3 ms·

Your comment resonates with me but I'm not sure I fully understand it: "compliance transfers risk out of the project and onto the standard/model": If I choose t

Your comment resonates with me but I'm not sure I fully understand it: "compliance transfers risk out of the project and onto the standard/model": If I choose to be compliant to a standard, some of the risks are mitigated, not transferred; some risks I have that are not covered by the standard are not mitigated or transferred, but still unknown, because I chose not to look into the threats (but just comply with some standard). So how does it transfer risk out of a project? "A business PM won't problematize those things because it will demand a solution that gets in their critical path. The best they can do is manage it": If you identify a risk you can still choose to accept it and do nothing to mitigate it. So why does it demand a solution? "you've reduced the flexibility of the business to manage that risk": Why? Again, risk identification does not automatically mean risk mitigation. If you're aware of a risk you may choose to detect problems instead of prevent them from happening. How else would you be able to manage risk if you are not even aware of it? Maybe your comment is related to something I have experienced. I often think about a theoretical situation related to the movie the Matrix. Suppose there exists a complete risk analysis that provides insight into every aspect of risk for a company. By taking the red pill responsible management would instantly see all these risks, but it cannot be "unseen", so they would have to act to reduce them to acceptable levels (taking away resources that would otherwise be devoted to business functionality). Would they take the red pill or the blue pill? I think most managers would choose to stay ignorant. [edit: wording]

lmkg 6y ago
> some risks I have that are not covered by the standard are not mitigated or transferred If you're compliant with a regulation or a standard, then you're not liable for failures of those standards. I think there's an implicit assumption that the harm of a failure will fall on users/consumers/some other third party, rather than yourself. In this case, the "risk" is liability for damages, rather than actual damages. If you roll your own risk-management strategy, then you assume responsibility for its failures. If you follow a blessed external standard, then you transfer responsibility to the standard. So the risk of a failure is not fully mitigated, but your risk of being liable for that failure is. Which, to GP's point, disincentivizes exploring novel approaches that mitigate the risk of real failures.
- A_No_Name_Mouse 6y ago
  Thanks. In this context it makes perfect sense.

lmkg 6y ago

> some risks I have that are not covered by the standard are not mitigated or transferred If you're compliant with a regulation or a standard, then you're not liable for failures of those standards. I think there's an implicit assumption that the harm of a failure will fall on users/consumers/some other third party, rather than yourself. In this case, the "risk" is liability for damages, rather than actual damages. If you roll your own risk-management strategy, then you assume responsibility for its failures. If you follow a blessed external standard, then you transfer responsibility to the standard. So the risk of a failure is not fully mitigated, but your risk of being liable for that failure is. Which, to GP's point, disincentivizes exploring novel approaches that mitigate the risk of real failures.

A_No_Name_Mouse 6y ago
Thanks. In this context it makes perfect sense.