Had the pleasure of catching (RMI founder) Jack Jones present at an ISACA meeting this morning.  One of the great things about working with Jack is that he has this salient view of why things are messed up (and how we can make them better).  Two brief items I thought I’d share with you that he said today:

1.) Risk (and Risk Management) deals in open-ended problems.  Checklists and Best Practices, while they have some value, aren’t an end in and of themselves.  They will always fail because they are closed-ended.

2.)  Because we deal in open-ended problems,  if we are to be successful we must become subject matter experts and develop critical thinking skills.