READOS / Business
Risk, Controls and Assurance
Practical risk management: appetite, registers, scores, controls, assurance, rules and the risks you pass on.
Start reading →Contents
- 01A risk management framework that works: applying ISO 31000 in a growing businessA risk register is not a framework. How to apply ISO 31000's principles, framework and process: set criteria, assign accountability, build risk into real decisions and report what matters.
- 02How much risk can the business carry? Appetite, tolerance and capacity in practical termsBeing willing to take a risk is not the same as being able to survive it. How to separate appetite, tolerance and capacity, set limits that guide decisions and price a zero-risk promise.
- 03Making a risk register change decisions: causes, triggers, barriers and owners who can actA risk register can be complete and still change nothing. How to write risks that point to action, set triggers early, check the barriers you rely on and give owners real authority.
- 04What a risk score cannot tell you: averages, rare disasters and different kinds of uncertaintyLikelihood times consequence ranks risks as if the business could average out its losses. Why that hides the risks that could end it, and how to match responses to each kind of uncertainty.
- 05Risk is also the opportunity you miss: weighing threats, upside and the cost of standing stillRisk reviews that only ask what could go wrong can make a business safer today and weaker tomorrow. How to weigh threats, opportunities and the status quo, and buy information cheaply.
- 06Risk is not vulnerability: what turns a disruption into damage, and how to build the capacity to copeTwo businesses can face the same flood, supplier failure or surge in demand and fare very differently. How to find the weak points inside your business, and why seeing a risk is not coping.
- 07Changing the odds or changing who pays: choosing risk responses that actually reduce exposureSome risk responses make an event less likely; others only decide who pays when it happens. How to tell them apart, why design beats procedures, and how to choose the mix deliberately.
- 08Passing a risk on does not remove it: what stays with you when a supplier carries the riskA contract decides who must pay after a failure, not whether they can, or whether your customers still feel it. How to test a transfer, follow the recovery chain and keep what you need.
- 09Beyond the fence line: consequences outside your control and effects that add upNoise, traffic, pollution and supplier impacts cross business boundaries and add up over many small decisions. How to map them early, see who bears them and act before they return.
- 10When your building requirements are set outside your boundary: site hazards that can change after you commitWhy the standard a building or asset must meet can depend on neighbouring land, terrain, hazard maps and adopted rules you do not control, and how to investigate them before committing.
- 11Problems that creep: managing slow-building risks as conditions, not eventsMaintenance backlogs, overtime, dust, quality drift and growing dependence on one supplier rarely cause one dramatic event. How to define normal, watch trends and act before damage shows.
- 12How quickly would you find out? Detection speed, monitoring built into decisions and visibility you can useMost reports show problems months after they began. How to measure the lag between a change and your awareness of it, build monitoring into each decision and see into outsourced work.
- 13Pricing your risk controls: why every risk treatment needs a cost lineRisk registers record the risk, rating and response, but rarely what the response costs. How to price controls, judge them on net benefit and track the new risks controls create.
- 14Retiring controls that no longer earn their place: checks, sign-offs and rules that outlive their reasonsControls are easy to add after an incident and almost never removed, so they pile up unpriced. How to trace each to its reason, test whether it still earns its place and retire it safely.
- 15Control, assurance and independent review: three different checks and when you need eachInspecting work, checking the process behind it and asking whether the venture still makes sense are different jobs. How to tell them apart, set independence by stakes and act on findings.
- 16Who is the assessment for? Certifications, maturity ratings and real improvementAn assessment done to win tenders and one done to improve are different exercises. How to name the audience first, choose the right approach and fund improvement separately.
- 17From promise to proof: turning business commitments into controls you can checkPublishing a commitment creates visibility, not accountability. How to trace a promise through decisions, controls and evidence, and choose checks and audits that answer a real question.
- 18What your people can commit you to: approval limits, obligations and risks that quietly drop off the listApproval limits control what staff may spend, not what they may cause you to owe. How to map the commitments everyday emails create, control them and see why a risk stopped being red.
- 19Who tells you which rules apply? Access to standards and the source of your compliance knowledgeTechnical standards are licensed products, and your list of obligations often comes from a supplier or adviser. How to check where your compliance knowledge comes from and who can read it.
- 20Which edition applies? When the law references an older version of a standardLaws, codes and contracts often reference a specific edition of a technical standard, so working to the newest edition can leave you unable to show compliance. How to track it.
These topic-based reading collections are organised alphabetically; chapters may be read in any order.
← All books