GRC Journal - (Page 9) Governance, Risk & Compliance identification (RFID) tags, email communication, instant messaging, and all major IT assets. Using this data, a system simulates control configurations in real-time to let an organization proactively identify and prevent risks. • The ability to govern and enforce: This proactively prioritizes corrective action while automatically centralizing and storing evidence needed to support decisions taken. When issues arise, flexible notification services make it easy to locate and inform responsible parties through unified communication capabilities, while action services extend documented policies throughout the infrastructure. What ideas can you share for enhancing strategic flexibility to mitigate risks with existing assets and to enhance risktaking for reward? JM: No organization is in a position to start from scratch. There are far too many existing compliance and risk-related issues to automate everything at once. Perhaps Gartner stated this most clearly: “Organizations that choose individual solutions for each regulatory challenge they face will spend ten times more on compliance projects than those that leverage each implementation for multiple requirements.” This type of multiple involved organizations and CIOs can begin to address this area incrementally, and be able to at least satisfy the cost reduction part of the equation. The sticky challenge for most IT organizations is to help identify the areas with most upside – the combination of positive business impact and relatively low technology risk. A CIO who can understand the underlying business risks and align those against technology risks is going to be in the best position. • Identify key value areas first. By working directly with the finance organization, a CIO can ensure focus on those areas of highest impact or greatest risk management requirement. By working with a technology program office (if it exists), these key requirements can be overlayed against the existing projects and investment plans. Together, these should help organizations understand the degree of existing automation within the risk and compliance space internally and provide a common basis for aligning against risk and compliance requirements. • Expect to start and build incrementally while keeping an eye on a long-term architecture that can support your risksensitive business in the future. There are clearly business areas that can benefit from a more deliberate and automated approach first. There are high value examples where adding incremental (and generally external) capabilities to existing business process can drive dramatic and quick value to the business. Utilizing existing investments – like those in a corporate network – can not only shorten time-to-value but build a strong infrastructure for add-on projects. • Build capabilities for flexibility while outsourcing those areas more straightforward and/or mundane. How your organization chooses to address the market, whether it grows organically or through acquisition, and how much it depends on external supplies and vendors can all change the importance of managing risk and the need to provide more complete solutions for risk and compliance management. All organizations have a combination of activities that are core and those that are context. Moreover, there are many opportunities for balancing the need for “world-class” versus “does the job.” The critical capability for an IT organization is to be able to adapt to these priorities on an ongoing basis. Q1 2007 | www.btquarterly.com AC: When executives decide to enter new lines of business, there are always risks that need to be considered. For example, a high-tech component manufacturer can enhance their strategic flexibility by building not one large factory, but rather four – maybe geographically distributed in India, China, Russia, and Mexico. Then, depending on the risk situation of the country and the production plans, capacity can be strategically deployed. This additional flexibility could help the company produce when their competitors are facing significant challenges – political crises, currency devaluations, strikes, etc. But this flexibility is only possible because back when the new business was just an idea on a whiteboard, management had the foresight to build strategic flexibility into their plans. Another area where SAP is helping customers to enhance strategic flexibility to mitigate risks with existing assets is by leveraging our partnership with Cisco. Cisco and SAP have both been investing in service-oriented architecture, which makes it significantly easier to exchange information between systems and with all partners in the value chain. Customers can take advantage of their existing investments with SAP and Cisco to identify all sorts of network data exchange risks, using existing assets. Enhancing risk-taking for reward requires good performance measurement and management – the link between risk management and performance management exists today and will become stronger in the next years – since the goal of risk management is to provide the business with the information they need to deliver predictable results. Therefore, if there is not a system which monitors risk ownership, measures the amount of risk taking, and tracks results, people cannot be held accountable for their actions and rewarded for taking risks. Businesses and executives need to be able to learn from their experiences: Which business strategies worked? Which risk mitigation plans were worth the investment? Capturing this information consistently and including it into internal “best practice” playbooks means that with time, our executive management will benefit from both positive and negative experiences. BW: Taking an enterprise approach to risk management is critical. Knowing the requirements that face the organization as a whole allows the IT group to architect the proper infrastructure to support the organization not only today, but into the future. Having key controls in place, understanding what they do and why, and having subordinate controls for flexibility gives the organization the ability to respond strategically to critical events. Whether faced with a natural disaster, an audit or lawsuit, or an acquisition, the infrastructure is agile enough to grow and respond with the needs of the company while still being under control. Additionally, there are many controls that exist today in IT systems that are not being fully utilized. These controls are both preventive (restrict access to data) and detective (alerted to suspicious activity) in nature, which if properly implemented, will allow the business to enhance risk-taking for reward. However, just implementing these preventive and detective controls does not mean that you reduce the risk associated with these IT systems. Monitoring of these controls is paramount to effectively reducing risks, which will allow you to realize a greater return on investment in your existing IT environment. BTQ Business Trends Quarterly 43 http://www.btquarterly.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.