I have seen quite a lot of smaller companies (up to 50 employees) making an attempt to practice danger evaluation tools as part of their ISO 27001 implementation in Qatar project. The end result is that it generally takes too much time and cash with too little effect. First of all, what is truly chance assessment, and what is its purpose? Risk evaluation is a system at some stage in...