Blog

Most organisations with critical risk obligations believe they’re doing verification. Often, they’re doing something that looks like verification but functions like documentation. Here’s how to tell which one you’re doing.

Critical control verification cadence shouldn’t default to audit cycles or gut feel. Here’s how to set a starting frequency — and how to know when to adjust it.

Having a critical control and having an effective one aren’t the same thing. Here’s what “effective” means in this context – and why the distinction matters.

Having a critical control and having an effective one aren’t the same thing. Here’s what “effective” means in this context – and why the distinction matters.

Critical risks aren’t just serious hazards – they’re a specific category that demands a greater focus of resource and effort. Here’s what that means in practice.

Critter was built because IMPAC kept seeing the same gap: organisations with critical controls documented, and no reliable way to verify they were in place and working.