Appendix D

The twenty-seven sources

Every component cites its source by the key in brackets. All twenty-seven were read on their official sites in October 2026; this table gives the document, the version at writing and the page to read first. Nothing from any source is reproduced here.

Key	Source and document	Version at writing	Where to start
[1]	ISO 31000 iso.org ISO 31000:2018, Risk management: Guidelines, second edition (full text sold; the principles and the process diagram are shown free on the ISO 31000 page); IEC 31010:2019 for techniques; a third edition in committee draft during 2026	2018; revision in progress	Read first. Start with clause 4, the principles, then clause 6, the process; watch the ISO 31000 page for the third edition, which may renumber the clauses cited in this book.
[2]	COSO ERM coso.org Enterprise Risk Management: Integrating with Strategy and Performance (2017; the executive summary is free, the full framework and compendium are sold); guidance on risk appetite (2020), fraud risk (2023), board oversight and practical ERM (May 2026)	2017 framework with supplements to 2026	Read first. Start with the free executive summary and the list of twenty principles, then the 2020 appetite guidance and the May 2026 board oversight guide.
[3]	PMI Risk Breakdown Structure pmi.org “Use a risk breakdown structure (RBS) to understand your risks” (Hillson, 2002) and the 2005 paper on the Risk Breakdown Matrix, in the PMI library; the Standard for Risk Management in Portfolios, Programs and Projects (2019); the September 2026 post on an AI branch	2002 and 2005 papers; 2019 standard; 2026 post	Read first. Start with the worked RBS in the 2002 paper; the matrix paper and the AI post are extensions of it.
[4]	HM Treasury Orange Book gov.uk The Orange Book: Management of Risk, Principles and Concepts (May 2023; HTML version updated July 2026, free); Risk Appetite Guidance Note v2.0 (2021, withdrawn from the page in 2026 and archived in the National Archives)	2023 edition; July 2026 HTML	Read first. Start with the five principles, then the section on risk appetite; find the 2021 guidance note in the National Archives for the five-position method.
[5]	Basel Framework, market risk and interest rate risk in the banking book bis.org Basel Framework: the MAR chapters on market risk (in force since 1 January 2023; MAR21 updated by the technical amendment of March 2026, BCBS d610), RBC25 on the trading and banking boundary, and SRP31 on interest rate risk in the banking book (recalibrated 2024, in force from 1 January 2026)	MAR 2023 with the March 2026 amendment; SRP31 2026	Read first. Start with MAR12 on trading desks and MAR32 on backtesting and profit and loss attribution, then the twelve principles of SRP31.
[6]	Institute of Risk Management theirm.org A Risk Management Standard (2002); Risk Appetite and Tolerance (2011); Risk Culture: Under the Microscope (2012); Horizon Scanning: A Practitioner's Guide (2018); several PDFs are mirrored by partner bodies where the original download is restricted	2002 to 2018; none superseded	Read first. Start with the appetite paper, whose board questions are worth the whole source, then the horizon scanning guide for the idea of clockspeed.
[7]	JRC INFORM indices drmkc.jrc.ec.europa.eu INFORM Risk (Mid-2026 release, 191 countries), INFORM Severity (monthly), INFORM Warning (1 to 12 months) and the Risk Data Hub, on the Disaster Risk Management Knowledge Centre site; the “Concept and Methodology” paper (2017) linked from the methodology page	Mid-2026 release	Read first. Start with the one-page description of the three dimensions and the geometric mean on the methodology page; the arithmetic is the argument.
[8]	ASQ Failure Mode and Effects Analysis asq.org Failure Mode and Effects Analysis, in Quality Resources (reviewed November 2024, with a template and a worked example), and the FMEA chapter of the Quality Toolbox, third edition (2024); the Action Priority table is in the AIAG-VDA FMEA Handbook (2019), which is sold	2024 page; 2019 handbook for Action Priority	Read first. Start with the ten-step procedure, then the worked example.
