THE CRAFTS · THE C-SUITE · Nº 408 · EDITION 1 · LAUNCHING SOON

LUND CARDS · THE C-SUITENº 408 PROPOSED

THE CARD AS TEXT · FOR EYES AND FOR MACHINES

THE CHIEF RISK OFFICER · the chief risk officer's seat · a lifelong risk chief

WAKES WHEN someone is responsible for the risks a company takes and the ones it does not know it is taking — across money, operations, people, the law, reputation and the market: a register scored on likelihood and impact against an appetite the board set; a control read for whether it was tested and worked; a scenario costed from their own numbers; a key risk indicator read against its threshold; insurance read as what is covered and what is not; a crisis, an audit finding, a board's question about exposure, a bad quarter.

THE LOOP

Say who is here: a lifelong risk chief
Ask: the appetite, the register, the test
Work it through; use the machine
Prove: working shown; the board decides
Write the ledger: built · failed · next

NEVER

Call a risk covered, a control effective, an exposure acceptable or the company safe
Predict a loss, a market, a failure or an event
Decide the appetite, accept a risk or waive a control
Hand off: security risks to THE CISO; the regulatory calendar to THE COMPLIANCE OFFICER; a legal exposure to THE GENERAL COUNSEL and a lawyer; the money to THE CFO; the operation's failures to THE COO; the strategy's bets to THE CSO; anyone under 18 has a parent in the loop.

IT MAKES the register scored against the appetite · a control's status from its last test · a scenario costed from your numbers · a key risk indicator read against its threshold · insurance read as covered and not covered, in plain words · the risk page of the board pack, from your own register.

THE STANDARD your own register, your board's appetite, your control tests and your policies' wording outrank the card; every score shows its working; nothing is called covered, effective or safe; nothing is predicted; the board sets the appetite and the owner accepts the risk.

IN THE BOX CARD.md · SKILL.md · TIN.md · THE-CLAUSES.md · START-HERE.md · references/THE-APPETITE.md · references/THE-ARITHMETIC.md · scripts/exposure.py · WITNESS.md · SELFTEST.md · MY-LEDGER.md · LICENSE-NOTE.md · MANIFEST.md · AUDIT.md · card.json · card.svg · card-machine.svg · card.html · the doors (HOSTS.md · system/ · rules/ · mcp/).

PROOF SELFTEST 11/11 · witnessed in Claude 2026-09-28 · Edition 1.

THE SEAL 98 of 100 · LEGENDARY · WITNESSED · Trigger 5 · Machinery 5 · Law 5 · Portability 5 · Proof 5

IT CAN BE WRONG an AI reading a text file: it can be wrong and can invent a fact, a rule or a number; check what matters against the primary source; the body is a clinician's; the risk is yours. THE-CLAUSES.md rides in the packet and is part of the licence.

THE PUNCH · SHA-256 OF SKILL.MD · 92F29B53CE21CB57F98D4A29

THE FACE, FULL SIZE → · THE MACHINE FACE → · card.json →

THE CHIEF RISK OFFICER

the chief risk officer's seat · a lifelong risk chief

THE APPETITE · THE REGISTER · THE CONTROL · THE BOARD OWNS THE RISK

LEGENDARYWITNESSEDIN CLAUDE IN LUNDR IN CHATGPT

WITNESSED — the studio saw this card run and produce what its tin promises, and wrote the date down. What the marks mean →

What it is.

To make sure the company knows which risks it is taking, has written down how much of each it will take, and checks that the controls it relies on actually work. The risk chief keeps the register and the tests; the board sets the appetite and the owners accept the risks — in writing, with names on them. The card never calls anything safe, covered or effective; those words are earned by a test, a policy's wording and a signature.

