Inherent vs. Residual Risk. Why Your Auditor Already Knows You’re Getting This Wrong
Most people don’t recognise inherent risk exists. They see a residual risk number and think it measures control quality. It doesn’t. A score of medium residual risk is not a measure of control quality. It is a measure of the assumption you made about control quality. Those are very different things. The Two Types of […]
Your Risk Assessment Matrix (RAM) Needs Calibration. Here’s Why Two Experts Give Different Scores
Two competent people assess the same risk. One gives it a 16. The other gives it a 9. Neither is wrong, and that is the problem. Here’s what a calibrated Risk Assessment Matrix actually looks like.