is it risk management just a fad?

Is IT Risk Management just a Fad?

Joerg Fritsch NATO C3 Agency 21/10/09 | Session ID: GOV-208

Classification: Intermediate

2

Agenda

‘reductionist’ vs holistic?

IT Risk Management & Technology

A simple IT Risk framework

WIIFM (what’s in it for me?)

3

IT Security “Fads” over the past 15 years

Time

Bus

ines

s Im

pact

1997 today 2006 2001 2003

Sectors may have experienced these ‘fads’ at different stages

Wasn’t this

about

Technology?

4

What are the ‘potential risks’?

Description ITGI 2008

Insufficient number of staff 58%

IT service delivery problems 48%

High cost of IT with low/unproven ROI 41%

Lack of agility/development problems 39%

Staff with inadequate skills 38%

Problems with outsourcers 35%

Problems with document content or knowledge management

31%

Disconnect between IT strategy and business strategy 29%

Electronic archiving or storage problems 26%

Inadequate desaster recovery or business continuity measures (DRP/BCP)

26%

Source: IT Governance Global Status Report 2008

5

More about potential Information Technology Risks

•  IT security risk management is a subset of technology management

•  IT risks are side effects of the use of technology

•  It is O.K. to understand and communicate complex technical issues behind a risk

•  But what prevents us from doing this?

6

Two possible reasons: stereotypes and unchallenged assumptions

The following slides

 Will tell a story about stereotypes and unchallenged assumptions

 Do not claim to be a comprehensive collection of reasons

No one wants to be perceived as a technocrat.

Systems thinking / holistic thinking is far better than ...

Stereotypes Assumptions

Inhibition

7

Stereotypes that prevent us from managing technology (risks)

  Technicians are not interpersonal savvy.

  Key communication skills not developed very well.

‘Technicians’ have personal issues

  Technicians and senior management speak different languages.

  ‘Geek speak’

‘Technicians’ cannot talk business

  Technicians see technology as ends and not as means to an end.

  Technicians recommend (new) technology because they are in love with it.

‘Technicians’ see Technology as end goal

  Technology managers cannot make career if the output of the firm is not technology related.

‘Technicians’ cannot make career

Personal issues

Geek speak

T. is end goal

Not a fee earner

8

Technology Management?

Business policies, strategy & mission statement. Interface with the business environment.

Technology pro- vides information

systems! Technology

creats wealth. Interface with the

technology landscape.

Control of operation, improvement & innovation. Technology forecast. Alignment of technology platform & technology strategy with business policies & mission.

General Management Technology

Technology Management

9

Better take pride in being involved with technology

•  Technology provides information systems

•  Technology creates wealth

•  Technology is a tool

•  Technology provides answers

•  Technology …

•  But technology also poses problems (management by exception?)

10

Everyone knows that

•  Without (Information) Technology ‘it’ is not going to fly

•  Without IT security ‘it’ is not going to fly either

•  Nor is ‘it’ ever going to fly without a proper risk assessment

11

Let’s talk about ‘reductionist’ & holistic views

(CC), http://www.flickr.com/photos/ananth/2046725823/in/set-72157603700082721

12

‘Reductionist’ & holistic views (continued)

(CC), http://www.flickr.com/photos/ananth/2047524926/in/set-72157603700082721 (CC), http://www.flickr.com/photos/ananth/2047522102/

in/set-72157603700082721

13

IT defies compartmentalization: Back to the primordial ooze?

•  Does compartmentalization really contradict a holistic approach?

•  Being ‘all over’ is not equal to not fitting in a compartment

•  Compartments have human gatekeepers at the boundaries

14

An example of compartmentalization: The IT value chain

  Goal: Positive impact of IT on business.   Think about some buzzwords for alignment of

business and IT here.   A representation without direction/orientation

but with links/interfaces.

Business Outcomes

  Compartmentalization is not necessarily negative.

  Categorizing & compartmentalizing can be an essential skill if it is not overly used.

IT Value Chain

Strategy Applications Operations

Business outcomes

IT Value chain

15

Did you have beneficial experiences with compartmentalization recently?

(CC), http://www.flickr.com/photos/toyohara/303600377/

16

IT Risk Framework (Fritsch, 2009)

(CC), http://www.flickr.com/photos/eriwst/2303608353/

17

Proposal: A simple IT Risk Framework

IT Risk Management

Risks Risks Risks Risks

BU1 BU2 IT BU3

Enterprise Risk Management (ERM)

Business Units assess their potential IT Risks

Compartmentalized

Holistic

Communities of Practice (CoPs)

18

Proposal: A simple IT Risk Framework (continued 1)

•  Compartments build Communities of Practice (CoPs) all having a stake in IT Risk Management

•  IT Risk Management community stretches across vertical and horizontal organizational boundaries

•  Gatekeepers (Employees) interface between boundaries, performance dependent on:

•  Prior related knowledge

•  Organizational culture

19

Proposal: A simple IT Risk Framework (continued 2)

•  Use gatekeepers to integrate RM horizontally and vertically in the organization

•  Risk Management can be integrated into existing processes

•  As consequence of a well integrated risk management, people often do not know that they are doing risk management.

20

Storytelling: positive effects of IT Risk management

•  Plenty of methodologies and frameworks but little

•  Living examples

•  Authentic, memorable stories

•  Story context around past failures and risk based decisions for current audiences

•  Case Studies

•  Tell me your story!

21

What’s in it for me?

(CC) http://www.flickr.com/photos/86257563@N00/476500197/

22

WIIFM

•  This is a preliminary to a wider discussion. We can have (part) of that discussion

•  Now

•  Anytime soon

•  Share your experience

•  Think about the proposed framework

23

Questions & Answers

Thank you for your attention

joerg.fritsch@nc3a.nato.int