Working notes on doing risk assessment properly.

Written from engagements rather than from a content calendar. Nothing here is published yet, so every piece below is marked forthcoming rather than dressed up as an archive.

Seven pieces in preparation. None is currently available to read.

Insights · contentsNo. 01 to 03

Written for the people who have to sign.

01The 2013 to 2022 crosswalk, and what it exposes

02Why a consultant cannot accept residual risk for you

03Reading a risk register the way an examiner does

Plain English · no gatingFree

H.1Lead piece
Forthcoming

The 2013 to 2022 crosswalk, and what it exposes

Mapping a legacy register forward is not a renumbering exercise. Eleven controls in the 2022 edition have no ancestor at all, so an institution assessed only against 2013 has never evaluated them, and the merge relations quietly collapse several old findings onto a single new reference. This piece walks the mapping properly and shows what falls out of it.

Forthcoming

H.2In preparation
Six more

Six more we are working on.

QUANTITATIVEWhy annualised loss expectancy understates your worst losses, and what capping rate of occurrence at 100 per cent quietly does to a bank's most frequent incidentsForthcoming

REGULATORYWhat a regulator actually asks for in a risk register, and why the answer is an artefact and a cadence rather than a scoring formulaForthcoming

METHODAsset-based or event-based identification under ISO 27005, choosing properly rather than defaulting, and what each one missesForthcoming

PRACTICEWrite a threat, not a gap. Phrasing a risk statement so the register reads as risk rather than as a restated checklistForthcoming

GOVERNANCERisk appetite is a board policy, not a dashboard setting, and what changes when you treat it as a governed objectForthcoming

FAILUREWhat breaks when a spreadsheet governs a bank's security posture, documented from a real forty-row registerForthcoming

H.3Notification
When published

Get each piece when it is published.

Roughly monthly, only when something is actually finished. One click to unsubscribe, and the address is not used for anything else.

NextTell us what
to write

Which one would help you most?

If one of these would be useful sooner, say so. We tend to write the piece a client has just asked for.

Get in touch How it works