We just ended our first Certified Enterprise Risk Manager(R) Bootcamp in Seattle. Five days of risk bonding, sharing of risk information, and risk learnings. it was a great success. Continue reading
From http://www.digitaljournal.com/article/320137:
Under the Sarbanes-Oxley Act, publicly traded corporations must apply appropriate methods to ensure controls over the organization, one of which is enterprise risk management (ERM). The Federal Information Security Management Act (FISMA) states federal government agencies must comply with guidance and standards of the National Institute for Standards and Technology (NIST) in its Special Publications 800 (SP800-nn) series for Information System Security (ISS) also known as cybersecurity. It’s good advice that commercial firms are well served by adopting too. Cybersecurity as a sub-discipline of Information Technology (IT) has had problems communicating with middle management and executives. In December 2010, NIST published a second draft of its guidance, “Integrated Enterprise-Wide Risk Management” (NIST SP800-39) that works with its rapidly evolving cybersecurity special publications series to try to bridge that gap.
Background
In the hierarchy of problem solving methods, Bob Charette[1]described the differences between risks and problems and between risk management (RM) and problem management (problem solving) very clearly.
The differences between problem and risk management are primarily in time frame, control span, and information domain: problem management has a short time frame, tight controls, and needs only narrow information. Risk management has a long time frame, loose controls, and wide information needs. Indeed problem management is a subset of risk management. Charette1 points out that lack of time, control, or information often is the root cause of risks, and that lack of risk management mostly leads to more severe and repetitious instances of problems. The management of risk is the management of change and of the choices that come with change.
Risk Management
RM methods exist in many domains. The NIST (security) risk management cycle[2] is in Figure 1. It also is a form of action inquiry (frame, advocate, illustrate, inquire), a technique from high-capability organizational transformation[3]. The initial step is framing the context in which to identify risks and defining them. This can be organizational context or individual risk context. Risk owners may be assigned in this step or the next. Risk assessment involves identifying the likelihood and impact or consequences of the risk becoming a problem, but also a) the indicators and their threshold values when the risk mitigation should be activated, and b) the priorities to address the risks. Risk mitigation is what one chooses to do to reduce the likelihood or impact of the risk if its indicator threshold is exceeded. Risk monitoring tracks the risks and status of mitigations and activates mitigations as indicated.
Figure 1: NIST Risk Management Framework2
Risk Management can be done at many organizational levels. Traditionally Enterprise Risk Management (ERM) has been in the domain of finance or actuarial science. As Greg Hutchins[4] says, “Would you trust me, an engineer, to audit your books? Then why would you trust a CPA to audit your technical processes?” An enterprise needs both financial and technical risk management at appropriate levels, but it has to be affordable and cost-effective.
“Integrated Enterprise Risk Management” provides a detailed description of how three tiers of risk management can integrate to provide an appropriate context for cybersecurity as the lowest tier RM mechanism as in Figure 2. The focus of SP800-39 is on inter-tier deliverables rather than methods at each level.
There is a spectrum of ways to define risks during framing step from simple brainstorming (open) through model-based approaches to checklists (closed). Which method is appropriate varies as to situation, the organization’s risk culture and appetite, and its governance mechanisms as well as different techniques available at different organizational levels. Figure 3 provides the primary focus of each tier. Charette1 notes that the lower the organizational level, the more bounded the risk set and so checklists are more appropriate but they are almost never all of the risks that should be defined in framing risk. RM is about managing change so static checklists can’t provide good risk identification for long. 
Figure 2: Multi-tiered Enterprise Risk Management2 
©1993, Robert Charette Figure 3: Risk Approaches by Organizational Tier1
The risk framing and identification techniques used in Tier 1 range from traditional strategic planning: Political, Economic, Social, Technology / Strengths, Weaknesses, Opportunities, Threats (PEST/SWOT) brainstorm analyses (open) through Model-based approaches of COSO[5] brainstorming to checklists generated from trade journal and economic factor lists and financial ERM methods. Tier 2 techniques range from brainstorming ala Force-Field Analysis[6] (open) through an appropriate Business Value Model-based brainstorm to discipline-specific or functional checklists such as Westerman’s “IT Risk Management” checklists.[7] Tier 3 methods run from simple brainstorms to risk-area-based brainstorms (Office of Management and Budget’s Circular A-11, Exhibit 300, 2005 list of 19 risk areas in which all investment programs had to identify risks), to checklists (NIST SP800-53A 400+ security controls that might be required of an information system).
