Notes from inside the work.
Short pieces on the parts of risk management that are hard to get right: tiering, concentration, evidence, control testing and the gap between a framework and an operating process.
- Third-Party Risk6 min
Tiering that survives contact with procurement
Most vendor tiering models fail for the same reason: they are scored by the team least able to judge service criticality. A tier is a statement about your process, not about the supplier.
Full note on request - Third-Party Risk8 min
Concentration risk is a technology question
Four unrelated vendors can still be one outage. Concentration only becomes visible when the inventory records region, platform and upstream dependency, not just the contracting entity.
Full note on request - Controls5 min
Control testing versus control evidence
A screenshot proves a setting existed on a Tuesday. Designing the evidence requirement alongside the control is what turns an annual scramble into a by-product of normal operation.
Full note on request - Operational Risk7 min
RCSA without the theatre
When every process self-assesses as low residual risk, the exercise has told you something about incentives rather than about exposure. A few structural changes fix most of it.
Full note on request - Technology Risk9 min
Reading a SOC 2 like an engineer
Scope, exceptions, subservice carve-outs and the complementary user entity controls you have just silently inherited. What to read first when the report lands.
Full note on request - Regulation6 min
Impact tolerances, stated honestly
An impact tolerance that has never been tested against a real dependency map is an aspiration. Mapping important business services is where resilience programs either land or stall.
Full note on request
Full versions of these notes are shared directly with clients and prospective clients. Ask for any of them by title and we will send it across.
Want the long version of any of these?
Tell us which note is relevant to what you are working on and we will send it — usually with the working material behind it.