The core of the content of this forum comes from an academic work made in 2006. Recently the author of this work has received the 2007 Student of the Year Business Continuity Industry Award, hosted by CIR (Continuity Insurance & Risk, the UK's leading bi-monthly risk management and insurance journal).
This award would not have been received without the valuable answers provided in the questionnaire by 82 information security and business professionals worldwide. Part of the academic work was the analysis of these answers.
Thanks to all of you!
See some coverage in the news:
- Business Continuity Central Site
- Business Continuity Forum
See also:
- the Business Continuity Awards Site
- the Student of the Year Award Call for Nominations
Executive summary
Making business means taking risks. Risk management deals with exposures to specific threats that can take advantage of existing vulnerabilities and affect organisations. Enterprise risk management (ERM) consists of the processes used to manage risks in the enterprise.
Strategic (not defining and meeting objectives), market (negative interactions with the market), credit (exposure to non-payments) and operational risk (exposure to loss from internal processes, people, systems and external events) constitute ERM.
An ERM umbrella that is aligned with the business strategy helps the organisation achieve its objective.
Information is an essential asset for most organisations: it connects all risk management disciplines and, more broadly, most business processes use it. Information risk management, also called information security, is an element of operational risk.
There is a current tendency towards linking the information security activity (infosec) with the operational risk management (ORM) practice and, more generally, with the enterprise risk management activity.
The link between infosec and ORM disciplines can eventually play a positive role in constructing sustainable and superior benefits for organisations.
An overarching model is proposed to understand and manage the complexity of infosec and ORM in organisations: the ‘risk house’ model.
This model explains how to link the infosec practice with the ORM strategy and practice. It locates ORM within ERM and signals the pervasiveness of information and the need to develop information security and to link it with ORM.
The infosec-ORM link should always happen in accordance to the risk appetite of the organisation. ORM objectives can be significantly facilitated if both risk disciplines are aligned with the strategy of the organisation to achieve its objective.
A survey of 82 experts provides two main conclusions: First, management commitment, the degree of development of information security and the alignment of risk management with the business strategy (i.e. its strategic alignment) are strongly related to superior benefits achieved in organisations.
Second, the three most probable superior benefits achieved are stakeholder value, new business opportunities and better compliance. These three benefits ultimately contribute to the responsible image of the organisation.
Strategic (not defining and meeting objectives), market (negative interactions with the market), credit (exposure to non-payments) and operational risk (exposure to loss from internal processes, people, systems and external events) constitute ERM.
An ERM umbrella that is aligned with the business strategy helps the organisation achieve its objective.
Information is an essential asset for most organisations: it connects all risk management disciplines and, more broadly, most business processes use it. Information risk management, also called information security, is an element of operational risk.
There is a current tendency towards linking the information security activity (infosec) with the operational risk management (ORM) practice and, more generally, with the enterprise risk management activity.
The link between infosec and ORM disciplines can eventually play a positive role in constructing sustainable and superior benefits for organisations.
An overarching model is proposed to understand and manage the complexity of infosec and ORM in organisations: the ‘risk house’ model.
This model explains how to link the infosec practice with the ORM strategy and practice. It locates ORM within ERM and signals the pervasiveness of information and the need to develop information security and to link it with ORM.
The infosec-ORM link should always happen in accordance to the risk appetite of the organisation. ORM objectives can be significantly facilitated if both risk disciplines are aligned with the strategy of the organisation to achieve its objective.
A survey of 82 experts provides two main conclusions: First, management commitment, the degree of development of information security and the alignment of risk management with the business strategy (i.e. its strategic alignment) are strongly related to superior benefits achieved in organisations.
Second, the three most probable superior benefits achieved are stakeholder value, new business opportunities and better compliance. These three benefits ultimately contribute to the responsible image of the organisation.
Introduction
Doing business is taking risks to achieve an objective while following a strategy.
All activities in an organisation should be aligned with the business strategy so that the organisation achieves its objective. However, nowadays it is frequent to find big companies, let alone small and medium ones, handling risks in a very archaic and fragmented way, not aligned with the organisation’s strategy.
