-
A KRI dashboard a board will read
A key risk indicator earns a place in the board pack only if crossing its threshold calls for a decision the board itself must take. Here is how to build that page, and what to move down to management.
-
Risk appetite that means something
A risk appetite statement proves itself when a limit becomes inconvenient. Set limits a breach must act on, and keep legal obligations out of appetite altogether.
-
Third-party risk: test the exit
A termination clause is the right to leave, not the ability to. For every critical provider, prove you can recover the data and keep the service running before you need to.
-
RCSA people actually use
A control rated effective because the procedure says so is a guess. Rate each control on how it has performed, and let the business own the result.