WHITE PAPER THE 6 DIMENSIONS (& OBSTACLES) OF RISK MANAGEMENT

WHITE PAPER THE 6 DIMENSIONS (& OBSTACLES) OF RISK MANAGEMENT

Risk management efforts often begin as focused attempts to improve certain elements of risk or compliance management within one functional area such as IT, security or finance. The function takes on the challenge of building a defined approach to methodically review risk or catalog compliance obligations to ensure that individual piece of the organization is properly tracking towards its objectives. The drivers for this effort can be many regulatory pressure from an external entity, strategic acknowledgement by executives or bottom-up efforts by front-line managers to reduce risks. Eventually, this function designates resources, implements processes and utilizes some technologies to address risk and compliance issues. As more functions understand that risk and compliance management is part of managing business operations, more risk management processes are created. Most organizations take the path of building individual pieces of this overall program independently, since each function has its own nuances and challenges. As the implementations become more mature, the organization realizes there are significant benefits to streamlining processes, reducing efforts and eliminating redundant activities. This is the point at which the organization determines an integrated approach to risk management would be a benefit to the overall organization and launches an initiative. THE DIMENSIONS (AND OBSTACLES) OF RISK MANAGEMENT PROGRAMS When you look at establishing your risk management program, it is useful to consider some fundamental dimensions that can be examined to assess overall effectiveness. Breadth, depth, adaptability, ecosystem, track record and strategic value are all indicators of a strategic approach to addressing business risks. Each of these dimensions is associated with a barrier to success. When building your strategy, it is beneficial to understand and plan for these obstacles. Breadth (Obstacle: Silos) Breadth is defined as the scope of your risk program across the enterprise from an organizational, technical and functional perspective. Organizations that create silos, or individual functions with no connection to other risk functions, miss the point of integrated risk management. The resulting program will have individual kingdoms that rarely share information or that have do-it-my-way mentalities. Risks today are connected like never before. For example, a security incident can result in a compliance failure, initiation of a disaster recovery play or involvement of a third party. Traditional functions in this example, security, compliance, business continuity and third-party management, respectively that are not connected will not adequately manage the risk. 1

How broad is our risk management strategy and the technical solution plan to support it? What mechanisms (organizational and technical) are we putting in place to dissolve silos into an integrated approach? What organizational and technical changes do we need to make to foster collaboration and promote the cultural change to break down the silos? Depth (Obstacle: Time/resources/skills) Depth is defined as implementing effective risk management processes within operations. Organizations that lack the time, resources or skills to implement or maintain the program have difficulties driving the program into the heart of risk. The depth at which your organization attacks risk will depend on your ability to leverage industry best practices and expertise to quickly implement processes and keep those processes on pace with the business. If you are addressing risk only at the surface, perhaps by simply working the issues identified during assessment processes, you will miss many root causes of systemic issues. How do we not only raise up issues but also strive to understand the root cause of risk and compliance issues? How are we keeping our risk and compliance teams up to date on current best practices? What are we doing from a technology perspective to get deeper visibility into risk in business operations? Adaptability (Obstacle: Rigidity) Adaptability is defined as the ability for the risk management program to adjust to changing requirements. Organizations that implement rigid processes or rely on technologies that hard-code data, workflows, reporting, etc., can t react quickly to changes. Business change is one of the most common causes of gaps in risk and compliance processes the business changes too fast and the risk management program cannot keep up. Many times this is due to a lack of flexibility in both processes and technology. 2 How fast can risk, security, compliance and other risk-related functions respond to a business change? Has organizational and technical adaptability been built into the program? What capabilities do we have to enable change, and do we have the right governance structure in place to respond appropriately? Ecosystem (Obstacle: Culture) Ecosystem is defined as the collaborative environment necessary to address the multidimensional nature of risk. Organizations that don t address the cultural changes necessary to implement