It is usual that unrelated groups deal with related dimensions of enterprise risk: credit, market, strategic, operational and also reputational risk. This is a very ineffective and inefficient way to manage risk.
Credit and market risk management models are well established and developed (e.g. VaR). They fall outside the scope of this study. This study investigates the level of development of infosec and operational risk management practices within organisations and justifies why enterprise risk management needs to be aligned with the organisation’s strategy.
On one hand, the recent succession of corporate and government scandals happening in the First World (Enron, Arthur Andersen, Shell, Worldcom to mention only a few of an endless list of well known names) has created a myriad of corporate governance regulations that organisations have to comply with. This new corporate governance scenario includes better ways to deal with risk in organisations.
On the other hand, the increasing dependence on information and on information systems for most organisations makes the role of information security increasingly pivotal. The Internet revolution and open systems architectures bring an extraordinary level of connectivity and interaction but also the great challenge to guarantee information security in organisations.
This study looks at both hot topics from a linking and reconciling angle: operational risk management (ORM) and information security (infosec). Based on the fact that both information and operational risk spread throughout the whole organisation, this study defends that the systematic link of the infosec practice with the ORM strategy and practice bring superior benefits to the organisation.
Furthermore, it presents a way to carry out this linkage between infosec and ORM, which is anchored in a proposed model, the ‘risk house’: a comprehensive model to understand and manage risks in organisations.
A survey was launched to research the relationship between the level of evolution in infosec and risk management within organisations and potential benefits that organisations enjoy. These benefits will help organisations to better achieve their objectives, managing risks while following their strategy.
The survey in turn follows the spirit of the ‘risk house’ model.
82 risk management professionals from the 5 continents have answered it in a valid way. The results of the quantitative research prove the applicability of the proposed ‘risk house’ model. They serve to confirm which requirements to link infosec with ORM actually contribute to provide organisations with superior benefits. Simultaneously, they hint the pace companies nowadays follow to implement them.
All activities in an organisation should be aligned with the business strategy so that the organisation achieves its objective. However, nowadays it is frequent to find big companies, let alone small and medium ones, handling risks in a very archaic and fragmented way, not aligned with the organisation’s strategy.
It is usual that unrelated groups deal with related dimensions of enterprise risk: credit, market, strategic, operational and also reputational risk. This is a very ineffective and inefficient way to manage risk.
Credit and market risk management models are well established and developed (e.g. VaR). They fall outside the scope of this study. This study investigates the level of development of infosec and operational risk management practices within organisations and justifies why enterprise risk management needs to be aligned with the organisation’s strategy.
On one hand, the recent succession of corporate and government scandals happening in the First World (Enron, Arthur Andersen, Shell, Worldcom to mention only a few of an endless list of well known names) has created a myriad of corporate governance regulations that organisations have to comply with. This new corporate governance scenario includes better ways to deal with risk in organisations.
On the other hand, the increasing dependence on information and on information systems for most organisations makes the role of information security increasingly pivotal. The Internet revolution and open systems architectures bring an extraordinary level of connectivity and interaction but also the great challenge to guarantee information security in organisations.
This study looks at both hot topics from a linking and reconciling angle: operational risk management (ORM) and information security (infosec). Based on the fact that both information and operational risk spread throughout the whole organisation, this study defends that the systematic link of the infosec practice with the ORM strategy and practice bring superior benefits to the organisation.
Furthermore, it presents a way to carry out this linkage between infosec and ORM, which is anchored in a proposed model, the ‘risk house’: a comprehensive model to understand and manage risks in organisations.
A survey was launched to research the relationship between the level of evolution in infosec and risk management within organisations and potential benefits that organisations enjoy. These benefits will help organisations to better achieve their objectives, managing risks while following their strategy.
The survey in turn follows the spirit of the ‘risk house’ model.
82 risk management professionals from the 5 continents have answered it in a valid way. The results of the quantitative research prove the applicability of the proposed ‘risk house’ model. They serve to confirm which requirements to link infosec with ORM actually contribute to provide organisations with superior benefits. Simultaneously, they hint the pace companies nowadays follow to implement them.
Hypothesis
- Survey results corroborate that the strongest relationship exists between ‘management commitment’ to implement a risk management framework and any possible benefit for the organisation.
