The Gap Between Risk Registers and Real Incidents
The risk register said the building was covered. Access control: mitigated. Emergency response: documented. Security training: completed. Then, on an ordinary weekday evening, something happened that wasn’t extraordinary at all. A contractor who hadn’t worked in the building for months walked in after hours. His card still worked. He didn’t rush. He didn’t hide. He […]