[9]	NIST IR 8286 series csrc.nist.gov NIST IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management (December 2025), with 8286A to 8286D and the Risk Register and Risk Detail Record JSON schemas listed as supplemental material	Revision 1, December 2025	Read first. Start with the core report, then open the Risk Detail Record schema file, which is short and says more than the prose; then 8286C for the roll-up to the enterprise and 8286D for the business impact analysis.
[10]	NIOSH Hierarchy of Controls cdc.gov Hierarchy of Controls, About page (reviewed April 2024, republished July 2026); Prevention through Design, About page (reviewed January 2024); the controls repository on the same site	2024 pages	Read first. Start with the hierarchy page itself, which is short, and read the criteria for engineering controls twice.
[11]	NASA Risk Management Handbook nasa.gov (NASA Technical Reports Server) NASA Risk Management Handbook, Version 2.0, Parts 1 and 2 (NASA/SP-20240014019, November 2024); NPR 8000.4C (April 2022); Probabilistic Risk Assessment Procedures Guide for NASA Managers and Practitioners, second edition (December 2011)	Version 2.0, November 2024	Read first. Start with the chapter on the risk statement, then risk-informed decision making; leave the PRA guide until you have a model to build.
[12]	PMI probability and impact articles, with Cox's critique pmi.org PMI library articles: “Assessing risk probability: alternative approaches” (Hillson and Hulett, 2004), “Describing probability: the limitations of natural language” and “Qualitative risk assessment: cheaper, faster”; Cox, 'What's wrong with risk matrices?', Risk Analysis, 2008, as the formal critique, listed separately as [28]	Articles 2000 to 2015; Cox 2008	Read first. Start with Hillson and Hulett, then read Cox with a matrix of your own at hand.
[13]	NGFS climate scenarios ngfs.net NGFS Scenarios Portal: long-term scenarios, Phase V (November 2024; the chronic physical damage estimates were retracted by the statement of 3 December 2025); short-term scenarios (May 2025, technical documentation July 2025); sector mapping (February 2026)	Phase V, 2024; short-term scenarios 2025; sector mapping 2026	Read first. Start with the December 2025 statement, then the documentation of the short-term scenarios, then the portal.
[14]	ASQ root cause analysis tools asq.org Root Cause Analysis, in Quality Resources, with the pages on the fishbone diagram, the five whys, the Pareto chart and the Eight Disciplines (8D); all free, revised with the Quality Toolbox, third edition (2024)	2024	Read first. Start with the root cause page, then the 8D page for the discipline of closing a case.
[15]	CISA ICT supply chain risk management cisa.gov ICT Supply Chain Risk Management Task Force page, with the SCRM Essentials and the Vendor SCRM Template (April 2021, 97 questions) linked from it; the HBOM Framework (2023); SBOM Minimum Elements (draft, August 2025); NIST SP 800-161r1 as technical reference	2021 to 2025	Read first. Start with the appendix of fields in the SBOM draft, then its known-unknowns passage, then the first section of the vendor template to see the question-to-standard tracing.
[16]	Ready.gov business impact analysis ready.gov Business Impact Analysis (page dated December 2023), with the BIA and resource requirements worksheets; IT Disaster Recovery Plan (February 2025); continuity plan templates; aligned with NFPA 1600 and ISO 22301	2023 to 2025	Read first. Start with the BIA worksheet: it is one page and it contains the whole method.
[17]	BCBS 239 and the operational risk principles bis.org BCBS 239, Principles for effective risk data aggregation and risk reporting (January 2013) and the progress report of November 2023; Revisions to the Principles for the Sound Management of Operational Risk (BCBS d515, March 2021); Basel Framework SRP50, liquidity monitoring tools	2013 principles with 2023 progress report; 2021 operational risk revision	Read first. Start with the one-line statements of the fourteen principles, then principle 6 of the operational risk document.