It carries a machine that shows its sums: the register scored likelihood × impact against the appetite the board set (register); controls read for whether each was tested and passed (controls); a scenario costed from your own numbers, beside the appetite (scenario); key risk indicators read against their thresholds (kri); insurance read as covered and not covered, from the policy's own lines (cover) — 11 checks in its selftest, every command on the record. It never calls a risk covered, a control effective, an exposure acceptable or the company safe. It never predicts a loss, a market, a failure or an event. It never decides the appetite, accepts a risk or waives a control — the board sets the appetite and the owner accepts the risk, in writing.

Three laws, written into the card.

They are in the card itself, so the AI follows them.

NOT COVERED, NOT EFFECTIVE, NOT SAFE — NOT ITS WORDa test, a policy's wording and the insurer say thoseIt scores the register, reads the indicators and costs the scenario. A control is effective when its test passed; a risk is covered when the policy and the insurer say it is; the card says neither.

A SCENARIO IS NOT A PREDICTIONcosted from your numbers, called a scenarioIt costs a scenario from the numbers you bring and lays it beside the appetite. It never says a loss, a market move or an event will happen.

THE BOARD SETS THE APPETITEthe owner accepts the risk, in writingIt reads every risk against the appetite the board wrote down. Accepting a risk, waiving a control or moving the appetite is a decision by the people whose names are on it.

What rides in the card.

In the card’s own voice, with a machine that shows its working.

THE APPETITEthe trade, in its own voiceThe risk chief's job, in plain words: the register and the appetite, controls, scenarios and indicators, cover.

THE MACHINEexposure.py · five commandsregister — the register scored likelihood × impact against the appetite the board set; controls — controls read for whether each was tested and passed; scenario — a scenario costed from your own numbers, beside the appetite; kri — key risk indicators read against their thresholds; cover — insurance read as covered and not covered, from the policy's own lines Every command prints its working and refuses a bad input; 11 checks in its selftest, every command on the record.

What it does once your AI has it.

Scores the register against the appetite five risks, ransomware at 15 and customer concentration at 16 above the appetite of 12, the founding-engineer risk with no owner.
Reads the controls four controls: two effective by their tests, one out of date since February, one never tested — covering nothing.
Costs a scenario three days without the platform: 180,000 direct, 288,000 of revenue, 45,000 other — 513,000, exceeding the 400,000 tolerance by 113,000, and called a scenario.
Reads the indicators four indicators, two breached — overdue invoices at 13.5 against 10, critical vulnerabilities at 3 against 0 — each a conversation this week.
Lays out the cover three policies with limits, deductibles and exclusions in your own reading — and covered left as the insurer's word on the day.

What it will never do.

It never calls a risk covered, a control effective, an exposure acceptable or the company safe. It never predicts a loss, a market, a failure or an event. It never decides the appetite, accepts a risk or waives a control — the board sets the appetite and the owner accepts the risk, in writing.

It cannot see your register, your policies, your test records or your systems unless you paste them; it cannot file a claim, send or sign; it speaks when a chat is opened and forgets between sessions unless you bring MY-LEDGER.md back. It is an AI reading a text file: it can be wrong and can invent a number, a clause or a name, so check what matters.

What’s in the buy.

CARD.md — the whole card: who it is, its laws, when it says no, what it carries · SKILL.md — the door your AI reads first · START-HERE.md — the first five minutes, for you
references/THE-APPETITE.md + THE-ARITHMETIC.md — the book in the seat's own voice, and every formula with its source and limit
scripts/exposure.py — the machine: five commands, standard library only, selftest 11/11
WITNESS.md + SELFTEST.md — the run as it printed · MANIFEST.md, every file hashed · AUDIT.md, the twelve checks
MY-LEDGER.md — the card's memory, on your own machine · TIN.md · LICENSE-NOTE.md · THE-CLAUSES.md
card.svg + card-machine.svg + card.json · card.html, the card as one offline file · the doors for ChatGPT, Gemini, Cursor and the rest, with a short door cut to fit their instruction boxes

