The problem with any risk assessment approach whether qualitative or quantitive, lies in estimating the scope (how widespread the outcome...

For many organisations, developing a risk register is seen as a destination - and it should not be. Often, the corporate risk register is seen as some kind of holy grail and this, coupled with some periodic assertions of relevance and controls performance, forms the "risk management system". A risk register is basically a statement of scope and intent: the organisation has identified the risks or threats it thinks are significant enough to warrant doing something about and w

Is the concept of risk appetite practical & helpful?