Risk Management

Organizations are exposed to business risks in varying degrees. These risks can be categorized as:

• Operational / strategic risk, which includes anything that could impede the organization's performance due to
  • external events (e.g. pandemics, natural catastrophes, climate change)
  • internal events (e.g. labor issues, strike)
  • technology problems (e.g. increasing technical debt)
  • vendor choice / turnover
  • security issues (e.g. CyberSecurity)
• Reputational risk, which summarizes potential harm to the organization's
  • internal perception by its employees and shareholders
  • external perception by customers and the general public
• Compliance risk, which is related to the organization's responsibilities under applicable laws and regulations
• Environmental, Social and Governance (ESG) risk, which pertains to the organization's business ethics and practices (e.g. environmental management, respect for human rights, anti-bribery/-corruption, financial reporting)

Since risks often affect multiple business units or the whole organization, it is important to centralize risk management, i.e. the responsibility for identifying, assessing and mitigating threats that may significantly impact the organization in its ability to conduct its current and future business. Particular attention needs to be paid to cumulative risks, i.e. the organization’s total exposure that amounts from the existence of several parallel, but independent risk factors with the same impact (e.g. several vendors that process personal data on behalf of a certain organization could independently suffer a data breach).

 

Risk management is typically headed by a corporate executive, the Chief Risk Officer (CRO). Small and medium sized organization may not establish a separate position for risk management, but assign the related responsibility to another executive (for the sake of simplicity, hereinafter also called “CRO”). The CRO should ideally report to the CEO or the Board. As most of the risks have a financial impact, the CRO may instead report to the Chief Financial Officer (CFO).

 

Having a horizontal responsibility (such as the CFO, Chief Human Resources Officer (CHRO), or Chief Data Officer (CDO)), the CRO needs to be an excellent communicator and influencer.

 

The CRO’s responsibility includes the following tasks of risk management:

• Document process maps with focus on risk to both information and material, both in transfer and in rest
• Analyze the organization’s risk profile in terms of potential operational, strategic, reputational, compliance and ESG risks
• Identify risk factors that could have the same impact 
• Determine and quantify the organization's risk appetite
• Develop action plans to mitigate risks to the organization – both strategic and tactical
• Seek insurance coverage for remaining risks 
• Integrate risk management priorities into the organization's overall strategy
• Plan and oversee budget for risk management and related projects 
• Monitor the progress of risk mitigation efforts
• Communicate risk analysis and mitigation progress to the organization’s executives, board members and heads of business units

Protecting Consumer & Employee Data In The Cloud

Cybersecurity has quickly emerged from a technical task to a problem that keeps executives up at night.

Why is that? Consumers expect to interact with businesses through a multitude of channels. Organizations do not only need to offer more and more online services, but also want to collect behavioral data about how users navigate, what are their shopping preferences etc. To do so comprehensively, organizations depend on vendors to provide the necessary technology.

Given the usual push for functionality while security is an afterthought, it is only a matter of time until vulnerabilities of such an ecosystem are exposed and exploited. May this be inadvertently caused by employees or vendors, may this be intentionally pursued by bad guys outside.

Remote working has only exacerbated the risk as employees now work in environments that – from a security perspective – are even less under control of the organization. Employees working from home may copy data about consumers or fellow employees to their computer or to their personal cloud (which may not be secured at all) or fall prey to a phishing email that they deem to be authentic and inadvertently disclose their credentials.

This been said, I want to emphasize that Cybersecurity is not a mere technical issue, but requires a culture where the organization, its employees as well as its suppliers collaborate in lock-step and follow the same charter of data protection.

Furthermore, I’d like to point out that whenever we talk security, we need to accept that higher security comes with a price, and perfect security is not possible. So it becomes critical for any organization to define its risk appetite and its level of risk tolerance. Therefore, data protection issues in general and cybersecurity issues in particular can only be tackled in a risk-based approach.

If you like to hear more about this approach, please join the upcoming non-technical webinar “Quantifying And Managing Cloud Risk For Consumer & Employee Data” on December 9, 2020 at 11 am EST. Being one of the panelists, I will take on a compliance perspective for protecting personal information in the Cloud. You are welcome to register here.