Risk Management

In an environment where risk is persistent and constantly changing, enterprises must develop a comprehensive risk management strategy that fosters a risk-aware culture.
However, identifying and controlling risk depends on rapid access to quality data.

This guide will provide an overview of risk management, its principles, and a framework for implementing a comprehensive risk management strategy based on streamlined data access.

What is the main purpose of risk management?

The primary purpose of risk management is to proactively, continuously, and systematically address vulnerabilities before they can materially impact the business, its employees, or its customers.

Since risks can appear anywhere, a risk management strategy must be comprehensive and holistic. A gap in physical security could give threat actors access to internal systems. A vendor with weak financials may take shortcuts that compromise its customers. Software development practices could open the door for supply chain attacks.

To effectively manage risk, companies must develop systems based on constant, 360-degree vigilance and continuous improvement.

What is the difference between risk management and risk assessment?

Risk assessment is the first stage in the management of risks. It starts with an audit of a company’s assets and processes that identifies the internal vulnerabilities and external threats that comprise risk.

After identifying the potential risks facing a company, risk managers assess each one’s probability and impact. Could the threat damage the organization’s assets or compromise its data? Would it disrupt business operations? Could it prevent the company from achieving its objectives?

Once complete, the risk assessment provides the basis for the rest of the risk management plan: prioritizing potential risks, mitigating risks, and developing contingency plans to manage a threat when it occurs.

What are the 8 principles of risk management?

Enterprise risk management is more than the technical implementation of top-down policy. Effectively controlling risk requires a risk-aware culture in which everyone at every level understands they have a responsibility — and the ability — to manage risk. ISO 31000 defines these eight risk management principles that can guide companies toward that risk-aware culture.

1. Include all stakeholders

Wrapping risk management in secrecy and closed-door executive meetings sends a clear message that risk is somebody else’s responsibility. A risk-aware culture requires open communications between internal and external stakeholders.

2. It’s a process, not an event

Set-it-and-forget-it approaches result in risk management programs that are quickly obsolete. The threat landscape is too dynamic for any plan to remain effective for long. Instead, make the risk management plan a living document. Regularly review and revise controls and periodically update your risk management strategies.

3. Don’t let perfect be the enemy of good

Risks always involve uncertainty. No matter how much time or resources you pour into risk analysis, you will never understand potential vulnerabilities perfectly. Implement risk mitigation plans based on the information you have and use your review process to improve them over time.

4. Don’t ignore the human factor

Human nature creates many of the cybersecurity risks companies face. It also determines how effective risk management processes could become. Make sure your risk assessments evaluate human sources while implementing practices that are easy for people to adopt.

5. Improve continuously

Your risk management team should constantly seek feedback. Interviewing or surveying stakeholders can provide fresh perspectives on how risk practices work on the frontlines. More objective data from risk management systems provide direct insights into performance. Treat incidents as learning opportunities, and use them to improve processes.

6. Integrate risk everywhere

Threats and vulnerabilities can appear anywhere, from software supply chains to third-party vendors to remote-working employees. Develop comprehensive strategies that address risks holistically.

7. Avoid tunnel vision

While cybersecurity’s consequences justify its prioritization, don’t fall into the trap of ignoring risks from other sources. Extreme weather, physical security, and vendor reliability can just as easily jeopardize the company’s finances or reputation.

8. Cookie cutters don’t work

Every organization has a unique combination of threats, vulnerabilities, and risk tolerance. There’s no plug-and-play solution for risk reduction, so you must develop plans for your organization.

What are the 8 elements of a risk management framework?

Even though risk management is specific to each organization, you don’t have to create everything from scratch. A risk management framework can guide your planning process by identifying the elements you must address. For example, the National Institute of Standards and Technology (NIST) developed its Risk Management Framework for Information Systems and Organizations (SP800-37) to steer cyber risk management within the federal government. This framework’s guidance is just as applicable to the private sector.

1. Prepare

Build a solid foundation before acting. Define your risk strategy’s mission, scope, and objectives. Develop a consensus for risk tolerance within the C-suite and the Board. Create a risk management team, with a C-level sponsor, that will develop and maintain your risk management process.

2. Categorize

With the basics in place, you begin the risk identification phase. Survey internal systems and processes to understand your existing vulnerabilities. Scan the threat landscape to identify external threats. Wherever possible, quantify each risk’s impact and probability.

Within the context of your organization’s risk tolerance, categorize these risks by severity and ease of mitigation. Review these categorized risks with senior management to prioritize risk treatments.

3. Select

Select the controls needed to address internal and external risks. Appropriate risk responses include:

• Risk transfer: Shift risks to a third party by revising vendor agreements or purchasing an insurance policy.
• Risk avoidance: Stop activities that create an unacceptable risk, such as ceasing operations in unstable regions.
• Risk reduction: Revise practices to lower risks. For example, using a software bill of materials can reduce exposure to supply chain risks.
• Risk acceptance: Sometimes, organizations must accept risk, such as when a new product’s revenue opportunities outweigh certain unavoidable operational risks.

4. Implement

Create a risk register that documents each risk and its owner, controls, action items, and metrics. The risk management team will use this register to track the plan’s implementation and ensure the organization reduces risks to an acceptable level.

5. Assess

Continuously monitor risks and controls to ensure compliance and to provide input for a regular review and assessment process. Automation can help manage the flood of data modern information technology generates by proactively identifying emerging weaknesses in risk controls.

6. Authorize

Incorporate risk into the decision-making process. Software development, infrastructure investments, and other new business activities shouldn’t proceed without a risk assessment and formal authorization of a risk management plan.

7. Monitor

In addition to monitoring the performance of risk controls, the risk management team must also place the company’s risk posture within the context of a dynamic threat environment. Any change to internal systems can open new risks. Likewise, emerging threats need to be addressed.

8. Revise

Establish a culture and process of continuous improvement. Although NIST folds this element into the previous step, it is worth breaking it out separately. Use stakeholder feedback, operational data, and ongoing threat assessments to improve risk management practices. Learn from risk events. And make risk management part of your everyday business practice.

Starburst Galaxy provides insights into risk management performance

An effective risk management system depends on fast, reliable access to quality data. Starburst Gravity’s universal discovery, governance, and sharing layer provides the rapid, holistic data risk management teams need while contributing to the company’s risk controls.

Unifying enterprise data sources

Rather than consolidating data into yet another system, Starburst’s analytics platform virtualizes every source within Gravity’s single access layer. Data remains at the source where domain owners can implement security and control practices most effectively.

Democratizing access to insights

Galaxy democratizes data access by letting authorized users analyze data stored anywhere in the organization. Giving more people expanded access to enterprise data empowers them to make informed decisions about risk.

Governance and compliance

Galaxy’s ability to deliver faster and better analytics streamlines governance of the risk management systems. Rather than maintaining risk registers manually, Galaxy lets you turn them into data products that provide real-time status updates that reinforce compliance efforts.

Enhance data protection

Starburst also helps control risk by centralizing data access. Rather than implementing access controls source by source, Starburst Galaxy provides a single pane of glass for managing access through fine-grained controls based on user roles and source attributes. For example, Galaxy can reduce data privacy risks by limiting access based on the location of users and data.