I've just posted a short article on the limitations of risk assessment on my Infosecurity blog. Those of you who've read my book on Managing the Human Factor in Information Security will know I have many concerns about the practice of risk management, though I also take the view that it's an essential governance tool that's most definitely here to stay. I do however believe that we need a better, stricter approach to information security management.