Build a Business-Driven IT Risk Management Program

Info-Tech Research Group 1Info-Tech Research Group 1
Info-Tech Research Group, Inc. is a global leader in providing IT research and advice.
Info-Tech’s products and services combine actionable insight and relevant advice with
ready-to-use tools and templates that cover the full spectrum of IT concerns.
© 1997-2016 Info-Tech Research Group Inc.
Build a Business-Driven IT Risk Management
Program
Hope is not a risk management strategy.
Info-Tech's products and services combine actionable insight and relevant advice with ready-to-use tools
and templates that cover the full spectrum of IT concerns.© 1997 – 2016 Info-Tech Research Group

When most CIOs and IT leaders think of risk, their minds immediately jump to
the latest security threat making headlines.
While security is an important part of IT risk, it is only one component. Risk
across IT requires a holistic perspective, driven by the needs and priorities of
the business. Failing to understand the true business ramifications of IT risk
exposes the business to IT-related threats, or leads to overspending on low-
priority initiatives. Like good leadership, risk management must be proactive,
dynamic, and constantly improving. In the modern IT risk environment, hoping
for the best is not an acceptable strategy for managing risk – and the line
between optimism and negligence is razor thin.
Use this blueprint to build a right-sized, business-driven risk management
program with minimal effort.
Scott Janz,
Consulting Analyst, CIO Advisory
Info-Tech Research Group
A good security practice is not enough to manage IT risk.
ANALYST PERSPECTIVE

This Research is Designed For: This Research Will Help You:
This Research Will Assist: This Research Will Help You:
This Research Is Designed For: This Research Will Help You:
This Research Will Also Assist: This Research Will Help Them:
Our understanding of the problem
Any IT Leader responsible for IT risk
management in their organization.
Any CIO mandated to integrate IT risk
management with their organization’s central risk
management function or Enterprise Risk
Management (ERM).
Any IT Director or Manager undertaking a risk
assessment.
Any IT Director or Manager responding to or
preparing for an IT audit.
Establish a comprehensive IT risk
management program that exposes your IT
risks.
Create a strategy for managing and mitigating
risks to meet your organization’s risk appetite.
Quantify risk exposure in meaningful financial
terms.
Build business buy-in and shared
accountability for business-impacting IT risks.
Enterprise Risk Management
Senior Leadership
Develop consensus on organizational risk
appetite.
Establish a framework and metrics for
acceptable risk tolerance.
Align business and IT risk management
objectives.
Enable the business to make informed
investments when managing IT risks.

Resolution
Situation
Complication
Info-Tech Insight
Executive Summary
• Risk is unavoidable. Without a formal program to manage IT risk, you may
be unaware of your severest IT risks.
• 66% of organizations do not formally manage IT risk.1
• IT risk is business risk – however, IT is often left to manage risk
independently.
• Reacting to risks AFTER they occur can be costly and crippling, yet is
one of the most common tactics used by IT departments.
• Security risk receives such a high profile that it often eclipses other
important IT risks, leaving the organization vulnerable.
• Failing to include the business in IT risk management leaves IT leaders
too accountable; the business must have accountability as well.
• Stop leaving IT risk to chance. Transform your ad hoc IT risk management processes into a formalized, ongoing program
and increase risk management success by 53%.2
• Take a proactive stance against IT threats and vulnerabilities by identifying and assessing IT’s greatest risks before they
occur and have serious implications.
• Involve key stakeholders including the business senior management team to gain buy-in and to focus on IT risks that
matter most to the organization.
• Share accountability for IT risk with business stakeholders and have them weigh-in on prioritizing investments in risk
response activities.
1. IT risk is business risk.
Every IT risk has business implications.
Create an IT risk management program
that shares accountability with the
business.
2. Risk is money.
It’s impossible to make intelligent
decisions about risks without knowing
what their financial impact will be.
3. You don’t know what you don’t know.
And what you don’t know can hurt you.
To find hidden risks, you must utilize a
structured risk identification method.
1: ESI International
2: Info-Tech Research Group, 2013, N=76

Poor IT risk management is expensive
The Wall Street Journal
The Washington Post
BBC
Computer Business Review
The Guardian
IT RISK IS HEADLINE NEWS
The Australian

