The development of parallel ISO "risk" standards series - ISO 31,000 and 27,000 and now Security Risk (28,001) versions, underlines the divergences in requirements from the different currently practising risk management communities. This is highlighted in the content of the series of ongoing web based discussions (Linked in) (Institute of Risk management, 2011). The contributions have been thoughtful, authoritative and illuminating and it is reassuring that even after (or perhaps because of) recent events and crises, (Fukushima, Lehman Bros, Eurozone, etc.) and new emerging threats (CYBER), responsible management seems still determined to understand and manage its risk exposures. However it is clear that there are practical difficulties in justifying the use of some of the more common management tools (such as Probability consequence diagrams - PCD's), that could inhibit the wider utilisation of predictive analysis to help steer corporate decision making. This contribution to the debate is aimed at trying to re-establish the basis of these techniques and to help justify their continued usage in a more rigorous and universally accepted and acceptable (useful) format. (C) 2014 Elsevier Ltd. All rights reserved.