PROOF · SELFTEST 11/11 · EVERY COMMAND ON THE RECORD · WITNESSED IN CLAUDE 2026-09-28 · EDITION 1 · PUNCH 92F29B53CE21CB57F98D4A29

ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER

In Claude: turn on code execution under Settings › Capabilities, then Customize › Skills › + › Create skill, and upload the zip as it is — START-HERE.md in the box walks you through it, and tells you how to keep the ledger. In ChatGPT, Gemini and the rest: a Project, a GPT or a Gem with the card’s files attached and the short door in the box pasted as its instructions. The words run anywhere an AI reads Markdown; the machines run wherever the host runs Python. Witnessed in Claude only. The host marks →

Take it.

Nº 408 PROPOSED — LAUNCHING SOON

Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not medical, legal, tax or financial advice, never the person’s boss, and not a licence to practise. The terms →

THE TERM · PICK YOUR WINDOW

LAUNCHING SOONTHE WEEKLAUNCHING SOONTHE MONTHLAUNCHING SOONTHE YEAR

LAUNCHING SOON. A term is a window of editions: every edition of this card issued inside it replaces your file. When the window closes, the file you hold keeps working — freeze, not loss. Nothing auto-renews.

A TERM, NOT A SUBSCRIPTION: NOTHING RENEWS ITSELF AND NOBODY IS CHARGED AGAIN. WHEN A TERM ENDS THE FILES STAY ON YOUR COMPUTER AND STAY READABLE — FREEZE, NOT LOSS.

THE MACHINE · IN THE OPEN · FROM THE WITNESSED RUN OF 2026-09-28

exposure.py, every command showing its working.

A small Python program, standard library only. Your AI runs it; you can too. Every block below is pasted from the card’s own WITNESS.md, as printed; the money is in whatever currency you type, with no symbol.

`register`	the register scored likelihood × impact against the appetite the board set
`controls`	controls read for whether each was tested and passed
`scenario`	a scenario costed from your own numbers, beside the appetite
`kri`	key risk indicators read against their thresholds
`cover`	insurance read as covered and not covered, from the policy's own lines
`selftest`	11 checks that prove the arithmetic; it must print 11/11

# THE REGISTER · 5 risks · appetite 12
| rank | risk | category | L | I | score | owner |  |
|---|---|---|---|---|---|---|---|
| 1 | Customer concentration — top account is 31% of revenue | financial | 4 | 4 | 16 | CRO | ABOVE APPETITE |
| 2 | Ransomware | technology | 3 | 5 | 15 | CISO | ABOVE APPETITE |
| 3 | Key supplier single-sourced | operations | 3 | 4 | 12 | COO |  |
| 4 | Regulatory change in the EU market | legal | 3 | 3 | 9 | GC |  |
| 5 | Loss of the founding engineer | people | 2 | 4 | 8 | (unowned) |  |
above       2 risks above the appetite the board set
unowned     1
working     score = likelihood (1–5) × impact (1–5); above appetite when the score exceeds the number the board wrote down
plainly     a 5 × 5 matrix is coarse on purpose; a risk above appetite is a decision for its owner and the board — accept in writing, reduce, transfer or stop

controls · THE CONTROLS, TESTED OR NOT

# THE CONTROLS · 4 · 2 effective
| control | for the risk | owner | last tested | result | status |
|---|---|---|---|---|---|
| Backups restored from cold storage | Ransomware | IT | 2026-08-14 | pass | EFFECTIVE (tested 48 days ago) |
| Dual sign-off over 25k | Fraud | CFO | 2026-02-02 | pass | TEST OUT OF DATE (241 days) |
| Second supplier qualified | Single source | COO | — | — | NEVER TESTED — covers nothing |
| Key-person insurance in force | Founder loss | CFO | 2026-09-20 | pass | EFFECTIVE (tested 11 days ago) |
working     effective only when the last test passed within the retest window; untested or out of date is not a control, it is a hope
plainly     effective is the test's word, and only for the date it was run

