Part II · Chapter 3 · Risk, without the score · lesson 3
A risk is a sentence with a victim in it
11 min
Part II · Chapter 3 · Risk, without the score · lesson 3
11 min
Four rows, copied out of a register that a real organisation submitted to a real buyer:
That is the whole of each row. Four nouns, one per line, each with a band against it and a treatment column reading mitigate.
Here is the problem with all four, and it is the same problem. There is nothing you can do to a category. You cannot reduce cloud. Nobody can be made the owner of GDPR. And when somebody asks what you did about phishing, the only answer the row admits is training, because training is the only treatment a noun has ever suggested to anybody.
Predict
A risk worth writing down has a path, an outcome and somebody who carries it.
An invoice for forty thousand is paid into an attacker's account, because approval happens in a chat message where the approver cannot see that the bank details changed.
Path: approval in chat. Outcome: money leaves. Carried by: the finance lead, who signs the payment run.
The test is whether you could say, on a given morning, that this happened. If you can, the row is a risk. If the honest answer is that it is always happening a bit, the row is a category and its bands are decoration.
The side effect is that the sentence argues with you. Somebody will say the approver can see the bank details, and now you have a disagreement about one screen — a better meeting than the one about whether phishing is a four.
The first cost is the owner. Cloud has no owner, so the row gets assigned to whoever runs the register. A sentence about a database copy left in staging has an owner the moment you read it out loud.
The second cost is the treatment. A category admits exactly one intervention — make people more aware of the category — which is why registers full of nouns all converge on the same annual training module regardless of what the organisation does. The invoice sentence suggests moving approval somewhere with an audit trail, or calling the supplier back on a known number when bank details change, or capping what one person can release without a second pair of eyes. Three options with three costs, available for free, out of the wording.
The third cost is the one that shows up later. Nothing can be shown to have addressed a category. A year from now somebody will ask what the control against insider threat produced, and there is no artefact that answers, because the row never said what the thing was.
Check
Keep them, one level up, as labels. A register of forty sentences is hard to read across, and a column tagging each sentence with a family — payments, access, suppliers, data handling — makes it possible to notice that eleven of your forty rows are about one supplier.
The distinction is that the label is for reading and the sentence is for working. Trouble arrives when the label is the row, because then the reading view is the only view that exists and nobody notices it has no working view underneath it.
The register in this subject has a floor built into it: the field refuses a risk shorter than a dozen characters or so. That is not a quality check and it cannot tell a sentence from a long noun phrase. It exists because Cloud used to get typed into it, and a one-word row is the single most reliable predictor of a register nobody ever acts on.