's formulation gate instead checks the actual structure and tense of every entry before it settles into the register, redirecting anything that is not really a future risk to where it actually belongs, and specifically naming the vague or blame-based phrasings the methodology considers inadequate on sight.

Related systems

Main system: Centriu Oracle.

What it does NOT do

  • Does not use a language model to judge whether a statement is vague or well-formed — every check is a deterministic pattern match and length check against declared rules, confirmed as pure, testable functions with no AI call anywhere in the assessment path.
  • Does not silently reject or delete a poorly formed entry — a vague or misclassified statement is still saved, scored, and shown what is missing, so a consultant never loses what they wrote in the middle of a client call.
  • Does not decide a probability rating on its own — a person always chooses the rating; the tool only caps an unsupported rating back down and states why, it never raises one.
  • Does not treat a redirect as final or irreversible — a consultant can still register something as a risk after seeing the classifier's suggestion; the tool flags and explains, it does not block.
  • Does not expose one organization's risk register to another — every read and write is checked against the acting user's actual organization membership first.

Security and governance

Every organization using Centriu Oracle sees only its own projects and risk registers; access is scoped by organization membership and re-checked on every write. Personal data follows Brazil's LGPD (Law No. 13,709/2018). Full detail on access control lives at /governanca.

Pricing and contracting

Available by monthly subscription, with tiered plans. Values and terms come from the official pricing table at /precos (Centriu's central source — never restated here).

Frequently asked questions

What three parts does a risk statement need?

A cause (why it might happen), an uncertain event (what exactly could occur), and a consequence (what it causes, and to whom). Missing all three scores the statement "vague"; missing some scores it "partial."

Does the tool reject a badly written risk?

No. It still saves the entry, scores its quality, and explains what is missing or which vague/blame pattern was matched — it never silently drops what a consultant wrote.

What happens if I describe something that is already happening as a future risk?

A tense-and-modality classifier reads for present-tense language and redirects the entry toward the diagnosis as a current problem, explaining why, rather than leaving it misclassified in the risk register.

Can a probability be rated "imminent" without evidence?

No. "Imminent" specifically requires at least one recorded anticipatory signal; without one, the rating is automatically downgraded to "very high" with a stated reason.

What happens to a financial estimate with no range, only a single number?

It is flagged with a specific alert and automatically presented with a hedge in the generated text — a bare number without formula, source, or a low-high range is never shown as if it were a guaranteed value.

What does Centriu Oracle cost?

It is sold by subscription with a published starting price — exact current values are on the central pricing page.

See how Centriu Oracle checks risk formulation quality

Reach our commercial team directly, or leave your details below — we'll follow up with guidance for your case.

Sources

  1. Centriu Oracle — public product page — Centriu, 2026-07-20 · link(primária)
  2. Centriu Oracle — public factsheet (API, JSON) — Centriu, 2026-07-21 · link
  3. Law No. 13,709/2018 — Brazil’s General Data Protection Law (LGPD) — Presidência da República (Brazil), 2018-08-14 · link

Last material update on .

By · AI-assisted production, with human review