Is ISO 31000 going to make the risk quantification mistakes that COSO did?
I have been following various debates on quantifying operational risk exposure on linked-in and elsewhere on the internet in the backdrop of risk standards such as COSO and ISO 31000.
What is a little disappointing is that it appears we might be falling into the same trap with ISO 31000 as the world has already done with COSO.
Let's take a look at the single problem around: What is the value of risk from an event?
Comments