- The second and third most important pre-conditions for benefits are ‘infosec development’ and ‘strategic alignment in RM’ i.e. establishing an infosec programme to improve security management enterprise-wide and align all risk management activities with the strategy of the organisation.
- The development of all risk management related fields within the organisation brings benefits to the organisation. Specifically, this is the case for infosec, ERM and ORM.
- The second and third most important pre-conditions for benefits are ‘infosec development’ and ‘strategic alignment in RM’ i.e. establishing an infosec programme to improve security management enterprise-wide and align all risk management activities with the strategy of the organisation.
- The development of all risk management related fields within the organisation brings benefits to the organisation. Specifically, this is the case for infosec, ERM and ORM.
The risk house model
The risk house model. Copyright (C) 2006, Alberto Partida
The conclusion of the literature review is the proposal of an overarching enterprise risk management model: the ‘risk house’.
This model helps answering how companies can link their information security practice with their operational risk management strategy and practice to achieve superior benefits and helps understanding the results of the survey.
---------------------------------------------------------------------------------
Copyright (c) 2006 Alberto Partida.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
Texts. A copy of the license is available at the GNU
Free Documentation License site.
---------------------------------------------------------------------------------
The ‘risk house’ model connects all subjects visited in the literature review. It is a comprehensive way to explain what risk means for an organisation. The core of the house is the business idea.
Every business idea brings intrinsically the need to address risks. The ideas of doing business and taking risks both are actions that constitute the core of the ‘risk house’. Managing risks is strongly coupled with the strategy of the business to achieve its objective. This is the reason why these three elements share a different background colour (yellow).
The remaining building blocks of the ‘risk house’ (sharing the blue colour) are related to risk. Surrounding the core of the ‘risk house’ (the business), there is an upper element consisting of all possible enterprise risks (i.e. strategic, market, credit and operational risks).
All of them form part of the enterprise risk block.
Reputational risks are written with a different font but they are located in the same enterprise risk block. The subtle difference is that reputational risk can be present in all four types of risks.
Information is the lower complementary block surrounding the business core. As identified in the literature review, information acts as a risk connector for all these risks. Information is pervasive. Based on the findings of the literature review, all risk practices should use a common language.
These days information resides in information systems. This is the reason why the information block lays upon several information systems. These are drawn as definite circles because organisations still struggle to integrate their information systems. It is frequent to find unlinked information systems for different business processes, bringing sometimes even more complexity to the business.
On the top of the house, corporate governance is the roof aiming at safeguarding the future of the organisation, taking care of the overall steering principles and governance processes of the organisation and its compliance with current regulations.
On the right hand side, the model refers to risk management processes related to the adjacent house element. Following a top-down approach and starting from the corporate governance umbrella, the first process related to corporate governance and business strategy is compliance and control.
The process dealing with all the risks affecting the business is enterprise risk management. Similarly, the process guaranteeing the effectiveness of information as a pervasive element that connect risks is information security.
Information systems security guarantees the confidentiality, integrity and availability of information residing in information systems.
Every process relies on the one located just below, in such a way that their seamless integration provides a unique way for the organisation to achieve its objective in the form of superior benefits.
The remaining elements of the ‘risk house’ model bring actions: Risks, as threats taking advantage of vulnerabilities, are always menacing the business. Consequently, enterprise risk management and information security provide required input to assess the current risk exposure and to compare it with the organisation’s risk tolerance (risk appetite).
This is the reason why it is so important to integrate ERM with infosec (and within ERM, especially ORM). This way, the ERM and the information blocks can determine which risks can be accepted and which risks need to be mitigated.
The last element to mention is management commitment. This is the fluid glue that links business strategy with ERM. Management commitment is essential to keep the house protected and governed.
The application of the ‘risk house’ model to different industrial sectors would show very different levels of block strength e.g. the financial world is currently one of the most advanced in terms of risk management.
The final objective of the ‘risk house’ model is to show graphically the need to protect the business by integrating risk management practices under the ERM umbrella and linking them with information security to adjust the organisation’s risk exposure with its risk tolerance.
This way, the organisation will enjoy superior benefits that will leverage achieving its objective. This is the message of the ‘risk house’ model.
