Good point Andy, I think when you're talking about Risk Assessment and/or Reducing Risk, you might have to carefully define what you're assessing. The point being that you want to reduce unnecessary (or involuntary) risk, but calculated risk isn't really a Risk in the 'capitalized' sense, it's a business investment. That investment may or may not pay out, but it's identified and set aside as acceptable due to the possible return. That differs from the true Risk situation, where you have a hole in your processes or systems that allows the possibility of negative impacts to occur with no potential upside.