> some risks I have that are not covered by the standard are not mitigated or transferred If you're compliant with a regulation or a standard, then you're not

> some risks I have that are not covered by the standard are not mitigated or transferred If you're compliant with a regulation or a standard, then you're not liable for failures of those standards. I think there's an implicit assumption that the harm of a failure will fall on users/consumers/some other third party, rather than yourself. In this case, the "risk" is liability for damages, rather than actual damages. If you roll your own risk-management strategy, then you assume responsibility for its failures. If you follow a blessed external standard, then you transfer responsibility to the standard. So the risk of a failure is not fully mitigated, but your risk of being liable for that failure is. Which, to GP's point, disincentivizes exploring novel approaches that mitigate the risk of real failures.