Knowledge base · v1
The reasoning behind the numbers.
Methodology guides, worked examples, and a glossary covering every tool in the Monty & Co suite. Written for risk professionals — the tools assume you know what a control is and the docs do too.
Methodology
Concept guides — what bow ties model, how Monte Carlo works, why distributions matter, and how a risk matrix actually carries decision weight.
What is a bow tie?
Grounded in the ISO 31000 family: how to build and read one, step by step, from the event of interest through barriers and escalation factors to what the technique cannot show you.
Monte Carlo basics for project risk
Why simulating thousands of outcomes beats one deterministic estimate, how to read P50 / P80 / P90, why the choice of level is not yours to make, and why percentiles must never be added together.
Probability distributions in PRQ
Triangular, PERT and fixed: when to reach for each, what the parameters mean, how to elicit them in a workshop, and which of them the current standard actually names.
Risk matrices and the residual / target / appetite triple
Working out the rating is analysis; drawing it on a grid is communication. How to rate a risk, how to design scales that survive scrutiny, and the limitations the standard itself states.
What is single-event risk quantification?
Quantify one risk event with Monte Carlo: when to reach for it instead of PRQ, how multi-driver causes and impacts aggregate, and how a treatment earns its cost at the margin.
Risk treatment: options, plans and controls
The seven options of ISO 31000:2018 clause 6.5.2, how an implemented treatment becomes a control, what a treatment plan must actually contain, and which slice of the loop each tool carries.
Risk appetite, tolerance and criteria
The three terms that decide what 'acceptable' means, per ISO 31073:2022 and ISO 31000:2018: who sets each, how a matrix is criteria made visible, and why a funded percentile is an appetite decision.
Reading simulation outputs
The histogram tells the story, the S-curve makes the decision, the tornado says where to look next: reading Monte Carlo results per IEC 31010 B.10.4 and the Commonwealth guidance, with the health warnings attached.
Accounts and cloud sync
Why Monty & Co is local-first by default and cloud-synced when you sign in, what magic-link auth does (and why no passwords), how migration between local and cloud works, and how multi-device behaviour resolves.
Tools
Practical usage guides for the tools currently shipping. Walk through every panel, every export, every assumption — written assuming you know risk, not the UI.
Using Beau-Tie
Build a bow tie diagram from scratch: causes, controls, the central event, consequences, ratings, and exports.
Using Project Risk Quantification
Run a Monte Carlo simulation: set up the project header, populate the register, choose iterations, optionally specify correlations, and read the results.
Using Event Risk Exposure
Set up a single-event Monte Carlo model: the event, multi-driver causes + impacts, existing controls + treatments with shared targets, then run baseline-vs-treated and read the cost-benefit.
Using GeoRisk
Read the country ratings properly: what the four bands mean, how coverage floors and 'Insufficient data' work, when a sanctions override moves a band, and what a frozen snapshot promises.
Examples
End-to-end walkthroughs against the in-app sample data. Open the tool alongside the article and follow exactly what the example does.
Walkthrough — Cybersecurity data breach (Beau-Tie)
Map a customer-data-breach scenario in Beau-Tie: four causes, two consequences, eleven controls, and the residual / target ratings that drive the treatment plan.
Walkthrough — Acme Platform Migration (PRQ)
Quantify the cost-risk exposure of a $1.5M cloud migration: four risks, two distributions, 10 000 iterations, and the contingency that falls out at P80.
Walkthrough — Customer data breach (Event Risk)
Quantify a customer-data-breach event end-to-end: two cause drivers (phishing + insider), two impact dimensions (regulatory + reputational), shared controls + dual-target treatments, and per-treatment ROI.
Reference
Risk and Monte Carlo terminology used across the suite, anchored to ISO 31000:2018 vocabulary where it diverges from common usage.