RESOURCES
Everything we've written on GRC, compliance frameworks and running it all inside your own network.
7 posts found
4 August 2026 · By P LarnerBlog post
Why most risk statements say nothing, and the condition, event and consequence structure that fixes them, with real register entries rewritten in full.
Risk Management#condition event consequence#risk register#risk statements#ownership#scoring
Read more →4 August 2026 · By P LarnerBlog post
How to turn a write-only risk register into a management tool. Keep it small, write real statements, give risks owners with budget, and review by volatility.
Risk Management#review cadence#governance#risk register#ownership#board reporting
Read more →30 July 2026 · By P LarnerBlog post
Risk appetite, tolerance and capacity answer different questions. Getting the terms straight, and why the difference matters.
Risk Management#escalation#thresholds#Orange Book#capacity#risk appetite#tolerance
Read more →30 July 2026 · By P LarnerBlog post
How to run a Monte Carlo risk assessment in four steps, from calibrated ranges and lognormal distributions to reading a loss exceedance curve.
Risk Management#calibration#FAIR#loss exceedance#simulation#Monte Carlo#quantification
Read more →28 July 2026 · By P LarnerBlog post
The organisation has a low appetite for risk" isn't an appetite statement, it's a mood. Real organisations hold several appetites at once. This post makes the case for a multi-dimensional appetite profile: six to eight risk dimensions, each with its own level, rationale, tolerances, and owner
Risk Management#governance#Orange Book#tolerances#risk appetite#board reporting
Read more →25 July 2026 · By P LarnerBlog post
Threat models, risk registers and incident logs describe the same reality but cannot be joined. How the TRACE taxonomy turns four documents into one engine.
Risk Management#TRACE#incident analysis#threat taxonomy#MITRE ATT&CK#threat modelling#STRIDE
Read more →25 July 2026 · By P LarnerBlog post
Where 5x5 matrices earn their place, where they mislead, and when quantified risk analysis is worth the effort. Most mature programmes end up using both.
Risk Management#ALE#FAIR#hybrid approach#risk matrix#quantitative risk#qualitative risk
Read more →