[18]	IIA Global Internal Audit Standards and Three Lines theiia.org Global Internal Audit Standards (2024 edition, effective January 2025); Three Lines Model statements of position (July 2026); Topical Requirements on cybersecurity and on third parties (2026)	2024 standards; 2026 statements and topical requirements	Read first. Start with the statement of position on internal audit's role in risk management, which is short, then Domain IV, standards 9.4 and 9.5, and standard 15.2 in Domain V.
[19]	BCBS credit risk principles bis.org Principles for the Management of Credit Risk (BCBS d595, 30 April 2025, sixteen principles); Guidance on credit risk and accounting for expected credit losses (d350, December 2015); Guidelines for counterparty credit risk management (d588, December 2024); the CRE chapters of the Basel Framework	April 2025	Read first. Start with the principle on limits and the principle on concentration; together they are two pages.
[20]	NIST SP 800-39, SP 800-37 and SP 800-30 csrc.nist.gov SP 800-39, Managing Information Security Risk (March 2011); SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations (December 2018); SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (September 2012)	2011 to 2018	Read first. Start with the chapter of SP 800-39 on the three tiers and the four components, then the task tables of SP 800-37 for the authorize and monitor steps; SP 800-30 only when you need the risk model and the example scales.
[21]	NIST AI Risk Management Framework airc.nist.gov AI RMF 1.0 (January 2023, under revision) and the Playbook, on the AI Resource Center; Generative AI Profile (NIST AI 600-1, July 2024); Cyber AI Profile (draft, 2025); ARIA and Dioptra	1.0, 2023; profiles 2024 to 2025; revision in progress	Read first. Start with the seven characteristics in part one, then the Measure function, then the table of twelve risks in the generative profile; check the Resource Center for the revised numbering before relying on the one given in this book.
[22]	World Economic Forum Global Risks Report weforum.org Global Risks Report 2026 (21st edition, January 2026), with the chapter “Overview of methodology” in the full text	2026 edition	Read first. Start with the methodology overview and the table of the thirty-three risks by category; the rankings are the headline, the method is what you can reuse.
[23]	NIST Cybersecurity Framework 2.0 nist.gov The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29, February 2024), with the online reference tool and the quick-start guides; the IR 8286 series as the bridge to enterprise risk	2.0, February 2024	Read first. Start with the Govern function, GV.RM in particular, then the short sections on tiers and on building a profile.
[24]	UNDRR Sendai Framework and Hazard Information Profiles undrr.org Sendai Framework for Disaster Risk Reduction 2015 to 2030; the 2017 terminology; Hazard Information Profiles, 2025 update (4 June 2025, 281 hazards with persistent identifiers, with the International Science Council); Global Assessment Report 2025; Early Warnings for All	Sendai 2015; profiles updated 2025	Read first. Start with the terminology entry for “disaster risk”; it is the grammar everything else assumes.
[25]	EBA stress testing eba.europa.eu EU-wide stress test 2025 (methodological note, January 2025; results, August 2025); Guidelines on institutions' stress testing (EBA/GL/2018/04); press release of 11 June 2026 on the 2027 exercise and its climate module	2025 exercise; 2018 guidelines; 2026 consultation	Read first. Start with the guidelines' section on management actions, then the credit chapter of the methodological note.
[26]	risk-engineering.org open course risk-engineering.org Open course in risk engineering by Eric Marsden: Monte Carlo methods for risk analysis (updated 7 October 2026), sensitivity analysis, risk acceptability and reliability; CC BY-SA 4.0, with notebooks that run in the browser	October 2026 update	Read first. Start with the Monte Carlo slides, run the pi and Saint Petersburg notebooks, then read the acceptability slides for ALARP.
[27]	Financial Stability Board fsb.org Promoting Global Financial Stability, 2025 Annual Report (March 2026); Work Programme for 2026 (February 2026); Format for Incident Reporting Exchange (FIRE), final report and taxonomy package (April 2025); the report on artificial intelligence in financial services (November 2024); the third-party risk toolkit (December 2023); non-bank leverage (2025) and private credit (2026)	2024 to 2026	Read first. Start with FIRE's annex listing the information items; it is short.