The answer to the research question pops out by feeding the ‘risk house’ model, created out of the literature review, with the results obtained in the survey.
First, the indispensable glue among all blocks is management commitment, without it the ‘risk house’ would collapse.
Second, the information block and the information security process need to be assembled and maintained.
Third, the enterprise risk block and, consequently, all blocks in the house, need alignment with the business strategy.
The conclusion of the literature review is the proposal of an overarching enterprise risk management model: the ‘risk house’.
This model helps answering how companies can link their information security practice with their operational risk management strategy and practice to achieve superior benefits and helps understanding the results of the survey.
---------------------------------------------------------------------------------
Copyright (c) 2006 Alberto Partida.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
Texts. A copy of the license is available at the GNU
Free Documentation License site.
---------------------------------------------------------------------------------
The ‘risk house’ model connects all subjects visited in the literature review. It is a comprehensive way to explain what risk means for an organisation. The core of the house is the business idea.
Every business idea brings intrinsically the need to address risks. The ideas of doing business and taking risks both are actions that constitute the core of the ‘risk house’. Managing risks is strongly coupled with the strategy of the business to achieve its objective. This is the reason why these three elements share a different background colour (yellow).
The remaining building blocks of the ‘risk house’ (sharing the blue colour) are related to risk. Surrounding the core of the ‘risk house’ (the business), there is an upper element consisting of all possible enterprise risks (i.e. strategic, market, credit and operational risks).
All of them form part of the enterprise risk block.
Reputational risks are written with a different font but they are located in the same enterprise risk block. The subtle difference is that reputational risk can be present in all four types of risks.
Information is the lower complementary block surrounding the business core. As identified in the literature review, information acts as a risk connector for all these risks. Information is pervasive. Based on the findings of the literature review, all risk practices should use a common language.
These days information resides in information systems. This is the reason why the information block lays upon several information systems. These are drawn as definite circles because organisations still struggle to integrate their information systems. It is frequent to find unlinked information systems for different business processes, bringing sometimes even more complexity to the business.
On the top of the house, corporate governance is the roof aiming at safeguarding the future of the organisation, taking care of the overall steering principles and governance processes of the organisation and its compliance with current regulations.
On the right hand side, the model refers to risk management processes related to the adjacent house element. Following a top-down approach and starting from the corporate governance umbrella, the first process related to corporate governance and business strategy is compliance and control.
The process dealing with all the risks affecting the business is enterprise risk management. Similarly, the process guaranteeing the effectiveness of information as a pervasive element that connect risks is information security.
Information systems security guarantees the confidentiality, integrity and availability of information residing in information systems.
Every process relies on the one located just below, in such a way that their seamless integration provides a unique way for the organisation to achieve its objective in the form of superior benefits.
The remaining elements of the ‘risk house’ model bring actions: Risks, as threats taking advantage of vulnerabilities, are always menacing the business. Consequently, enterprise risk management and information security provide required input to assess the current risk exposure and to compare it with the organisation’s risk tolerance (risk appetite).
This is the reason why it is so important to integrate ERM with infosec (and within ERM, especially ORM). This way, the ERM and the information blocks can determine which risks can be accepted and which risks need to be mitigated.
The last element to mention is management commitment. This is the fluid glue that links business strategy with ERM. Management commitment is essential to keep the house protected and governed.
The application of the ‘risk house’ model to different industrial sectors would show very different levels of block strength e.g. the financial world is currently one of the most advanced in terms of risk management.
The final objective of the ‘risk house’ model is to show graphically the need to protect the business by integrating risk management practices under the ERM umbrella and linking them with information security to adjust the organisation’s risk exposure with its risk tolerance.
This way, the organisation will enjoy superior benefits that will leverage achieving its objective. This is the message of the ‘risk house’ model.
The answer to the research question pops out by feeding the ‘risk house’ model, created out of the literature review, with the results obtained in the survey.
First, the indispensable glue among all blocks is management commitment, without it the ‘risk house’ would collapse.
Second, the information block and the information security process need to be assembled and maintained.
Third, the enterprise risk block and, consequently, all blocks in the house, need alignment with the business strategy.
Subscribe to:
Posts (Atom)
