the detroit chapter of the iia presents...making risk management sustainable integrating risk...

51
The Detroit Chapter of the IIA Presents

Upload: others

Post on 02-Jun-2020

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

The Detroit Chapter of the IIAPresents

Page 2: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

LOGO

By Priti Sikdar (FCA, CISA, CISM, CRISC, ISO 27001 LA, BS 25999 LA, PRINCE 2(FC)

Assessing and Building a Risk Conscious Culture

Page 3: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

If You Have Questions…

If you have questions during the webcast:

– If necessary,

exit Full Screen View

by pressing the Esc key

– Submit questions

through the

Ask a question button

Page 4: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Earning CPE Credit

In order to receive CPE credit for this webcast, participants must:

Attend the webcast on individual computers (one person per

computer)

Answer polling questions asked throughout the webcast

When answering polling questions, select your answer and the

click “Vote” button (next to the “Ask a Question” button) to

submit / save your answer.

CPE certificates will be sent to the e-mail address on your

BrightTALK account within two weeks of this webinar.

Page 5: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

A) Member Detroit ChapterB) Member – Central Region District 2 (Fort Wayne, Toledo,

Michiana, W. Mich., Lansing) C) Member – Other DistrictD) Non-member

Please tell us your member status

Page 6: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk-an inevitable part of every business!

Company Logo

Page 7: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk n Return are inversely proportional

Company Logo

My risk is other’s opportunity!

Opportunity

Risk

Page 8: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk is all pervasive

Elements of organization

Risk can pervade any of the elements

Tone at top is a good determinant of risk culture

A secure risk culture can provide both stability and a competitive advantage

Company Logo

Page 9: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Vulnerabilities are mostly due to people

Lack of security training

Unavailability of proper job descriptions

Management do not give importance to risk evaluation activities

Surfing on unsecure websites

Lack of pre-screening for new employees

Company Logo

Page 10: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk Culture-definition

“Risk culture can be defined as individual and group behaviour within an organization that determines the way in which the company identifies, understands, discusses and acts on the risks the organization confronts and takes.”

(Source: “Reform in the Financial Services Industry : Strengthening Practices for a More Stable System .” Institute of International Finance, 2009)

Company Logo

Page 11: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Assess level of maturity in risk management

The level of understanding/maturity is to be considered before designing risk strategy to embed risk within the culture of the organization.

At a higher level, organizations may have their own risk frameworks or opt for risk standards like ISO 27001, ISO 31000, that define specific control objectives.

Company Logo

Page 12: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

People determine organizational culture

The way an organization works is largely dependent on the people culture.

RISK is all pervasive and perceptions to risk differ from person to person and from organization to organization.

Organizations may choose different ways to deal with risk and this decision is a subjective decision.

Company Logo

Page 13: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Question Time

1) Risk is the outcome of threat exploiting a vulnerability within the organizational system-

i) True

ii) False

Company Logo

Page 14: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Understanding Risk

Organizations need to communicate their risk perceptions to employees

Company Logo

Page 15: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Management to communicate expectations

Management to communicate risk management expectations for the organization

Define roles and responsibilities around risk.

Delivering communications from leadership using a common risk management vocabulary.

Setting risk accountabilities.

Conducting general education and customized risk training programs based on employees’ roles.

Embedding risk management at induction stage.

Refining recruitment methods to include risk management capabilities.

Company Logo

Page 16: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Question Time

2) Risk that remains once all mitigation controls are implemented is called-

a) Business risk

b) Inherent risk

c) Residual risk

d) Strategic risk

Company Logo

Assessing and Building a Risk Conscious Culture

Page 17: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Board responsibility in risk

Does the board understand how innovative technologies could disrupt the organization’s business model?

Are innovative technologies and approaches being adopted that can better create value and capture greater market share for the organization?

Does the organization have a set of defined innovation KPIs linked to key growth objectives? Is regular reporting on such KPIs made?

Are innovative technologies across the industry being benchmarked?

How often do directors meetings held with business unit leaders and suppliers?

Is the Board aware of prevalent market practices? Are they aware of competitors’ practices?

Company Logo

Page 18: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

False sense of security

Myth is risk is covered if you have insurance

Company Logo

Page 19: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

What if you get surprises

WHAT IF insurance has expired yesterday and renewal cheque is still in office?

WHAT IF your assets are under-insured?

WHAT IF the risk is not covered by your contract?

Company Logo

Page 20: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Positive indicators of a healthy risk culture

Company Logo

• Commonality of purpose, values and ethics: The extent to which an

employee’s individual interests, values and ethics are aligned with the

organization’s risk strategy, appetite, tolerance and approach.

