Risk Management

Risk Management of Your Technology and Your Business

Risk management is the monitoring for, identification of, and mitigation of threats to your business technology. In addition to any other consequences, all risks have one thing in common: Downtime.

Primary Uncertainties

1. What are the consequences if your systems fail or are breached, or suffer a prolonged outage?
2. Who has right of access to your data, both primary and backup? Can you name all people involved?
3. Where is your data stored, and what laws govern your data in the country of storage? Do your customers know about this?
4. If your data or IP found its way to a competitor or interested parties, what impact could that have on your business?
5. During a disaster the Internet is the first thing to go down. How much of disaster recovery plan relies on your Internet connection being up?
6. How is your business risk management profile changed with remote workers and BYOD (bring your own device)?
7. What systems and processes exist to monitor and manage all risks?
8. Who is accountable if things go wrong?
9. In many cases, risk management requires an understanding of the psyche and patterns of behaviour. Does your IT provider have the skill-set to do this?

The Five Areas of Impact

The five key areas of impact are related to success and failures within the Five Disciplines of IT ™.

1. Functionality
2. Reliability
3. Integrity
4. Efficiency
5. Security

The Five Main Sources of Risk

1. Strategy:  Those responsible for managing the IT systems fail to correctly identify and/or communicate the level of risks.
2. Governance:  The business management fails to understand, acknowledge, and/or act upon the identified risk levels.
3. Management:  Infrastructure and systems do not meet standards necessary to reduce the risks.
4. Compliance:  Business policies and processes do not address the risks and/or staff are not trained.
5. Operations:  Staff or owners fail to observe risk management policies.

Risk Management Mind-Set

Risk management is best carried out by a skilled IT Risk Manager.

1. Preparedness: Being prepared for, and managing risk is not some sudden, spectacular program, but a way of life and of thinking.
2. Assessment: Is not only based on past events, but future events based on present conditions and the psyche of possible players.
3. Understanding: The ability to visualise potential negative conditions requires as much understanding and foresight as visualising positives.
4. Management: Risk management requires a thorough understanding of ethics, principles, processes, people and things.
5. Foresight: Everyone can be wise in hindsight. Being wise in foresight, requires discipline and training.