risk management will start hitting ceilings in terms of maturity. Risk management requires a strong relationship between the risk functions and the business. Building these relationships is necessary to get both sides on the same page. This impacts everything from strategic planning to operational implementation. Are we getting IT, the business and risk management functions talking on a regular basis? How are we instituting a change in how risk is perceived and managed across the organization? How are we transferring risk management knowledge to the front-line operations to better engage them and educate them as the first line of defense? Track Record (Obstacle: Lack of wins) Track record is defined as the series of program successes that demonstrates reliability of the overall program. Organizations that have a lack of wins (or a failure to achieve a continued progression of program successes) can lose faith in the program. This will cause issues for the program champions and undermine credibility in the business. Your strategy must allow you to implement those processes you need first, show progress and then move on to the next set of use cases. This applies to both organizational successes and technology implementations. Maturity Does our strategy unfold where we can demonstrate success on a regular basis? How do we communicate successful stages in our program? How well is our technology suited to incrementally expand the program in the context of our strategy? Strategic Value (Obstacle: Lack of measurement) Strategic value is defined as the long-term positive business outcome of the risk program. Risk programs that don t measure success will lack a method to show the strategic value to the business. This will lessen the program s impact and potentially affect funding and executive support. To show a return on the investment, you must plan in advance how you will measure your successes in tangible terms. 3 What metrics (time, budget, effort, etc.) are we measuring today that we can monitor over time to demonstrate improvements? How will we accurately capture and report on key metrics as we execute our strategy? What is the best approach to show strategic value (return on investment, time efficiencies, reduction in costs) and how does it align to overall business objectives?

SUMMARY Dimension Key barrier Organizational impact How RSA Archer solutions help overcome these barriers Breadth Managing risk holistically, crossing risk domains (operations, IT, resiliency, etc.) Silos Organizational silos create kingdoms of do it my way. RSA Archer solutions provide a common platform to address multiple dimensions of risk. Depth Implementing effective processes (best practices) Resources Without the resources to implement and scale, processes are inches deep and don t really get to the heart of the risk. RSA Archer use cases are built on industry best practices to speed implementation. We also offer specific courses through RSA University to ensure your resources are trained and knowledgeable. Adaptability Agility to modify and respond to business changes Rigidity Organizations that hard-code processes or technologies can t react to changes. The RSA Archer platform provides a flexible implementation path through our many use cases. The flexibility of the RSA Archer platform enables your organization to build risk management processes based on your business requirements. 4

Ecosystem Building a strong community to learn/share/ engage Culture A closed culture impedes communication, sharing, knowledge transfer and collaboration. RSA s professional services and partners have specific offerings to keep your program moving from strategy planning to ongoing implementation support. Track Record Demonstrating definitive progress within a long-erm strategy Lack of Wins Lack of progress will cause loss of faith, political turmoil and second guessing. The RSA Archer use case strategy allows you to implement individual processes within a broader strategy. Our track record in the market shows how we can support cross-functional risk programs. Strategic Value Demonstrating clear ROI, business value from investments Lack of Measurement Programs can lose funding with no way to articulate value. The RSA Archer Community is an excellent venue to draw from the experiences and expertise of our broad, global customer base. Overcoming the barriers to an integrated risk management program requires a strategy that is built around key principles of risk management, coupled with an understanding of the nuances of your business. The end goal of risk management is to help the business achieve objectives and improve decision-making. However, the implementation of a risk management program is not a simple step 1, step 2, step 3 type of project. It requires cross-functional teams working together and consistently progressing towards the long-term objectives. 5 Silos, resource limitations, rigidity, culture, a lack of wins and a lack of measurement are common obstacles to success. These impediments can be

overcome by building an appropriate strategy and working with a technology partner that has the right capabilities in place: DEPTH: RSA Archer solutions incorporate the industry-leading best practices you need to get an effective business risk management program up and running quickly. BREADTH: The RSA Archer Suite includes multidisciplinary risk management solutions and use cases that address the most critical domains of business risk. ADAPTABILITY: RSA Archer solutions are designed to help you evolve your risk management program as your business changes. ECOSYSTEM: With RSA Archer solutions, you can tap into the collective knowledge of our community and certified RSA Archer experts to help you get your risk management program on the right path from the start. TRACK RECORD: The RSA Archer Suite is recognized by industry analysts as a perennial leader in providing superior risk management solutions. STRATEGIC VALUE: RSA Archer customer stories are the best evidence of the positive outcomes from our business risk management solutions. RSA Archer solutions offer depth, breadth and adaptability to manage risk in multiple domains, combined with the ecosystem and track record to deliver strategic value to your organization. Learn more about RSA Archer solutions for business risk management at rsa.com/grc. 6 RSA and the RSA logo, are registered trademarks or trademarks of Dell Technologies in the United States and other countries. Copyright 2017 Dell Technologies. All rights reserved. Published in the USA. 10/17 White Paper H16755 RSA believes the information in this document is accurate as of its publication date. The information is subject to change without notice.