Explain like I'm five · Security

What is Risk Management?

Risk management, told as a story about a castle with a hundred doors and ten guards, weighing which door to guard first.

100 doors10 guardswhich door first?we can't guard them all — so where first?

A hundred doors, and only ten guards.We can't guard them all. So where first? The king wants to know.

empty storeroomfour guardsthe vault — no guardgoing by gut feelingyou guard the wrong doorone per door — all of them thinspreading evenlythe vault gets what the storeroom getsnot by gut, not evenly — you have to weigh it

By gut, you guard the wrong door. Spread evenly, every door is thin.Four guards at the empty storeroom, none at the vault. One per door, and the vault gets no more than the storeroom. So you have to weigh it.

×how likelywhat we'd loselikely × loss = riskRISK LEDGERdoorlikelylossriskvault doorhighbigguest room doorhighsmallthe king's windowlowbigstoreroom doorlownoneread it with the king — red doors firstwe can't guard everything, so we weigh and choose

Risk management is weighing each door — how likely × what we'd lose — and writing it in a ledger.Likely to be hit and costly if it is — that's red. Both low — that's green. The king reads the ledger with you, red doors first.

Likely × lossboth together make the risk
Write it downred, yellow, green
Red firstblock, accept, hand off, remove
With the kinghow much to accept is the king's call
reduceadd a lock and a guardacceptsmall? leave it — knowinglytransferinsurance pays if it goesavoidbrick the door up for goodred doors get blocked, green doors get accepted — not one answer for all

Once weighed, it's one of four: reduce it, accept it, hand it off, or remove it.Red doors get a lock and a guard. Green doors are left alone — knowingly. Some risk goes to insurance; some doors get bricked up. The crack ledger gets its order from here too.

RISK LEDGER — REVIEWEDvault door — 3 guardsguest door — new lockstoreroom — as ismonthlyeven blocked, a little remainsthe leftover risk is known and watchedthe scale is not a one-time thing

Even blocked, a little remains. So you weigh again every month.The leftover risk is known and watched. New doors appear, a thief's habits change, and the scale tips again. The inspector asks for this ledger first.

In one breath

Risk management = weigh every door by how likely × what we'd lose, write it in a ledger, and with the king, keep deciding — red doors first — to reduce, accept, transfer, or avoid.

For each asset, assess how likely a threat is and how bad its impact would be, record it in a risk register, and treat the biggest risks first — mitigate, accept, transfer, or avoid. The residual risk that remains is accepted by leadership and reassessed regularly.

When grown-ups say it

Risk
What the scale weighs. How likely a thief comes × what we'd lose. One without the other isn't risk.
Threat
The thief. The bad thing that could happen — thieves, fire, flood. → a thief's habits
Vulnerability
The loose door. A crack a thief could use. → the hole nobody knows
Likelihood × impact
The two pans. Likely and costly means red. Some castles use numbers.
Risk register
The risk ledger. Every door's color, who owns it, what was decided. Read with the king.
Accept / Mitigate / Transfer / Avoid
One of four. Leave it, reduce it, insure it, remove the door. Red gets reduced; green gets left.
Residual risk
What remains after blocking. Even three guards leave a little. The king knows and accepts it.
Vulnerability management
The crack ledger's order. Which crack to fix first comes from the risk ledger. → the crack ledger
Next story
The Inspector from the Neighboring Kingdom →
Want another term as a picture book? Request →