Articles
The risk register and the exception register: recording what was accepted
One register keeps the risk decision; the other keeps the deviation and its expiry.
Risk management
Directly assigned
Articles
Service criticality and dependencies: what fails when this stops
Criticality is a property of the service, not the box: name what it depends on.
Articles
Suppliers and external services: risk that arrives with the contract
Supplier risk that arrives with the contract: what stays yours and how it is managed.
Articles
Risk appetite and acceptance criteria: deciding how much risk is acceptable
Risk appetite is a leadership call; acceptance is real once written, owned and dated.
Articles
Threat, vulnerability, likelihood, impact: the parts of a risk
Risk is not one number: threat source, vulnerability, likelihood and impact are separate.
Articles
Treating a risk: mitigate, avoid, transfer, accept
Five ways to respond to a risk: what each one changes, what is left, and who answers.