Risk analysis and assessment is a big part of any large company’s strategy but it’s not an easy process, and it may require a special brand of courage to carry through with it. This article was written for a target audience of corporate directors, but it has many points that are pertinent to security professionals at all levels. The paper analyses some famous (or infamous) catastrophic events such as the sinking of the Titanic and the AIG collapse, but again, the concepts discussed are relevant to IT. Definitely worth a read if you’re involved in risk management.
http://www.poole.ncsu.edu/erm/index.php/articles/entry/identify-catastrophic-events