Menu
INSIGHT: Top 7 ways to IT Risk Management success

INSIGHT: Top 7 ways to IT Risk Management success

With all the hype and hysteria around the mounting cyber-security threats, companies are seeking to strengthen their management of IT risk.

With all the hype and hysteria around the mounting cyber-security threats, companies are seeking to strengthen their management of IT risk.

The Wall Street Journal reported last week that some of the largest U.S. based companies are establishing technology committees at the board level to meet the need for greater governance.

However, only 15 of the Fortune 100 and 5.2% of over 1,000 U.S. based companies surveyed recently by the National Association of Corporate Directors currently have a technology committee.

So, for those companies that have not formalised their IT risk governance and oversight, what should they do?

Based on research I completed at Gartner several years ago, the following seven critical elements exist within the most successful IT risk management programs.

No. 1: Speak substantively about risk at every board meeting

It is problematic for a company to undertake a substantive risk review annually only, given today’s market volatility and shifting regulatory landscape.

Instead, boards and senior management should review risk conditions, warnings and outcomes at every meeting. In addition, opportunities for identifying newer risks from changing market conditions and compliance requirements should also be discussed with the respective business owners from the management perspective.

No. 2: Define and deploy leading risk indicators

Large-scale, catastrophic events such as the explosion of the Deepwater Horizon oil platform in the Gulf of Mexico suggest the perils of depending too heavily on lagging measures of outcomes, and, perhaps, underestimating potential risk factors.

On the day of the explosion, a team of senior leaders had traveled to the platform to celebrate its safety record, which many companies in high-hazard industries define in terms of prior outcomes.

However, outcomes can be deceptive indications of likely future developments, and measures that are well-upstream of risk results are essential to risk management.

No. 3: Explicitly link major risk areas to elements of strategy

Many companies consider their careful articulation of risks in their annual public disclosures to be a substantive examination of risks and their mitigation. However, the discussion cannot end there.

Companies must develop a thorough understanding of their risk profile as it relates to their long-term strategic plan.

By doing so, the board and senior management can then begin to adopt a more proactive, forward-looking approach to addressing the company’s risks.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags Gartnerrisk managementsecurity

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Show Comments