STRATEGY &
GOVERNANCE
APPS DATA & BI
IT Governance
Application Portfolio
Management
Business Intelligence
& Reporting
Effectiveness = 5.7
Importance = 8.3
Effectiveness = 5.4
Importance = 8
Effectiveness = 5.4
Importance = 8.1
IT Strategy
IT Management &
Policies
Security Strategy
Enterprise Application
Selection &
Implementation
Data Architecture
Effectiveness = 6
Importance = 8.5
Effectiveness = 6
Importance = 8.3
PEOPLE & RESOURCES SECURITY & RISK Effectiveness = 6.3
Importance = 8.7
Effectiveness = 6.1
Importance = 8.3
Effectiveness = 5.6
Importance = 8.2
Performance
Measurement
Innovation
Human Resources
Management
Security Management
Business Process
Controls & Internal
Audit
Application
Development
Throughput
Data Quality
Effectiveness = 5.1
Importance = 7.8
Effectiveness = 5.7
Importance = 7.9
Effectiveness = 6.1
Importance = 8.3
Effectiveness = 6.5
Importance = 8.9
Effectiveness = 5.4
Importance = 7.9
Effectiveness = 5.4
Importance = 7.4
Effectiveness = 5.5
Importance = 8.5
Business Value Stakeholder Relations
IT Organizational
Design
Enterprise
Architecture
Availability & Capacity
Management
Change Management Risk Management External Compliance
Application
Development Quality
Portfolio Management
Effectiveness = 6.2
Importance = 8.4
Effectiveness = 6.2
Importance = 8.7
Effectiveness = 6.3
Importance = 8.3
Effectiveness = 5.7
Importance = 8.2
Effectiveness = 6.2
Importance = 8.4
Effectiveness = 6.1
Importance = 8.5
Effectiveness = 5.9
Importance = 8.3
Effectiveness = 6.4
Importance = 8.3
Effectiveness = 5.6
Importance = 7.7
Effectiveness = 5.4
Importance = 8.1
Cost & Budget
Management
Knowledge
Management
Leadership, Culture &
Values
Service Management Asset Management
Configuration
Management
Release Management Business Continuity
Application
Maintenance
Project Management
Effectiveness = 6.7
Importance = 8.4
Effectiveness = 5.8
Importance = 8.4
Effectiveness = 6.5
Importance = 8.5
Effectiveness = 6.1
Importance = 8.4
Effectiveness = 6
Importance = 7.9
Effectiveness = 5.5
Importance = 7.8
Effectiveness = 5.7
Importance = 8.1
Effectiveness = 6.1
Importance = 8.7
Effectiveness = 6
Importance = 8
Effectiveness = 6
Importance = 8.5
Vendor Management Cost Optimization
Manage Service
Catalog
Quality Management
Operations
Management
Service Desk
Incident & Problem
Management
Disaster Recovery
Planning
Organizational
Change Management
Requirements
Gathering
Effectiveness = 6.4
Importance = 8
Effectiveness = 6.2
Importance = 8.4
Effectiveness = 4.3
Importance = 7.3
Effectiveness = 5.6
Importance = 8.2
Effectiveness = 6.4
Importance = 8.4
Effectiveness = 7
Importance = 8.8
Effectiveness = 6.5
Importance = 8.7
Effectiveness = 6.1
Importance = 8.8
Effectiveness = 5.4
Importance = 8.3
Effectiveness = 5.9
Importance = 8.5
FINANCIAL MANAGEMENT PPM & PROJECTS
Above Average Importance and
Above Average Effectiveness
Below Average Importance and
Above Average Effectiveness
Above Average Importance and
Below Average Effectiveness
Below Average Importance and
Below Average Effectiveness
*Average is based on the overall average
Legend
INFRASTRUCTURE & OPERATIONS
SERVICE PLANNING & ARCHITECTURE
IT Management & Governance Framework
Benchmarking Results for the Management &
Governance Diagnostic
Risk management is a top IT priority
1. Data Quality
2. IT Governance
3. Risk Management
4. Knowledge Management
5. Requirements Gathering
6. Manage Service Catalog
7. Organizational Change
Management
8. Quality Management
9. Performance
Measurement
10. Application Portfolio
Management
Info-Tech’s Top 10
IT Improvement Priorities
Info-Tech asked over 2,500 IT professionals to rate, on a scale of 1 to
10, the importance of risk management and how effective they were at
managing IT risks.
Importance of
risk management:
Effectiveness of
risk management:
8.3
5.9
Above average importance
Significantly below average
effectiveness
For more information, see Info-Tech’s IT Management &
Governance Diagnostic.

66% of organizations lack a formal risk management program
Ad hoc risk management is often reactionary.
Ad hoc risk management is often focused
only on IT security.
Ad hoc risk management lacks alignment
with business objectives.
• Increased business risk exposure caused
by a lack of understanding of the impact of
IT risks on the business.
• Increased IT non-compliance, resulting in
costly settlements and fines.
• IT audit failure.
• Ineffective management of risk caused by
poor risk information and wrong risk
response decisions.
• Increased unnecessary and avoidable IT
failures and fixes.
If you are like the majority of IT departments, you do not have a consistent and comprehensive
strategy for managing IT risk.
1
2
• Without formalized procedures for managing IT risk, risk events
are often “managed” after they have occurred.
• IT departments that spend most of their time putting out fires
receive the lowest ratings for satisfaction and perceived value by
business stakeholders.
• Organizations must respond to the entire spectrum of IT risk.
• A client who recently completed Info-Tech’s methodology for risk
identification and assessment found that only 15 of the 135 IT
risks identified were related to security and compliance.
3 • Many IT risk assessments fail to communicate IT risks in a way
that compels the business to take action.
• 63% of CEOs indicate they want IT to provide better risk
metrics (CIO-CEO Alignment survey data, Info-Tech Research Group).
Ad hoc approaches to managing risk fail because… The results:
Most IT departments aren’t thinking
about formal risk management, and if
they are, it’s back-of-the-napkin
planning.
Ken Piddington, CIO & Executive Advisor,
MRE Consulting
1
1: ESI International

