“Risk” is not a primary metric.
What do I mean by that?
Primary metrics you can measure easily.
In physics they are things like length, weight, temperature, time-duration.
Secondary metrics most people can understand: rate of change that we call speed (length as distance and elapsed time).
Some secondary and many tertiary we can understand intellectually, but they have to be tabulated and calculated – acceleration.
Some such as ENTROPY still baffle people.
My experience with managers is that they often confuse risk for any number of things, not least of all simply equating risk to threats.
The again, I’ve met managers who would only commission a TVA if it was a contractual requirement, and then they might just ignore it, or if the contract required it, use it obsessively but with no actual understanding. BTDT.
What matters most to managers are things they can measure. Continue reading Risk is Not a Primary Metric