Integrating Risk Management into Business and IT Processes

Risk where decisions happen

Most new risk is created by decisions: a new project, a new supplier, a system change, an acquisition. If risk is only assessed once a year, those decisions go unchecked in between. One CISM task is to facilitate the integration of information risk management into business and IT processes: putting a proportionate risk question inside each decision process.

Touchpoints

Risk built into strategic planning, projects and SDLC, change management, procurement, M&A, incidents and audits.

Process	Risk integration
Strategic planning	Risk considered when goals and plans are set
Projects and the SDLC	Risk assessment at stage gates; security requirements in design
Change management	Security impact assessment for significant changes
Procurement and suppliers	Risk tiering and due diligence before contracts
Mergers and acquisitions	Security due diligence on targets before the deal
Incidents and audits	Findings feed back into the risk register

Projects and the SDLC

A light check early saves an expensive fix late:

Idea: an initial risk rating. What data and systems are involved?
Business case: security costs and residual risk included.
Design: security requirements and threat modelling.
Go-live: residual risk formally accepted by the owner.

Making it easy

Proportionate: a quick rating first; a full assessment only for high-risk items. Forcing every change through a full assessment creates delays and workarounds.
Standard tools: templates, questionnaires and common risk scales.
Risk champions: trained people inside business units and IT teams.
A feedback loop: incidents, audits and tests update the register.

Example. A company adds a five-question security screen to its project intake form. Low-risk projects pass straight through; about one in six triggers a full assessment. Security now hears about new cloud services before contracts are signed, instead of after go-live.

Signs it’s working

Risks are raised by the business, not only by security.
Projects include security costs in their business cases.
Discovery tools find few “surprise” systems.
The risk register changes between annual assessments.

Integration doesn’t transfer ownership: business owners still own the risks their decisions create.

How the exam asks about it

If the question asks…	The answer is usually…
Best way to keep risk assessment current	Integrate it into change, project and procurement processes
When to assess a new project’s risk	Early, at initiation and design
How to avoid slowing the business	Proportionate, risk-tiered checkpoints
Who owns risks identified in projects?	The business or project owner
Goal of integration	Risk management becomes part of normal business processes

In short

Facilitating the integration of information risk management into business and IT processes is a CISM task.
Risk is managed best where decisions happen: strategic planning, projects and the SDLC, change management, procurement, mergers and acquisitions.
Integration uses proportionate checkpoints: a quick risk rating for everything, deeper assessment only where the rating is high.
Standard templates, risk criteria and risk champions make it easy for the business to do it themselves.
Outputs from incidents, audits and tests flow back into the risk register.
The goal is that risk management becomes part of how the business works, not a separate activity run by security.

Exam traps

An annual risk assessment alone misses risks created by changes during the year.
Making every change go through a full risk assessment creates delays and workarounds; scale the effort to the risk.
Security reviewing a project after it's built is too late to influence the design cheaply.
Integration doesn't transfer ownership: business owners still own their risks.

Slides

Click the slide and use the arrow keys. F toggles full screen.