ACCEPTABLE RISK
The Mission
Acceptable Risk is a public library of practical thinking about governance in operational reality.
Why it exists
Because “documented” is not a mitigation strategy.
Policies, registers, certifications, training records and audit reports all have a place. But they are not the story. The useful question is what changes in the organisation as a result — who owns it, what evidence exists, what could happen next and what decision is required.
What this site is about
I write about the point where specialist issues stop behaving like specialist issues and become organisational ones.
- Governance Without Theatre — evidence, ownership, accountability and decisions.
- Data Privacy in Practice — privacy as an operating discipline rather than a paperwork exercise.
- AI Governance: Practitioner View — inventory, oversight, evidence and accountability around real AI use.
- Defence, Certification & Supply Chain — assurance, dependencies, suppliers and demonstrable trust.
- Resilience — what actually happens when the organisation is placed under load.
The editorial rule
The regulation is not the story. The control is not the story. The consequence is the story.
That means asking what is really happening, what evidence supports the claim, who owns the issue, what the operational or commercial consequence is, and what leadership needs to decide.
What you will not find here
- No fear-mongering.
- No hacker-hoodie storytelling.
- No empty “culture change” slogans without an operating mechanism.
- No pretending a certificate or policy proves more than it actually does.
- No sales pitch. This is not a services site.
How to use the library
If you are a leader, use the articles as prompts for better questions:
- What is actually different in the organisation?
- Do we have evidence, or do we have paperwork?
- Who owns the issue when it stops being theoretical?
- What happens if this is put under pressure?
- What decision are we avoiding?
If you are hands-on, use the same questions to test whether the operating reality matches the governance story.
No newsletter. No funnel.
There is no newsletter on this site and no commercial funnel hidden behind the content. It is a library. Read what is useful, ignore what is not, and come back when you need it.
Disagreement is welcome. The point is not to make governance look tidy. It is to get closer to what is true in practice.