• Proper Understanding and application: Whether risk is a part of

organizational activities from strategic planning to day-to-day operations.

• A learning organization: Whether risk monitoring and correction is an

ongoing process and is moving towards continuous improvement.

• Organization is communicating their risk definition, perception and

criteria to all employees: There is constant interactive exchange on risk

related issues between departments and employees.

Page 21: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Why Risk?

Threats hover inside and outside the organization

Organizations are not always ready for risks or for new risks that keep adding.

Organizational vulnerabilities to risk, the financial crises of 2007 and 2008 marked a turning point in rethinking the role of an organization’s risk culture.

Company Logo

Page 22: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk Breakdown Structure

Company Logo

Page 23: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Company Logo

Categories of risk

Natural, manmade, pandemic, employee injuryHazard risk•Natural hazards

Customer specific risks, risk to brand, risk from competitors Strategic risk•Business related risks

Interest rate risk, liquidity risk, working capital adequacy risk, Financial risk•Quantitative risks

Page 24: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Stages of risk management

Assess-Analyse-Treat

Company Logo

•Context of the organization

•Understand business

• processes

•Understand threat profile

Risk Assessment

•List of critical processes /assets

•List of threat-vulnerabilities-consequences

•Making the likelihood matrix and setting rating scale for risks identified

Risk analysis and rating •Avoid

•Accept

•Share/Transfer

•Mitigate

Risk Treatment

Page 25: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk Scenarios

Company Logo

Page 26: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Effective risk culture

An effective risk culture promotes sound risk-taking, Takes emerging risks into account (beyond risk appetite), and ensures employees conduct business in a “legal and ethical manner.”

People who are lower in the organization hierarchy may not identify risks and hence risks may not be considered giving riske to exposure

Company Logo

Page 27: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Causes of failure of risk management

Mismeasurement of known risks;

Failure to take risks into account, i.e. mismeasurement due to ignored risk;

Failure in communicating the risks to top management;

Failure in monitoring risks;

Failure in managing risks; and

Failure to use appropriate risk metrics or measurement system.

Company Logo

Page 28: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Changing the risk culture…

Change is slow and needs efforts to unfreeze, convince the people and embed the change and refreeze the organization a the desired level of risk.

Organizations aim at embedding risk performance metrics into motivational systems.

Risk management considerations can be added to the KRIs and appraisal can include it as one of the metric.

Ensure that individuals having orientation and knowhow in risk are placed in roles where effective risk management is critical.

Company Logo

Page 29: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Making risk management sustainable

Integrating risk management lessons learned into communications, education and training.

Holding people accountable for their actions.

Refining risk performance metrics to reflect changes in business strategy, risk appetite and tolerance.

Redeploying individuals to reflect changes to business strategy and priorities.

Company Logo

Page 30: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Requisites for embedding change

Company Logo

Awareness

•Of what change is to be made

•Who is to make the change

•Persons authorizing change

Agility

•Ability to respond to queries

•Timely effecting of change

Effective resources

•People

•Services

•Applications

•Utilities

Page 31: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Introducing a risk based culture

Unfreeze the organization

Initiate risk based programs in the organization

Refreeze the organization at a level of maturity higher

than what was started with

Company Logo

Page 32: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Unfreeze the organization

An organization exists at a certain level of risk acceptance and this is commensurate to the business and clients.

To prepare for risk conscious environment, it will be necessary to make people aware of the need to identify and assess risks and establish a risk management system within the organization.

Efforts to take signoff for risk initiatives have always proved to be vital in the success of risk management programs.

Consensus from people is a key to success, when goals are shared, commonality of objectives result.

Company Logo

Page 33: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Initiating risk management activities

Driving risk initiatives

Perform a risk impact analysis

Identify threat

Identify source of threat

Identify vulnerability

Identify risk

Determine likelihood of occurrence

Calculate impact if threat exploits the vulnerability leading to loss

Company Logo

Threat Vulnerability Risk

Page 34: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Undertake Training Awareness Sessions

Awareness sessions can be informal, during lunch hour in canteen or in a classroom.

People need to be encouraged to open up and share their experiences on risk and their perceptions.

Illustrative portrayal of common disasters like fire, power outage and live case studies shall be effective.

Company Logo

Page 35: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Organize Risk Workshops for different business groups

Discuss risk concepts and introduce audience with risks applicable to their group.

Discuss past precedents/incidents that have affected the business/department and frequency of such incidents

Discuss controls and note control lacuna in different areas under discussion.

This is a quasi-CSA (Control Self Assessment) where high risk areas are identified at the shop floor level

Company Logo

Page 36: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Review Asset Register

It is imperative that user management and business divisions have a list of assets and processes of which they are owners/custodians

They have to pick up from these assets/processes which are detailed/significant and which are baseline.

