A BIA? Don't do it. Risk Assessment? Skip it. Documentation? Eliminate most of it. For 20 years or more, we practitioners have followed the same best practices. But are they "proven practices?" Could there be a reason that our skills are undervalued by our organizations and leaders? Is there a better way?