{"id":1078,"date":"2026-03-26T08:09:35","date_gmt":"2026-03-26T07:09:35","guid":{"rendered":"https:\/\/eosgmbh.com\/?p=1078"},"modified":"2026-03-31T15:49:47","modified_gmt":"2026-03-31T13:49:47","slug":"informal-risk-acceptance","status":"publish","type":"post","link":"https:\/\/eosgmbh.com\/en\/informal-risk-acceptance\/","title":{"rendered":"Informal Risk Acceptance"},"content":{"rendered":"
\n
\n

<\/span>Why known security risks remain - and what they cost your P&L<\/strong><\/span><\/h3>\n\n\n\n

I see the same pattern again and again in mandates: a risk is known, a measure is decided, and yet nothing happens for a long time. The reasons are rarely irrational. On the contrary, they seem plausible: implementation is complex, resources are tied up, other issues seem more urgent. However, this is precisely where the problem lies. In fact, in these situations, a decision is not avoided, but made - only implicitly. The risk is not actively accepted, but borne over time.<\/p>\n\n\n\n

<\/p>\n\n\n\n

I refer to this phenomenon as Informal risk acceptance<\/strong>. And in many organizations, it is significantly more expensive than it appears at first glance.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Carsten Reffgen<\/em><\/p>\n\n\n\n

March 2026<\/em><\/p>\n\n\n\n

\n
<\/div>\n\n\n
\n
\n

Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n