You Cannot Protect Against Everything: Week Two of Our GRC Series Starts Now
Last week we sorted out who’s in charge. This week we work out what they’re actually in charge of protecting.
Why Risk Comes Second
Governance without risk is just an org chart. Once you know who owns security, the next honest question is what they should actually spend their limited time and money on. You cannot protect against everything, and trying to is exactly how businesses end up armour-plating a door nobody’s trying while the real one swings wide open.
What’s in Today’s Episode
Five plain questions that surface your business’s genuine top risks: what would stop you trading tomorrow, what data would hurt if it leaked, where your money moves and who could trick you there, who has the keys, and what you’re relying on one person for. Score each answer for likelihood and impact, and pick one of four honest responses: treat it, tolerate it, transfer it, or terminate it.
How to Turn This Into a Competitive Advantage
A ranked, honest risk register lets you answer client security questionnaires with specifics instead of vague reassurance, a genuine differentiator against competitors who haven’t done this work.
How to Sell This to Your Board
The entire exercise takes one honest hour and costs nothing but that time. Compare that to City of London Police’s figure of around £270,000 average loss per reported ransomware incident for UK businesses in the year to March 2026.
What This Means for Your Business
- Read today’s companion piece for the full five-question method.
- Block out an hour this week to answer them honestly about your own business.
- Bring your governance sheet from last week to the same session, since the two documents work together.
| Source | Article |
|---|---|
| NCSC | Risk management guidance |
| City of London Police | Ransomware warning: more than 320 businesses affected last year |