Beating IT Risks

Figure 11.1—Mapping of causes and consequences, showing illustrative links between the multiple causes (of a specific set of events) and their collective consequences

Rating IT risk alongside other risks

Do IT risks rate as one of the top risks in your company?

Let’s establish a framework within which to answer the question:

•For consistency of language, we say that (risk) causes lead to (risk) events that then have (risk) consequences;

•Failure within the IT risk portfolio is one of many causes of risk events within the enterprise – one of the many areas in which things can go wrong that can lead to a negative consequence for the business;

•Other risk causes may be totally unrelated with IT risk, or closely related with IT risk – this is known as inter-risk correlation; and

•The consequence for the business will not always be quantified. When measured reliably, it will be available only for past actual loss events and will typically be focused on the normal range of losses or ‘expected loss’.91

Within this framework we can create an illustrative ratings table of enterprise risks, illustrating the top risk causes and the major risk impacts or consequences, experienced within a given period (see Figure 11.1). The focus here is on the major ‘hits’ taken by the enterprise and the contributing causes.92 The lines joining the causes and the consequences indicate the major relationships evident in the risk events experienced within the period. For example, failures in

91‘Unexpected losses’ are those typically large consequences that are outside the normal range.

92This approach is similar to the approach taken by the World Health Organization in the World Health Report 2002 (WHO, 2002), in describing the major burden of disease. The leading ten risk factors and injuries are set out with causal links indicated, for example, between alcohol and road traffic injury, tobacco and lung cancers.

corporate governance led to reputational and financial loss. The number of stars is indicating the qualitative or quantitative assessment of the consequence. Note the big ‘hit’ to reputational loss also resulted from personnel and product quality failures that were contributing factors in the risk events.

In this illustrative example, IT ranks fourth behind failures in corporate governance, audit and personnel as a major cause of negative enterprise risk consequences, for the specific illustrative set of events.

Quantified loss and qualitative loss data should be normalized against the expected losses (normal range) in each category. While ‘plain sailing’ is desirable, it is not anticipated in any category of loss. Figure 11.2 illustrates this concept. Outcomes range from better than expected (one star), expected (two stars) through to catastrophic (five stars).

Comparability of losses in different categories may be attempted, but will remain open to the charge of subjectivity and may be considered insensitive (e.g. three deaths in our refineries is considered equivalent to how much in fraud-related loss?).

Where quantitative data is available – say, quantified total loss distribution represented as an aggregate annual loss – it may be translated as shown in Figure 11.3. This approach to rating IT risks alongside other enterprise risks reflects the reality that in most organizations priority funding will go towards patching today’s gaping holes.

If IT doesn’t rate as one of the top priorities then it won’t get the priority funding.

To the extent that the top risk causes don’t mop up all available funds and attention, management discretion will dictate how the remainder will be shared out amongst those areas most likely to negatively impact the business in the future and look with favour upon those offering cost-effective risk management options.

If you are operating in such an environment, IT risk spend needs to be justified and cannot be taken as a given. The pragmatic questions to ask cover a range of assessment tools:

•Actual loss experience: What are the major ‘hits’ you are taking? How did the ‘things go wrong’ and which risk portfolios do the things going wrong lie in?

•Control assessments: How effective are the existing controls and how can they be improved? Where are the most sensible, actionable and preventive risk treatment strategies directed?

•Key risk indicators: Do you have a set of indicators across all the risk areas that are effective in identifying deviations from the expected norms?

•Scenario analysis: For a broadly defined collection of scenarios, how well does your organization respond? Given that the scenarios cut across risk areas through multiple contributing causes, how should your limited risk treatment spend (mitigation) be allocated to ensure maximum effectiveness?

Figure 11.3—Qualitative to quantitative risk analysis mapping

Aligning roles and responsibilities for risk management

Risk management responsibilities are typically allocated widely across the business:

•Line-of-business managers held ‘fully accountable’ for managing risks that impact ‘their patch’ as part of the delegation of general managerial responsibilities. These managers are the organization’s risk-takers.

•Specialists in risk management, typically associated with a central function (e.g. group risk, risk analytics) assigned to provide support to the line-of- business managers, to provide risk management tools, and to ensure the application of policies, processes and standards is consistent, including standardized methods and metrics for expressing risk.

•Specialists with a narrow focus on specific types of risk events, with attempts to minimize their occurrence and severity of impact: fraud, credit losses, industrial action, money laundering, damage to physical assets, theft, etc.

•Specialists, typically in cross-company functional roles, attempting to minimize the consequences and impact of all risks on the business (including quantifiable losses), focused individually on different areas of consequence: reputational, financial, customer, legal and regulatory, etc.

•Specialists working with non-IT risks and issues that can cause various impacts: people, process, policy, business strategy, etc.

•Auditors (internal and external) typically exert independent whole-of-business review responsibility, to monitor and confirm compliance and adequacy of controls.

•CFOs and others responsible for rationing the allocation of capital across the enterprise intent on seeking the best risk-return outcome.

