Risk Management | Governance Risk & Compliance

What is Risk IT?

Better decision-making requires transparency into all risk information gathered at your organization. It also requires the ability to prioritize that information by assessing the risks related to organizational goals, resources, controls, and test monitoring.

Business values means looking at where yous pend time and money so you can prioritize resources and resolve confusing or contentious issues. In the risk ERM/eGRC space, some people think that business value is synonymous with reduced regulatory fines; because of the results of recent studies and reports. However, we risk managers know that regulatory risk is just a piece of the business value ERM can offer.

The purpose of a risk assessment is to bring context to other things. Assessments by themselves are like adjectives to nouns. Controls, tests, tasks, and resources are very expensive and risk assessments add priority to these activities, helping you understand how critical each one is.

Every organization has overlapping and redundant controls, tests, and metrics. All these excess activities are obstacles that prevent you from achieving a truly efficient risk management program. As risk practioners, we know we could always improve our programs, but the best path toa ccomplishing this goal isn't always clear.

However, by adopting a standardized and objective best-practice risk assessment methodology, you can start to identify the overlapping activites that crowd your program, priotize actions, and help your organization make more informed decisions.

Why do I need Framework to navigate Risk Management?

Think of Framework as your birds eye view. It allows you to look at your entire risk system from above, as a whole. Companies without Framework are facing the challenge of not being able to look at risk as a whole while comparing information across departments. Here are a few examples:

Activity Fatique

Staff may ignore certain activities because of lack of time to access them.

Activity Obsolescence

In a changing environment, there is no effective way to know when activities no longer apply.

Lack of Prioritization

Picking activities to focus on is likely to be on an ad hoc basis and subject to the whims of current staff.

Lack of Continuity

Changes in the organization or development of new business lines may result in new activities even though existing ones are more effective.

Lack of Coordination

Often, activities apply to multiple risks or commitments across functional lines. The inability to formally tie activities to risk or commitments hinders inter-functional coordination, resulting ina business silos and duplication of effort.

Wasted Resources

The number of resources available for accomplishing business goals and treating risk is finite. Staff will too often continue to manage obsolete or unimportant activities rather than re-aligning with current imperatives. If a risk changes, most organizations have no way of knowing how (or even if) these changes will affect their resources and activities. Risk assessments and linking risks to activities allows organizations to start prioritizing what activities need to be monitored.