GRC Journal - (Page 4) OffICER IT: MANAGING YOuR ENTERPRISE’S RISkS Governance, Risk & Compliance increasing business complexity, the interdependency of risks, the increasing fragmentation and duplication of effort, and most importantly, the increased accountability required by investors and governments. Today, management of compliance and risk is typically facilitated in separate organizational silos, independent from mainstream processes and decision-making. It is very dependent on human capital as “middleware” to traverse the fragmented technologies implemented to facilitate control, monitoring, and management. Organizations have been experiencing the high costs of ad-hoc compliance management (around SOX, Basel2, HIPAA) for several years; now that it’s clear that compliance and risk management are a way of life and not just a short-term political issue, companies need to rationalize their approach. IT is seen as the likely and appropriate way to do that. What are the attributes of a “risk intelligent” CIO? BW: It used to be that the main focus of a CIO was to look at risk from a systems perspective, making sure that the systems and network were available and supported. Today’s CIO must have a good grasp of the business issues and a perspective on risks that the business faces from an enterprise-wide level – not just from a technology perspective. Previously, the CIO’s main skill set was around technology; now, CIO’s must not only have strong technology backgrounds, but also business savvy, risk management, and partnering skills as well. A CIO should embrace innovation and change by leveraging lessons learned, how technology and effective solutions can address risk factors, supporting governance and compliance activities, and empowering people to address risks at all levels of the organization. It is crucial that a CIO look both internally and externally to their organizations, gathering information and assessing risks from many disparate sources. Today’s CIO must look beyond his/her own team and systems and interact with senior management across an enterprise to fully understand the needs and strategies within the organization that they support. It’s only with this “higher” view that today’s CIO can truly be “risk intelligent.” JM: As the role of IT has become more central to the operation of today’s enterprise, the role of the CIO has to become more aligned with all of the business priorities. Years ago, CIOs routinely came from the IT function, generally having grown up around the applications’ development. Today, many CIOs arrive directly from the business or at least having mandates that come directly from the business operations. Today’s CIOs also have the challenge of managing and integrating internal systems with those from both business partners and outsourcing agents. In this environment, the CIO must not only reduce the costs of IT operations, but also help manage external costs and risk, like those specific to compliance and audit. There are many attributes that will help a CIO best align and meet these challenges. Among many others, three stand out: • The ability to adapt to the business demands, especially those being expressed from finance and the board room. These demands are often cross-functional and require large cross-system or even enterprise-wide solutions. The ability to balance both business risk against technical risk will be critical to play a valuable role at the table with other C-level executives. • An ability to build and maintain a nimble IT organization. In early phases, reducing the costs of compliance may be possible with static projects. But as organizations desire the ability to manage risks more holistically, the demands on IT are likely to evolve rapidly. • A complete understanding of how technology can be applied and extended. While organizations are limited by their current implementations and investments, there are often incremental additions that can provide tremendous information and control even within existing business processes. Such a CIO will be pushing his teams to understand such options and capabilities while maintaining a pragmatic focus. AC: Tech-savvy: new opportunities to leverage technology for risk management come up all the time – whether through the use of collaboration tools like wiki and blogs, or advanced monitoring of network traffic. Long-term planner: while many CIOs focus solely on the risk management tasks at hand, it is critical to do serious business continuity planning and crisis planning for events that could arise in the future. Scenario analyses and stress tests can ensure that business will be able to proceed even in times of severe events. Cross-enterprise view: constantly considers ways to break silos of geography, functions, and systems so that managers and information workers have access to the information they need to ensure that business performance is predictable. Good at identifying synergies across the enterprise. Sensitivity: build relationships with CEO and other key stakeholders, understand how to build and communicate a vision, tactical judgment and how to communicate decisions when outsourcing should be considered as an option. Understand the business: by understanding the business, its key objectives, and strategic goals, the risk intelligent CIO can make sure IT is set up to deliver. The CIO’s team can get involved in reviews and streamlining of business processes to make sure that all of the information available is being appropriately leveraged. What is the role of technology in risk management? JM: Risk and compliance management are clearly critical areas for applying technology. But unlike other business processes, managing risk and compliance within an organization must successfully merge policy, information, and technology. There will always be many approaches that customers and vendors consider, ranging from “rebuild it all” to “solve the biggest problem first.” In today’s environment, only a brand new company gets to start from scratch, with a discipline so pervasive; however, it will really take a combination of efforts for success. Depending on the area of the business, companies will be investing in storage, security solutions, new operations management, and information lifecycle management. The challenge with any of these tactical investments is whether these then address the holistic problem: how can an organization improve its overall approach to risk and compliance management substantially and yet incrementally? The twin challenges boil down to: 1) being able to collect 38 BTQ Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.