GRC Journal - (Page 6) OffICER IT: MANAGING YOuR ENTERPRISE’S RISkS and analyze all sorts of business and technical events more quickly and assuredly than any employee; and 2) being able to normalize and present these events and processes in a business context for appropriate decision-making and control. Part of the solution comes from leveraging a resource that already exists throughout organizations – existing corporate networks. As the only truly pervasive resource, it can provide both unique information and full control enforcement. When coupled with an appropriate context engine, the events and information can flow from both existing and new systems with control being directed centrally and enforced across the enterprise in line with business objectives. This would provide a truly incremental approach and a new risk-adapted business process. These are very broad areas of scope, but businesses are so expansive that only by implementing the equivalent of a central nervous system can executives understand and control risk across their extended enterprises. AC: On the one hand IT is a source of risk. Ask any CIO and they’ll tell you that they’re worried about security breaches, crashes, business continuity, as well as the size of the required investment in systems, integration scenarios – the list goes on and on. On the other hand, IT helps to mitigate risk. Consider what it would be like if accountants still used paper-based journals and calculators to do the books for multinational corporations. The risk of manual calculation errors, as well as the potential for fraud, is very high. IT provides transparency, which is a great combatant of risk. Managers know the value of the deals they’ve closed, the amount of budget they’ve already spent, and which lowers the risk of not meeting their objectives. Technology can also simplify risk management processes. Without effective use of IT, the risk management organization will be trying to collect information on risks via desktop tools, which can lead to spreadsheet errors and make results very difficult to aggregate. Also, follow-ups and progress can‘t be tracked effectively. Business owners with no formalized process for risk identification end up only being able to identify risks in cases where it‘s too late, and they can‘t leverage experience or re-use best-practice responses – like each event is always happenng for the first time. Finally, executives aren‘t aware of what‘s going on in other parts of the enterprise; they don‘t consider organizational implications, and aggregation and auditability are not possible, since without IT, risk management is a non-repeatable, manual process. With effective risk management processes implemented via technology and embedded into business processes, risk management can become an effective driver of business change. BW: Technology reduces risks, and at the same time increases risks. Vendors are doing a better job of implementing risks mitigation features into their hardware and software solutions. This will allow customers to implement detective and preventive controls that reduce risk to the business. At the same time, technology has opened up new areas of risks that CIOs a decade ago would not have dreamed of impacting their business. The ability to deliver services via the internet to our customers, employees, partners, etc. has made it mandatory that we raise the level of our risk management efforts to stay competitive. 40 BTQ Governance, Risk & Compliance Technology allows automation and enforcement of policies, and it reduces the manual processes and headcount required to address risk. Technology also promotes exposure. People are connecting to technology from any number of devices, from any number of locations, with any number of “handles,” and expecting to have access to their information and network all the time. This is a great offering and what technology is supposed to do – advance the way we live. However, this is also a great risk. Without the proper safeguards in place with this universal access, things like identity management, single sign on, authentication, and role-based access can have serious repercussions. It is important that organizations and individuals build systems to manage this kind of risk. How do you believe organizations can improve the efficiency of risk management through automated controls and real-time monitoring of risk? AC: By leveraging the capabilities of today’s enterprise IT systems – such as automated controls, collaboration, workflow, and alert engines – the efficiency of risk management can be greatly improved. Automated controls can be implemented in key operational business processes. You can be sure that the controls will be executed for each transaction – an IT system doesn’t randomly skip a transaction, get sick, or take a coffee break. Through ongoing “lights out” monitoring of these controls, business owners can be sure that the controls are being executed and that they will be notified in case of exceptions. This management-by-exception greatly reduces the cost of compliance. Automated controls can be implemented up and down the technology stack. For example, SAP is working with Cisco SONA to deliver a set of network-aware composite applications that implement controls into the network layer – this can extend the reach of control monitoring to your extended value chain – your suppliers, partners, and customers. Collaboration tools allow managers and risk experts to work together to identify risks, as well as to analyze probability and impact and decide on the most appropriate course of action. Workflow tools included in IT systems route information to the correct users and automatically escalate alerts and notification items in case they are not followed up on on time. Alert engines constantly monitor systems and reduce the burden of manual monitoring, focusing your valuable of limited resources on management-by-exception. BW: Today, a significant number of controls are manual in nature. The monitoring of these manual controls is time consuming and prone to errors. It can also be inefficient to implement due to the budgetary constraints which are facing most IT organizations today. The impact on headcount to implement and manage manual controls can be very costly as well. We have taken a ground-up approach to our systems. If the foundation of the architecture is reliable, controlled, and monitored, and you have confidence in those systems, then you will also have confidence in the systems that are running on top of it and the applications on top of that. If these systems and applications are also reliable, controlled, and monitored, then you have confidence in the business services Business Trends Quarterly Q1 2007 | www.btquarterly.com http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.