Only detailed processes will be selected for risk analysis

Baseline processes will be under genral risk management procedures.

Company Logo

Page 37: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Study Asset Classification Scheme

Information must be classified into-

i) Critical

ii) Vial

iii)Important

iv) Minor

Classification of information shall be made on sensitivity basis

Company Logo

Page 38: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk attitude/risk appetite

Risk attitude generally determines risk treatment; whether or not risks are to be tolerated, shared, avoided, retained or transferred and also whether these treatments are to be implemented or postponed to some future date. Like business continuity, a risk assessment Process is also driven by the top management.

Risk appetite-In the context of ISO 22301 standard, risk appetite refers to the amount and type of risk that an organization is prepared to accept, tolerate, or pursue.

Company Logo

Page 39: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk Tolerance Levels

Company Logo

Risk tolerance is a function of recognising those risks with which management is ready to suffer anomalies/loss.

Page 40: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Set Risk Criteria for Every Level

Threat Likelihood, Consequence Rating

Likelihood

of

Occurrence Consequence Threat Level Threat Rating

Low Low Low 1

Low Moderate Low 2

Low High Moderate 3

Moderate Low Low 2

Moderate Moderate Moderate 3

Moderate High High 4

High Low Moderate 3

High Moderate High 4

High High High 5

Company LDogo

Page 41: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk Dashboard

Company Logo

Page 42: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Prepare Threat List that is realistic for the business

Prepare a list of Threats-Vulnerabilities and give to users to select what is likely to affect them most

Make a threat-risk-impact analysis and rate all risks

Prioritizing risks in order of importance and based on cost-effect basis.

Company Logo

Page 43: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Match Threat with vulnerabilities

Threats

Fire

Earthquake

System downtime

Power outage

Hacker/cracker/sabotage

Disgruntled employee/dismissed employees

Theft

Unauthorized access

Vulnerabilities

Proximity to gas station

Glass structure of building

Network vulnerable

No redundancy

Firewall rules not configured properly

Allowed access to critical processes

No process for return of assets while leaving organization

Password sharing

Company Logo

Page 44: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

To remove misconceptions arrange for second knowledge sharing

session

Interview business process heads

Take stock of existing controls

Identify vulnerabilities/gaps

Give it ranking in terms of criticality

NB: This can be effectively done in workshop mode

Company Logo

Page 45: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Identify existing controls

Threats are hovering inside and outside the organization.

A lot depends on an effective control system that safeguards against known risks.

A good management inculcates a risk culture by leading by example. I have witnessed an evacuation drill where the MD of the company was the first to walk after the alarm.

Being risk averse means being control savvy.

Company Logo

Page 46: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Company Logo

Question Time

3) The first requisite of risk management exercise is-

a) Risk strategy

b) Risk acceptance

c) Risk identification

d) Risk mitigationAssessing and Building a Risk Conscious Culture

Page 47: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Make Control Gap Assessment

Identify control gaps and suggest control measures

A CSA (Control Self Assessment) can be initiated and participation of line managers can be solicited to identify areas of high risk

Once risk gaps are identified, remediation measures can be defined and a time scale for meeting the remediation exercise can be determined.

Company Logo

Page 48: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Risk Assessment is a subjective exercise

To get best results people should be educated and guided towards using their business acumen, based on past precedents and future forecasts in assessing present risks and choosing appropriate risk treatment.

It is a collaborate and iterative exercise and hence embedding risk awareness and resilience to risk incidents is akin to taking vaccination against disease.

People run business processes and steered in the right perspective, people can safeguard organizational assets/processes.

Company Logo

Page 49: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Changing culture is always a challenge

Changing culture thus requires change at the beliefs level, which is often substantially more difficult than changing business process or information systems.

To complicate matters, there may be an overall company culture and sub-cultures across groups. Sometimes these can be in conflict.

While CEOs have the authority to lead cultural change across a company, they are limited in scope to drive belief changes in their specific sub-organization.

Company Logo

Page 50: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Culture is a matter of mindset

An integrated healthy atmosphere where people treat their work with ownership and responsibility and complement each other with the idea of one for all and all for one, risks will be minimised and dealt with promptly and at minim al expense.

Group programs, workshops, seminars, picnics and celebration for common festivals will promote a good cultural integration which is necessary for effective risk avoidance and mitigation

Company Logo

Page 51: The Detroit Chapter of the IIA Presents...Making risk management sustainable Integrating risk management lessons learned into communications, education and training. Holding people

Thank you for your time…

Company Logo

Email [email protected]