The COSO5 model for Tier 1 is shown graphically in Figure 4. The risk management process is the eight rows, while the four bands across the top are the areas in which to brainstorm risks at organizational (and supply chain) tiers. 
Copyright 2004-2011. Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Used with permission.
Figure 4: COSO5 ERM Framework as Model for Brainstorming Risks
An example of how to initiate a Tier 2 business value model-based brainstorm is shown in Figure 5. The core, value-production process is in the center with support areas (probably multiple processes each) at the top and a risk or how to find risks noted. References for how to do the rest of the above methods are in the appendix. For examples send an email to the author.
© John Wiley & Sons, Inc. 1998
This material is reproduced with permission of John Wiley & Sons, Inc.
Figure 5: Value-Shop Model Basis for an IT Organization Risk Generation Exercise[8]
There is no canned approach yet to integrate RM across tiers. The best approach is from Russell Ackoff[9] where he describes how to establish interlocking governance boards across levels. That is, one member from boards below or above or both is on a governance board presenting and carrying back results of the other board’s dialog and decisions. NIST SP800-39 describes the roles and responsibilities of each tier and the way each provides input and feedback to the others.
Managing Change to RM
With respect to adoption of RM, in 1993 Charette1 was concerned that RM would follow the trajectory of Total Quality Management (TQM) as a bottom up method that would not become a stable executive behavior. His thesis was that without executive and middle management understanding of the difference between risk management and problem solving, RM would become bureaucratic and then disappear from its own weight. The newest change management methods are from Leadership Development Framework (LDF) and Action Inquiry method3. Leaders may be at one of seven stages (See Figure 6). The leader, usually manager, sets the culture of the group s/he manages to his or her stage given enough time. Thus how you work with a group tends to depend on how you would work with its leader. Depending on the level, there are mechanisms to use to engage them in change.
For leaders / groups of stage 5 and up (15% of people), there is usually not a problem in being heard and having the idea of RM reviewed and prioritized among other opportunities to be pursued. For a leader or group at stage 4 (30%), one has to raise the RM idea and sell it, but the leader will not dismiss it immediately. A good business case[10]will be sufficient to get RM in the set of opportunities to pursue.
|
Action Logic |
Characteristics |
Utility |
Frequency |
| Magician | Generates societal transformations, integrating material, spiritual, and social | Good for leading cultural changes |
1% |
| Strategist | Generates organizational transformations: uses joint inquiry, care, vulnerability | Effective leader to transform an organization pro-actively |
4% |
| Individualist | Integrates organizational and personal processes by creating unique ways to close plan-actual gaps | Effective in consulting and new developments |
10% |
| Achiever | Meets strategic objectives via teams, balancing people needs and results | Good operations manager with desire for action and need to achieve |
30% |
| Expert | Approaches problems from expertise in logic of a discipline, seeking efficiency | Good contributor |
38% |
| Diplomat | Nice, avoids open conflict, values-based decisions | Social binder, support for others |
12% |
| Opportunist | Narcissistic, manipulative, power-seeking | Good when collateral damage isn’t important (emergencies, used car sales) |
5% |
Figure 6: Leadership Development Framework Stages
Stage 3 Experts (38%) – engineers are the archetype – tend to be comfortable with the processes that they use and in which they have roles. They also value observations over theory. Describe RM as a process and how it can be embedded as very minor changes in current processes to address requirements of “looking before we leap.” Give stage 3 experts a concrete example of how RM might have helped versus hindsight. The analogy that RM is like looking through the windshield at where you’re going, while quality (process) assurance is like looking out the side windows, and quality control / test is like looking in the rear view mirror may resonate as well.
