Most organizations running machine learning programmes maintain a risk register. Each entry is scored for probability and impact; the scores are multiplied, and the resulting list drives where mitigation effort goes.

That approach assesses every risk on its own. It cannot represent what a risk sets in motion, which risks sit on the path between the technical and governance domains of a programme, or which entries are consequences of others already on the list.

The result is usually a register that is broadly sound and specifically wrong in a small number of places. Those places are the ones worth finding.

SigmaFly compares an organization's own severity assessment of its machine learning risks against the dependency structure among those risks, and reports where the two diverge.

Substantial agreement between the two is the expected result. The value of the work lies in the exceptions: risks the register under-weights because their consequences are recorded elsewhere, risks that quietly connect otherwise separate parts of a programme, and risks that carry less structural weight than their score suggests.

This is a diagnostic layer over existing practice, not a replacement for it. Nothing has to be rebuilt, and no existing process has to be abandoned.

The approach is derived from doctoral research at Edinburgh Business School, Heriot-Watt University, conducted with sixty-one experienced practitioners across enterprise machine learning delivery. The research produced a consolidated register of machine learning project risks and an empirically validated structure of dependencies among them.

The analysis is deterministic and traceable: every conclusion can be followed back through explicit steps to the judgments it rests on.

It describes structural position and relational dependency. It does not forecast the likelihood, timing, or cost of any event, and it is not an audit or an assurance engagement.