Integrated risk management (IRM) is a set of practices and processes supported by a risk aware culture and enabling technologies, that improves decision making and performance through an integrated view of how well an organization manages its unique set of risks.
Under the Gartner definition, IRM has certain attributes:
- Strategy: Enablement and implementation of a framework, including performance improvement through effective governance and risk ownership
- Assessment: Identification, evaluation and prioritization of risks
- Response: Identification and implementation of mechanisms to mitigate risk • Communication and reporting: Provision of the best or most appropriate means to track and inform stakeholders of an enterprise’s risk response
- Monitoring: Identification and implementation of processes that methodically track governance objectives, risk ownership/accountability, compliance with policies and decisions that are set through the governance process, risks to those objectives, and the effectiveness of risk mitigation and controls
- Technology: Design and implementation of an IRM solution (IRMS) architecture
Integrated risk management is the combined activities of corporate governance, digital and cyber risk management, and cybersecurity-based compliance integrated into a holistic approach that enables a streamlined program, enhanced enterprise-wide visibility into the cyber posture, and meaningful automation to augment teams’ abilities and insights.
The needs of businesses today are changing. Where before the siloed approach of Governance Risk and Compliance teams operating almost independently was sufficient, this rapid increase in technology adoption has shifted the needs of information security teams and the businesses they serve.
Many forces caused the next iteration of security, privacy, and risk management to emerge: the integration of technology into business-side teams made digital risks ubiquitous across the organization, not just within technical teams. With breaches such as Equifax, Marriott, and Capital One, CEOs and Boards have seen how information security can have direct impacts on the bottom line. As the scope of IT risk assessment has expanded to include the entire business, information security leaders can no longer operate in modular and siloed teams.
Traditional Approach to Risk Management
Risk control has targeted on operational or management dangers in a number of features, particularly in finance, fitness and safety, fire, security, communications, and insurance. Those features have a tendency to function frequently and independently inside silos in an uncoordinated and unsystematic manner. But there was popularity with the aid of using senior managers that kept running in practical silos frequently and faced consequences in inefficient overlaps (and probably extreme gaps) with the average chance to manipulate strategy. It is additionally supposed no person ought to offer the board a holistic evaluation of prioritized chance profile of the organization.
The Downfall of Traditional Risk Management
Faced with the pandemic’s fast-moving, interconnected risks, organizations everywhere were left scrambling to deal with operational and financial difficulties they never contemplated, let alone planned or practiced for. If you don’t have all the facts, the action becomes nothing more than a shot in the dark.
The crisis may have sounded the alarm, but the glaring weaknesses revealed in the way risk and compliance are traditionally managed will not magically disappear when the coronavirus eventually runs its course. Even outside of crisis, today’s risk landscape is more crowded and uncertain than ever – and virtually every risk is gaining in velocity and ferocity. It’s difficult, if not impossible, to assess your true exposure with the fragmented view provided by old-school risk management techniques.
How can integrated risk management help my business?
As existing risks become more complex and new risks continue to emerge, companies need strong integrated risk management programs. Not having a clear understanding of risks and their potential effects can impede an organization’s decision-making, and harm its business performance. Organizations taking an integrated approach to managing risk will also achieve consistent risk management outcomes.
Many companies are adopting an integrated approach to risk management, enabling executives to coordinate and unify risk management activities throughout the enterprise. Integrated risk management gives organizations a better understanding of their risks and helps support informed risk-based decision-making.
The Rise of Integrated Risk management
Our always-connected world demands a similarly connected approach to risk management. To survive in a world dominated by social media, mobile devices, and relentless scrutiny by everyone inside and outside the organization, senior leaders need to rely on an increasing number of stakeholders to identify, manage, and reduce risk together.
Stakeholders across the organization need to be able to freely exchange data and ideas to proactively address accelerated and amplified risks. And all that intelligence needs to be available in real-time to top decision-makers, who must continually make hard strategic choices to drive organizational success, that takes an integrated approach to risk management.
Integrated risk management brings into focus anything that could harm your organization, its competitive position, reputation, or strategic growth. It connects the dots between every risk – insurable and non-insurable, strategic and operational – so you can understand what you’re facing, how everything interrelates, and the cumulative impact on the organization.
IRM v/s GRC v/s ERM
According to Reciprocity consultant Gerard Scheitlin, founder, and president of risk management company RISQ Management, there is no difference between IRM, ERM, and GRC. All three terms refer to enterprise-wide, integrated risk management, a program that encompasses cybersecurity, finance, human resource, audit, privacy, compliance, and natural disasters.
