With all the hype and hysteria around the mounting cyber-security threats, companies are seeking to strengthen their management of IT risk.
The Wall Street Journal reported last week that some of the largest U.S. based companies are establishing technology committees at the board level to meet the need for greater governance.
However, only 15 of the Fortune 100 and 5.2% of over 1,000 U.S. based companies surveyed recently by the National Association of Corporate Directors currently have a technology committee.
So, for those companies that have not formalised their IT risk governance and oversight, what should they do?
Based on research I completed at Gartner several years ago, the following seven critical elements exist within the most successful IT risk management programs.
No. 1: Speak substantively about risk at every board meeting
It is problematic for a company to undertake a substantive risk review annually only, given today’s market volatility and shifting regulatory landscape.
Instead, boards and senior management should review risk conditions, warnings and outcomes at every meeting. In addition, opportunities for identifying newer risks from changing market conditions and compliance requirements should also be discussed with the respective business owners from the management perspective.
No. 2: Define and deploy leading risk indicators
Large-scale, catastrophic events such as the explosion of the Deepwater Horizon oil platform in the Gulf of Mexico suggest the perils of depending too heavily on lagging measures of outcomes, and, perhaps, underestimating potential risk factors.
On the day of the explosion, a team of senior leaders had traveled to the platform to celebrate its safety record, which many companies in high-hazard industries define in terms of prior outcomes.
However, outcomes can be deceptive indications of likely future developments, and measures that are well-upstream of risk results are essential to risk management.
No. 3: Explicitly link major risk areas to elements of strategy
Many companies consider their careful articulation of risks in their annual public disclosures to be a substantive examination of risks and their mitigation. However, the discussion cannot end there.
Companies must develop a thorough understanding of their risk profile as it relates to their long-term strategic plan.
By doing so, the board and senior management can then begin to adopt a more proactive, forward-looking approach to addressing the company’s risks.