With this existing complexity, it is readily apparent that support functions, such as IT, with responsibility for delivering services across the business, must take an integrated risk management approach, because:

•The head of IT, if held accountable alone for managing IT risks, would not wear the consequences of loss or benefit from improvements. The line-of- business manager accountability would be eroded by IT’s perceived arbitrary judgements about the relative priorities and importance of different risks. An inevitable and unproductive cycle of blame would arise when unexpected losses arise that relate to an IT failure.

•Equally, a completely federated model – in which the line-of-business manager is able to ‘go it alone’ – is not feasible because of their reliance on infrastructure, applications and IT services that is shared with other parts of the enterprise.

So we have the complexity of shared responsibility, matrix organization and functional specialists working with line-of-business managers. On top of this we are dealing with the challenging topic of business risk and the complexities of IT.

This suggests a strong teaming approach is necessary, bringing together the multiple perspectives and specialists and supporting them with a common language and common risk management processes, supported by common tools and information systems.

Where to focus team efforts

To work out where the most active teaming is required, it is most useful to look at the universe of risks being managed across your business. For each of the risks, you can identify to what extent IT is:

•A potential cause or an important part of the control environment; or

•A key tool to aid risk management activities, particularly through risk information system support.

For those risks that achieve high ratings you will find a requirement for the most active teaming between business and IT specialists on joint risk management activities.

Some generic examples are illustrated in Table 11.1. Summarizing from the example table, most active teaming – between IT and others across the business

– would be required on fraud, privacy and credit loss risk management in this case. In particular, advanced IT measures for risk mitigation will be required or expected. For your organization, you would need to identify, for all major risk consequences, the level of IT cause (or control) and how much help you’ll need from the IT people.

Table 11.1—Effect-cause chart for typical risk consequences, showing level of IT cause or control, and the level of team support needed from IT staff

Banking industry operational risks

The universe of risks and how it is segmented for management purposes differs for each industry. Significant leadership in risk management, including IT, is demonstrated in airlines, military, intelligence, police and emergency services as well as some high-hazard mining and exploration industries.

Banking has been selected as an example because of the elevated position and importance of enterprise-wide risk management within banks, the recognition that banks are at the forefront of operational risk management practice and the particular importance of IT to banking operations makes lessons beneficial to others.

In banks, enterprise-wide risks are commonly defined in four broad categories:

1.Business risks – regulatory, political, competition, reputation, litigation, systemic events;

2.Credit risks – billed receivables, delivered unbilled and forward credit risks;

3.Market risks – commodity price, volatility and correlation, commodity volume, financial (interest rates and Foreign Exchange) and liquidity;

4.Operational risks – processes, technology, people and external events.

The Bank for International Settlements has focused significant recent efforts on the development of risk management frameworks and models, to be enshrined in the New Basel Capital Accord (also known as Basel II) that is to be implemented in member countries by year-end 2006 (BIS, 2003b, 2003c). A primary focus is on capital adequacy of reserves held by banks to cater for risk-related losses.

Operational risk in Basel II terminology deals with ‘losses resulting from inadequate or failed internal processes, people and systems, or external events’ and is structured into defined risk event-type categories (see Table 11.2).93

Risk events directly related to IT risk comprise a small proportion (approximately 3%) of the total value of the reported loss events. If treated as a ‘siloed’ risk management issue in banks, IT risk wouldn’t get much oxygen – leaders of the business would be far more likely to consider the other 97% of risk eventtypes! In practice banks will rank risks by the capital provision that they need to make.

However, risk events indirectly related to IT risk, where IT can mitigate or control the risk, comprise a large proportion (over 50%) of the total value of the reported loss events. The extent to which IT can make a contribution varies across these risk event-type categories. Let’s explore a few:

•External theft and fraud perpetrated via electronic channels may be reduced through improving IT authentication and access control methods;

•Transaction capture, execution and maintenance failures may be reduced through improving user interfaces, data validation and integrity checking at point of entry and rules-based workflow routing for managing processing exceptions; and

•Disclosure of information to clients may be made more consistent through on-line information delivery.

We have also assumed an indirect IT risk relationship between the damage to physical assets and the disasters and other events category, where IT and information assets may be amongst those threatened and damaged.

Notwithstanding the importance of IT-related risks, it is apparent that many types of risk events unrelated to IT risks do comprise a significant proportion of the total value of the reported loss events. Investments in IT won’t save the businesses from these types of loss as the root cause lies elsewhere. Minimal contribution by IT specialists to risk management activities in these areas would be appropriate.

Risks of compartmentalizing IT-related risks

If we consider a recent incident at National Australia Bank, where traders were found guilty of ‘hiding’ mounting market losses – in part to secure individual bonuses of up to A$265 000 – inevitably the ‘systems’ were brought into the dock along with the traders, their supervisors, auditors, risk management functions, members of the board, etc. All were found to be guilty or inadequate and to

93 Banks provided information about all individual operational risk loss events with gross loss amounts above a10 000 for 2001 within the defined categories.