ERM is centered around the strategic planning, organizing, leading, and controlling of a company’s risk activities. That is, an organization examines its strategic business objectives, then reviews the information technology risks associated with them, to assure business continuity.
IRM, meanwhile, focuses specifically on analyzing the risks inherent in an organization’s technologies. Integrated risk management incorporates many elements of enterprise risk management, but it’s typically more focused on IT functionality. According to business research and advisory company Gartner, IRM involves the hands-on work that makes ERM possible: the technical controls critical to effective cybersecurity such as security monitoring, network monitoring, and perimeter protection.
Both IRM and ERM provide a holistic model of risk management, including IT risk and operational risk, and are integrally related. You can’t have one without the other: IRM feeds ERM, and ERM guides IRM.
The idea of Governance Risk and Compliance (GRC) is not new to the information security industry. For years, GRC approaches and solutions have enabled organizations to operate cybersecurity teams for all three of those functions (corporate governance, IT risk, and industry and geographic compliance). The triggers that have caused the shift away from a siloed approach have also caused information security leaders to seek out integrated risk management as a means to align their entire information security organization to deliver on these new expectations.
Towards More Integration
The techniques of risk identification, evaluation, analysis, and control are equally applicable to all risk management functions whether operational or financial as the methodology behind them is the same.
Though some specialist knowledge will be required, an integrated approach essentially requires good planning, teamwork, and communication; sharing ideas and technical knowledge. The diversity inherent in an arrangement where professionals from different backgrounds and disciplines interact and challenge assumptions can often lead to striking insights and alternative approaches. Indeed it is often individuals with the least experience in an area that can ask the most insightful questions, having as they do no long-held assumptions about what can and can not be asked.
How to implement Integrated Risk Management? There are four pillars to implementing an integrated risk management program:
➢ Aligning your cyber strategy with business outcomes: The new role of CISO is acting as a bridge between technical cybersecurity teams and business-side stakeholders and executive management. The critical step is to ensure that you align your cyber strategy and tactics with the business outcomes that executive management is seeking to achieve. Start by asking yourself what identified risks you’re investing the most time and effort in mitigating. What are the disruptions caused by those risks if left unprotected? Is your company enabling technologies that improve performance through an integrated view of risk?
Sharing your knowledge helps the entire organization recognize that security is now an organization-wide effort that everyone must be aware of and participate in. This shift also allows non-technical business leaders to make more informed strategic decisions for their respective business units within the context of digital risk and the unique set of risks they may face.
➢ Facilitating a risk-aware, risk-engaged culture: Any goal of shifting an organizational culture can appear daunting, but with the right amount of patience and correct approach, it is possible. As a CISO, it is critical to ensure that you have buy-in from allies and colleagues within the C-suite to support your effort of shifting culture. CyberSaint partner’s experience, these positions as first alliances prove true. In one of these case studies, they worked with a Fortune 100 entertainment company, and their point of contact was the Director of IT. The IT Director knew that they needed to increase risk awareness across the organization and began soliciting buy-in from the CIO and the COO. The reason for this choice was that with the CIO’s technical understanding and the COO’s process of identifying ownership of employee development, these two would be the IT Director’s best evangelists as the program grew. The results were stunning. Once the IT Director, CIO, and COO had established the needs and goals they began expanding in concentric circles – going from three to 15 to 100 and so on until they did alter the company culture.
A culture change of any kind is daunting – it is a journey that requires patience, diligence, and constant vigilance to ensure that the new ideas remain and scale with the organization. For CISO’s working to increase cyber risk awareness at their organization, stating that you are going to change the culture is like saying you’re going to change the direction of a river – it is possible, but you have to start small. Start with critical stakeholders that will facilitate the change with you and be prepared to evangelize.
➢ Integrating risk into business strategy discussions: CISOs implementing an IRM program must see the give and take between business growth and security. Any strategic decision or new business growth shifts the risk landscape and could impact business. In today’s business world, the assumption is that new business growth is in some way related to technology and as such increases the digital risk profile of the organization.
Effective risk management activities result in secure growth for the business. Although, too many CISOs see any residual risk as a failure to do their job. However, a risk-aware culture enables the organization to effectively convey the decisions of which risks to address, and why a set of practices exists. This transparency is imperative to ensure that the whole organization knows where it stands on risk management activities.
➢ Effectively reporting on a risk-based approach: If it’s not measured, it’s not managed. Shifting from a checklist compliance-based approach to integrated risk management will change the way your security organization reports on its success. An integral value of an integrated approach to risk and compliance is the powerful insights that leaders can glean from all of that information being in one place. Where cybersecurity organizations would previously have to spend weeks or months generating reports from scores of spreadsheets and risk registers, using an integrated approach and an IRM program not only delivers better stories and insights but automates much of the reporting process.