Unmanaged IT risk isn’t just bad for the organization, it’s also
bad for your career
Take luck out of the equation – “Hoping for the best” is not a risk management strategy.
Take control of IT risk and avoid leaving your job security
to chance.
The top four reasons why CIOs lose their jobs:
X
X
X
X
Security Breaches
Project Failures
Disaster Recovery Failures
System Failures
IT Risk Management
When business stakeholders are unaware of top IT threats, blame for project, security, disaster recovery, and
system failures is usually assigned to the CIO and other senior IT managers.
When effectively integrated with business risk management,
IT risk management is your best job security policy.
IT Risk Management
IT Risk Management
IT Risk Management
Source: Silverton Consulting
If I wait until a risk
event occurs, I might
be out of a job before
the business recovers.
– VP of Security and Risk,
Energy Logistics Company

Ensure that your greatest IT risks are on your radar
CASE STUDY
Focusing on internal IT security risks may not be enough to protect your organization from a breach. Learn from these
organizations whose security breaches all originated from third-party vendors.
IT vendor risks may be your greatest business
risks.
“AT&T data breaches
revealed: 280K US
customers exposed”1
1: CNBC 2: Fortune 3: Forbes 4: KrebsOnSecurity
“Home Depot faces dozens
of data breach lawsuits”2
“868,000 Payment Cards,
330 Stores Hit in Goodwill
Credit Card Breach”3
Employees at an IT service provider
stole customer names and SSNs to
request unlock codes for stolen
phones. In 2015, AT&T agreed to
settle with the FCC and pay a $25 M
fine.
Hackers stole credentials from a third-
party vendor to gain access to Home
Depot’s network, stealing data from 56
million credit cards, as well as 53
million email addresses.
Hackers breached the system of a
cloud-based card processing service
vendor, with the intrusion lasting more
than 18 months.4

Formalize risk management to increase your likelihood of
success by 53%
Survey: Info-Tech Research Group, N = 76
Risk Management Success:
Formal Strategy vs. Ad Hoc Approach
53%
81%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Ad-hoc Approach Formal Strategy
RiskManagementSuccess(%)
53% Increase
Organizations that adopted formal risk programs increased their risk management success by 53%.
Risk management is a business enabler.
Line managers often see risk management as an impediment to their
day-to-day function. But, in fact, the opposite is true. By identifying areas
of risk exposure and creating solutions proactively, obstacles can be
removed or circumvented before they become a real problem.
A certain amount of risk is healthy and can stimulate innovation.
A formal risk management strategy doesn’t mean trying to mitigate every
possible risk; it means exposing the organization to the right amount of
risk. Taking a formal risk management approach allows an organization to
thoughtfully choose which risks it is willing to accept. Organizations with
high risk management maturity will vault themselves ahead of competition
because they will be aware of which risks to prepare for, which risks to
ignore, and which risks to take.
Taking the initiative pays off. A security manager in the energy
industry saved over $80,000 by developing an IT risk management
program in-house instead of bringing in external consultants.

You don’t know what you don’t know…
…and what you don’t know can hurt you!
Developed and tested directly with our clients, Info-Tech’s Risk
Register Tool allows you to document and track a comprehensive list
of IT risk events that may affect your organization.
• Assess risk severity using acceptability thresholds developed in
collaboration with senior leadership.
• Identify and manage the top IT risks impacting the organization.
So find out using Info-Tech’s risk identification and risk assessment methodology.
Use Info-Tech’s Risk Costing Tool to put a price on your top risks.
• Calculate the expected cost of anticipated risk events.
• Calculate the expected cost of alternative risk response actions.
• Project the costs of risk response actions over multiple years to
inform risk response decisions.
• Conduct cost-benefit analyses for your top risks and select a risk
response that offers the greatest value to the organization.
Risk is money. It’s impossible to make intelligent decisions about risks without knowing how much they cost.
Use Info-Tech’s Risk Costing Tool to calculate and present the expected costs associated with accepting and
responding to high-priority risk events.

Info-Tech Research Group Helps IT Professionals To:
 Quickly get up to speed
with new technologies
 Make the right technology
purchasing decisions – fast
 Deliver critical IT
projects, on time and
within budget
 Manage business expectations
 Justify IT spending and
prove the value of IT
 Train IT staff and effectively
manage an IT department
Toll Free: 1-888-670-8889

Build a Business-Driven IT Risk Management Program

More Related Content

What's hot

Similar to Build a Business-Driven IT Risk Management Program

More from Info-Tech Research Group

Recently uploaded

Build a Business-Driven IT Risk Management Program