The 16-page explanation behind the one-page ISO 31000 diagram.
 
If you have downloaded the free SRMBOK one-page process diagram, you already have the picture. This guide is the reasoning: why the diagram is drawn the way it is, what each element means in practice, and how to apply it to a real assessment. If you have not seen the diagram, it is included.
 
ISO 31000 is conceptually sound, but the standard diagram blurs three different things: the actions you perform (scope and criteria, identify, assess, evaluate, treat), the states of risk you observe (inherent, current, residual), and the context everything sits in. Once those are separated, the process becomes considerably easier to understand, teach and apply.
 
What's inside
The one-page process diagram, with a full explanation of every element, including why the arrows only connect to the five action steps
The journey from inherent risk to current risk to residual risk, and how existing and proposed controls change exposure
The Swiss-cheese view of layered controls within this model
Fitting the effort to the task, from a single work activity to an enterprise assessment
Applying the process to security risk: threat, vulnerability and criticality
The myths of nature, and how they shape the way people judge risk
 
Who it is for
Risk practitioners and security professionals who need to explain the process to others, project managers and board members who need to understand it, and trainers who need something between a poster and a textbook.
 
16-page PDF. Single-organization license.
 
Included in the SRMBOK Library at the Complete level. Compare Library plans.