30 July 2026 · By P LarnerBlog post
Risk Appetite, Tolerance and Capacity Getting the Terms Straight
Risk appetite, tolerance and capacity answer different questions. Getting the terms straight, and why the difference matters.
Read more →BLOG
From the practitioner's desk
Notes on GRC, compliance frameworks and running it all inside your own network.
5 posts found
30 July 2026 · By P LarnerBlog post
Monte Carlo Risk Assessment How to Actually Run One
How to run a Monte Carlo risk assessment in four steps, from calibrated ranges and lognormal distributions to reading a loss exceedance curve.
Read more →28 July 2026 · By P LarnerBlog post
Multi Dimensional Risk Appetite One Statement Is Not Enough
The organisation has a low appetite for risk" isn't an appetite statement, it's a mood. Real organisations hold several appetites at once. This post makes the case for a multi-dimensional appetite profile: six to eight risk dimensions, each with its own level, rationale, tolerances, and owner
Read more →25 July 2026 · By P LarnerBlog post
The TRACE Threat Taxonomy One Vocabulary Across Threats, Incidents and Risks
Threat models, risk registers and incident logs describe the same reality but cannot be joined. How the TRACE taxonomy turns four documents into one engine.
Read more →25 July 2026 · By P LarnerBlog post
Quantitative vs Qualitative Risk Assessment Which Should You Use
Where 5x5 matrices earn their place, where they mislead, and when quantified risk analysis is worth the effort. Most mature programmes end up using both.
Read more →