Risk is about uncertain impact, not merely bad things
Risk is the effect of uncertainty, which includes things going better than expected as well as worse.
In security the focus is naturally on harm, and it is worth knowing the wider definition because it explains why risk appetite language sounds odd when borrowed from finance. It also reframes the conversation usefully: the question is how much uncertainty the organisation can carry, not how many bad things are on a list.
More on Governance and risk
- 'compliance means secure'Certified, and propped open
- A risk register is a decision queue, not a museumNot a display case
- Risk acceptance spends organisational toleranceSigned, and spent
- Control effectiveness is separate from control existenceTicked, and still empty
- Risk owners need authority over the consequenceThe name, not the lever
- Risk aggregation can reveal concentrationAll on one leg