Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Aligning IT Risk Management with Business Strategy
Why strategy comes first
IT risk is the risk that technology stops the business reaching its goals. A risk practitioner who doesn’t know the goals can’t tell which IT risks matter, so understanding strategy and objectives is the first step in every IT risk activity: assessments, scenarios, responses and reports.
From goal to risk to control
Every IT risk should trace back to a business objective it threatens, and every control back to a risk it reduces. If a control can’t be traced, ask why it exists.
Risk supports strategy both ways
- It protects goals. It identifies what could stop current objectives and keeps that risk within appetite.
- It informs choices. It shows the risk of new strategies, so leaders choose with their eyes open.
Example. A retailer plans to move all sales online within two years. The risk practitioner shows that the plan makes website availability and payment fraud top risks. The board approves the strategy and funds resilience and fraud controls as part of it.
Speak the business’s language
| Technical statement | Business statement |
|---|---|
| Unpatched web server | Possible theft of 2 million customer records and regulatory fines |
| Single database server | Online sales stop if it fails; about 40,000 an hour lost |
| Weak vendor access control | A supplier compromise could halt production |
Risks expressed in business terms get attention and funding. Technical severity alone doesn’t make something a high business risk.
When strategy changes
- Revisit the risk profile and top risks.
- Check whether risk appetite still fits.
- Reprioritise risk responses and resources.
- Update risk scenarios for new products, markets or technology.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step in an IT risk assessment | Understand business objectives and context |
| MOST important when prioritising IT risks | Impact on business objectives |
| BEST way to get management attention | Express risk in business terms |
| After a major strategy change | Reassess the risk profile |
In short
- IT risk matters only because it can stop the business achieving its objectives; every risk should trace back to one.
- Understanding business strategy and objectives is the first step in any IT risk activity.
- Risk management supports strategy in both directions: it protects existing goals and informs decisions about new ones.
- Risks expressed in business terms get attention and funding; risks expressed in technical terms don't.
- When strategy changes, the risk profile, priorities and appetite need to be revisited.
Exam traps
- Starting a risk assessment with a vulnerability scan instead of the business objectives.
- Treating IT risk as an IT problem rather than a business risk.
- Assuming a technically severe issue is automatically a high business risk.
- Leaving the risk program unchanged after a major change in strategy.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From goal to risk to control