How to Strengthen Your IT Risk Management Program

An essential component of any Enterprise Risk Management (ERM) program today is IT risk management. With ever-increasing threats to privacy and information security, companies are looking to strengthen their risk governance processes in many ways.

A recent survey by Carnegie Mellon University’s CyLab highlights ten key steps to building a stronger ERM program with a focus on IT Risk. The CyLab 2010 survey is based on results received from 66 respondents at the board or senior executive level from Fortune 1000 companies. Twenty-seven percent of the respondents were board chairmen; 3 percent were outside directors; 47 percent were inside directors; and 50 percent were senior executives but not a board member. Forty-five percent of the participants were from critical infrastructure companies.

The survey revealed that governance of enterprise security is lacking in most corporations, with gaps in critical areas. If boards and senior management take the following ten actions, they can significantly improve their organizations’ security posture and reduce risk:

1. Establish a board risk committee separate from the audit committee and assign it responsibility for enterprise risks, including IT risks. Recruit directors with risk and IT governance expertise.

2. Ensure that privacy and security roles within the organization are separated and responsibilities are appropriately assigned. The CIO, CISO/CSO, and CPO should report independently to senior management.

3. Evaluate the existing organizational structure and establish a cross-organizational team that is required to meet at least monthly to coordinate and communicate on privacy and security issues. This team should include senior management from human resources, public relations, legal, and procurement, as well as the CFO, the CIO, CISO/CSO (or CRO), the CPO, and business line executives.

4. Review existing top-level policies to create a culture of security and respect for privacy. Organizations can enhance their reputation by valuing cyber security and the protection of privacy and viewing these as corporate social responsibilities.

5. Review the components of the organization’s security program and ensure that it comports with best practices and standards and includes incident response, disaster recovery, and breach response plans.

6. Establish privacy and security requirements for vendors based on key aspects of the organization’s security program, including annual audits or security reviews.

7. Conduct an annual audit of the organization’s enterprise security program, to be reviewed by the audit committee.

8. Conduct an annual review of the enterprise security program and the effectiveness of controls, to be reviewed by the board risk committee, and ensure that identified gaps or weaknesses are addressed.

9. Require regular reports from senior management on privacy and security risks and review annual budgets for IT risk management.

10. Conduct annual privacy compliance audits and review incident response and security breach notification plans.

These steps should be integrated into a holistic enterprise risk management approach to provide an effective and seamless program that is fully embraced at all levels within the organization. Doing so will not only raise a company’s risk mindfulness level, but also secure positive returns for key investors and stakeholders for years to come.

Risk Won't Wait

After several years of delaying funding on risk management and IT security due to economic pressures, more and more companies are realizing that they cannot wait any longer. The stakes are simply too high to rely on outdated technology and a bare-bones approach to addressing ever-increasing risks.  Here is what was reported in InformationWeek magazine earlier this week,

A unique convergence of circumstances makes this the perfect time to bring IT and business units together under the flag of a risk-oriented approach to security. Economic stress and cutthroat competition on a global scale mean every dollar you spend on security had better matter. Executives are increasingly being held personally accountable, and unified risk management as a discipline is finally reaching maturity.

Plus, the money is there. Thirty-five percent of the 563 respondents to our InformationWeek Analytics IT Risk Management Survey say their companies' IT risk management programs will get more funding in 2011 than they did last year. Very few will see cuts.

Don't be left behind. With leaps in technology occurring in a matter of months rather than years, no company can afford to delay their improvements in risk management.

IT Organizations Adjust to "New Normal"

The "new normal" is taking hold as businesses emerge from the economic recession and look to 2010 and beyond. Greater emphasis on disciplined decision making supported by a complete understanding of associated risks will become part of the norm.  To that end, one of the major Information Technology ("IT") market intelligence firms, IDC, recently published a report on what IT organizations should be doing to adjust to the "new normal".  Here is what IDC suggests as priorities for IT organizations.

1. Cost and Funding Management: IT organizations will increasingly be forced to develop cost profiles, including the business value of solutions, to support investment decisions. This will not be an easy or pleasant task, and has been a requirement that has dogged IT organizations for years.


2. Sourcing and Platform Strategies: As new options become available to achieve an IT or business objective, IT organizations will have more room to experiment, innovate, and change, but will also have to justify their choices more conclusively.


3. Equipment Leasing and Software Financing: Commercial organizations will return to IT leasing and financing as a means of bolstering their access to IT resources.


4. Life Cycle Management: IT organizations have already extended the planned deployment of many major systems, but they still need to develop the tools and management processes to quantify the underlying cost implications of these longer asset lifecycle models.


5. IT Financial Management Tools: As IT platforms and business processes increasingly move toward a mix of in-house and third-party provision, the need for IT financial management software, tools, and best practices to better enable IT organization operational decision-making will become apparent.

Does your IT organization have the necessary tools and supporting business practices to operate in this new environment?  If not, Wheelhouse Advisors can help.  Visit www.WheelhouseAdvisors.com to learn more.

Building Trust to Support Growth in 2010

This week, Information Technology ("IT") executives from around the globe have gathered in Orlando at the Gartner Symposium/ITxpo.  A big focus of the event is how IT can become more transparent and accountable in order to support business growth in 2010.  The key is balancing risk management with performance management.  Here is what Gartner analysts have to say on the subject.

Risk management is about accepting that IT organizations cannot protect the company from everything, so they will have to make conscious decisions about what they will do to protect themselves, and what they will not do. They must learn to balance risk and performance. People need IT organizations to share information, so that they can trust them. IT leaders should accommodate letting outside information in, and sharing inside information appropriately. CIOs shouldn`t think they can shut down the two-way flow of information because they can`t stop it.

Gartner analysts said that the quality of data underpinning metrics such as measuring business productivity, profits, value, and efficiency of services delivered is inadequate. This stems from siloed and inconsistent business data, and from an over reliance on spreadsheets. Even where there have been investments in business intelligence, it`s not giving the business what it needs. The challenge for IT leaders is getting the information that everyone can believe in, and that everyone in the organization will trust. "IT leaders need robust information architectures and governance, coupled with data quality and integration capabilities to create an enterprise view across these silos," said Nigel Rayner, research vice president at Gartner. "You will need to rationalize and link performance measures across the business in an enterprise metrics framework. When the data is consistent, and everyone believes it, then you have built trust."

Wheelhouse Advisors recently partnered with Apptio, the leading provider of IT Financial Management solutions, to help companies achieve a balanced risk and performance management approach. Apptio’s on-demand IT Financial Management solutions provide greater visibility into the cost, utilization and operations of IT products and services so that businesses can identify ways to reduce IT costs, make better IT decisions and provide the business with a true Bill of IT. World class companies such as Blue Cross Blue Shield of Kansas, BNP Paribas, EMD Chemical and Starbucks use Apptio’s IT cost analysis capabilities to reduce cost and achieve greater visibility into their IT costs and cost drivers. For more information, please visit www.apptio.com.