Accepting Responsibilities
Whatever the job description risk management in all its forms is always everyone’s responsibility not just that of specialists who have the term in their job title. The simple reason for this is that for every major incident there will be thousands of smaller incidents that collectively will present significant avoidable costs to organizations and which offer clear warning indicators of issues that need to be addressed before a major incident occurs. Major incidents are commonly accepted to be the tip of the iceberg, and if organizations which to reduce the frequency and severity of accidents they need to address the underlying causes of such incidents by learning from previous, preferably lesser, events.
To really address the issue of incident prevention the first steps are to identify, evaluate and control threats. To be effective this needs to be a team effort involving the entire organization with everyone taking responsibility for initiating and implementing opportunities for organizational learning. The first step in this is to increase risk awareness and alter the organization’s risk cognition. This is best done through regular communication activities and most importantly extensive training so that each employee understands their risk management roles and responsibilities as well as how they are to implement key risk controls.
The key to addressing how employees support risk control measures is to build an awareness of how a threat to the business is also a threat to each employee’s job security, threatening as it does the very existence of the organization. For example, tolerating colleagues smoking in authorized places could cause a fire that would effectively destroy the business. A lack of vigilance within the company premises can encourage petty theft and perhaps lead to more serious crimes or a steady fall in company morale. However to be responsive to such risks employees need to be aware of them, understand how to control them and how to implement such measures. This requires training and good internal communications. Unfortunately in the industries that I have had experience with, many employees still perceive such risk management activities as ‘somebody else’s job’.
The Benefits of IRM
A well integrated risk management solution can bring a number of benefits, including:
➢ More agile, risk-based decision making, based on having one view of top risks ➢ Bridging the strategy/execution gap, assuring that project delivery is tied to the business’s organizational needs and vision
➢ Identifying risks at the strategic level, which could have a major effect on the entire company
➢ Empowering companies to manage these risks
➢ Understanding that risks across the business create opportunities for cost savings, competitive advantages, and alignment
➢ Enabling organizations to take the initiative with those opportunities, rather than just reacting to them
➢ Minimizing cybersecurity threats and maximizing opportunities, boosting the chances of achieving strategic and operational objectives
➢ Providing management with useful information to aid the decision-making process ➢ Helping companies create risk-aware cultures, so employees understand that risk exists in all levels of the enterprise and that they can (and should) manage that risk smartly, reaping the most benefits
➢ Improving operational efficiency by reducing the costs and cycle times of risk assessments. An integrated risk management framework is the formal, structured approach to governing risk. Applying an integrated risk management framework allows organizations to evaluate their risks by connecting the objectives, the organization’s functional departments, and the components of a risk assessment. The industry standards that help to establish strong cybersecurity control often refer to IRM frameworks.
The challenges in realizing IRM Technology benefits
Given the challenges presented by the current business environment, perhaps it’s not surprising that many organizations are struggling to realize true IRM and the benefits that it brings. Tellingly, 72 percent of financial services risk managers surveyed by Accenture say that complex, interconnected new risks are emerging at a more rapid pace than ever before. There are complexities and obstacles that span people and culture, processes, technology, and data.
➢ People: The small percentage of organizations reporting success in building a data-centric and data-literate culture have a fluid workforce equipped with the right skills. The lack of an enterprise strategy and C-level sponsorship for IRM can amplify these problems.
➢ Process: Companies have standardized processes across many risk functions, but many have not yet addressed implementing the technology to support these processes. Non-standardized risk processes with one-off customizations can result in difficult implementations of capabilities such as machine learning.
➢ Technology: Outmoded legacy tools from the GRC era have made it difficult to implement IRM across an entire risk organization. An additional complication is that risk organizations have historically operated in silos, with different technology solutions supporting individual risk functions. The resulting ecosystem looks more like a maze than a coherent blueprint.
➢ Data: Poor data quality results in only a third of firms trusting their data enough to use it effectively and derive value from it. Companies also find it hard to control and manage data at scale, inhibiting their ability to operationalize and use it for strategic purposes.
Concluding
Shifting from a modular approach to managing cybersecurity and compliance, to integrating security, privacy, and risk is a daunting proposition. An integrated risk management approach requires security leaders to commit to the journey, not just for their teams and organization but the entire business as a whole. It will be challenging and the change won’t always be easy, but with the right allies, tools, and approach you and your organization can make the shift to integrated risk management.
Bringing the power to your hands with a complete management and visualization support to make use of capabilities in the organization Zeron provides complete solution to manage your events and risks with complete ticketing system and advance defensive mechanisms.