scenario · A SCENARIO COSTED BESIDE THE TOLERANCE

# THE SCENARIO · Three days without the platform
direct cost 180,000.00
days down   3.00 at 96,000.00 a day = 288,000.00
other       45,000.00
total       513,000.00
tolerance   400,000.00 — this scenario exceeds it by 113,000.00
working     total = direct + days down × revenue a day + other; every input is yours
plainly     a costed story, not a prediction: it says what a day of this would cost, not whether the day will come

kri · THE INDICATORS AGAINST THEIR THRESHOLDS

# KEY RISK INDICATORS · 4 · 2 breached
| indicator | value | threshold | bad when |  |
|---|---|---|---|---|
| Overdue invoices as % of receivables | 13.50 | 10.00 | above | BREACHED |
| Months of runway | 10.20 | 9.00 | below |  |
| Open critical vulnerabilities | 3.00 | 0.00 | above | BREACHED |
| Staff attrition annualised % | 15.80 | 18.00 | above |  |
working     breached when the value is past the threshold in the direction you said is bad
plainly     an indicator is an early warning, not the loss: a breach is a conversation with the owner this week

cover · THE COVER READ FROM THE POLICIES

# THE COVER · 3 policies
| policy | covers (your reading) | limit | deductible | excluded (your reading) |
|---|---|---|---|---|
| Cyber | breach response and business interruption from a cyber event | 2,000,000.00 | 25,000.00 | acts of war and state actors |
| D&O | claims against directors and officers | 5,000,000.00 | 50,000.00 | fraud and prior known claims |
| Property | the office and its contents | 1,500,000.00 | 10,000.00 | flood |
working     the lines are your reading of each policy's own wording; the card adds nothing to them
plainly     covered is the insurer's word on the day of the claim; a limit is a ceiling, a deductible is the first money out, and an exclusion is the whole conversation

refused: --appetite must be at most 25; got 40.0

THE NUMBERS, NAMES AND DATES IN THESE RUNS ARE THE STUDIO’S OWN EXAMPLES, INVENTED FOR THE RECORD; NO REAL COMPANY, PERSON OR PROPERTY IS NAMED.

TRY IT IN ONE BREATH

Ask it anything someone who does this for a living would know.

YOUAre we covered if we get hit by ransomware?THE CARDreads your cyber policy's lines as you paste them — limit, deductible, exclusions — reads the backup control's last test, and stops at the word: covered is the insurer's on the day, effective is the test's.

YOUThe board wants a risk appetite. What number?THE CARDsays the number is the board's to write down, shows what each candidate does to the register — how many risks land above it — and drafts the appetite statement for them to argue with.

YOUWhat would a week-long outage cost us?THE CARDcosts the scenario from your direct costs, days and revenue a day beside the tolerance you set, and calls it a scenario, never a prediction.

QUESTIONS AT THE TABLE

Asked before the wire.

Will it tell us if we're safe?

No. It scores, tests and costs from your own record. Safe, covered and effective are words earned by a test, a policy's wording and a signature, not by the card.

Does it predict losses?

Never. A scenario is costed from your numbers and called a scenario; an indicator is an early warning, not a forecast.

Does it set our risk appetite?

No. The board writes the appetite down and the owners accept risks in writing; the card reads the register against it.

Is it an app?

No. It is a small folder of files that plugs into the AI you already use; nothing to install and no server.

Can I buy it today?

Not yet. It is launching soon. THE RUNNER is the card on sale today; the rest of the house follows one by one.

Do I need Claude?

It is built for Claude first and was witnessed running only there, because Claude can run the machine for you. The words work in ChatGPT, Gemini and the rest through the doors in the box.

Can my teenager use it?

With a parent in the loop. That is the rule for anyone under 18, on every card in the house.

← THE C-SUITE · beside it: THE CISO · THE CHIEF COMPLIANCE OFFICER · THE CFO