Stage 2 Diplomats are nice. They appreciate niceness and conformity to espoused organizational values. RM may be something they can support as an organizational value. FAA has a passion for aviation safety (inherently risk-based) or fear of something not nice happening if RM is not tried. Al Cole at CIA once said that government managers, especially executives have three motivations. The first is to get into the good old boys (and girls) club. This may not be in the organization but outside. Pressure may be made to exist via the phenomenon of management fads. Second, and three times higher motivation than getting into “the club,” is fear of being accused of not being a team player. To use this motivation, someone must have adopted RM and others should be talking about it. Third and the most powerful motivator of all is to show the manager or executive how s/he can say, “Aren’t I wonderful?” for helping you. All of these reflect stage 2 Diplomat thinking.
Finally, a stage 1 Opportunist may be sold that riding the RM train will bring him/her fairly instant gratification and rewards. However, they are not good at any kind of input or feedback, so it may be better to find another manager or group rather than take the risk of trying to sell RM to a narcissist. Send an exciting (but short) article about how RM saved an organization or caused it to excel.
The FAA adage is also true for all of the above. “If you want anything to change you have to build a coalition, and if you invite anyone to the table, you have to have some quid pro quo, even if it’s only your own time and effort, which it always will include.”
Summary
Risk Management is likely to be an excellent island of stability in the current sea of change. Unlike a lot of other changes, some of the techniques such as Force Field Analysis can be performed and show value to the participants in as little as 20 minutes for tactical or even middle management decisions about the future. As with other methods, it is better if the whole organization adopts its use within a short period, and the culture changes too. Integrated ERM is a new concept, but without its adoption, the other RM types are less likely to either deliver maximum value or fail to be sustained.
Previously published in IEEE USA Today’s Engineer
References for methods: Brainstorming – http://en.wikipedia.org/wiki/Brainstorming PEST analysis – http://en.wikipedia.org/wiki/PEST_analysis SWOT analysis – http://en.wikipedia.org/wiki/SWOT_analysis Force field analysis – http://en.wikipedia.org/wiki/Force_field_analysis COSO ERM – http://www.coso.org/documents/COSO_ERM_ExecutiveSummary.pdf
Want to make money? Want to know the future of quality? Want to know how you can position your career? Well listen up:
ISO 9001 is moving to become a risk management standard.
By Ed Perkins
e.perkins@ieee.org
We hear lots of advice on how things now are being “reframed” in terms of risk. But what does this mean? How would I know that if I saw it? It helps to be an educated observer so you can tell when someone is ‘walking the talk’ vs. ‘blowing smoke’.
First, let’s look at how a risk view is different from the usual and customary. Every day we hear and read about many factors of concern. Here are some examples that quickly come to mind:
These factors are weighted towards transactions and outcomes, in other words, organizational objectives, which is the primary goal of any organization.
If we step back a bit, and look up at a bigger picture, we see that all these factors of concern are based on ensuring a positive outcome or avoiding a negative outcome. We want to avoid defects, have happy customers, be in compliance, be immune from threats, have reliable products, meet schedules, achieve milestones, and have positive results from the things we have to depend upon.
What about risk? When we think about risk, we tend to think of danger and peril, although there also is risk-reward, taking a risk, going out on a limb, etc. So risk is both bad and good? No, risk is risk; it is the possible consequences of the risk that can be bad or good.
Which brings us back to reframing things in terms of risk. If we switch to a risk perspective, these factors can be restated as (reframed):
Or in other words, in the risk domain, failure to achieve objectives.
Thus in the risk domain, the focus is not on the objectives per se, but on the risk to achieving the objectives. Risk Management is applied to control the risks and enhance the likelihood of achieving the objectives. Risk can be looked at as a two-sided coin: opportunity or danger. Either way, the same approach can be used to manage risk.
To determine if you or your organization are reframing things in terms of risk, or operating in the risk domain, look for this evidence. Do discussions of objectives cover risk? Is the likelihood and consequence of risk factored into decision making? Is any attention paid to assessing likelihood of risks happening, and if the consequences are severe, is any effort put into determining risk management and mitigation options.
