Revive Your Risk Management Program With a Regular Health Check

Having set up an IT risk management program that successfully mitigates key risks and raises the profile of IT risk in the eyes of the business, you have taken a significant step in your evolution as a strategic and proactive IT leader.
Unfortunately, your risk assessment is already outdated. Perform regular health checks to stay on top of the key risks threatening the business – and your reputation.
Our project seizes the momentum you created by building a robust IT risk management program, and creates a process for conducting periodic health checks and embedding ongoing risk management into every aspect of IT.
Our approach keeps the business on board by stressing the financial impact of IT risks as well as opportunities for calculated risk taking revealed through a deep understanding of how IT-related risk impacts the business.
Our focus is on using data to make IT risk assessment less like an art and more like a science. Ongoing data-driven risk management is self-improving and grounded in historical data.

Our Advice

Critical Insight

A false sense of security may be your greatest risk. The IT threat landscape is evolving rapidly and won’t wait for you to catch up.
Risk management should be seen and heard. Communicate the dollar value of risk management to keep the business engaged.
The first health check is pivotal. Successfully going through the risk management process the second time around is the difference between IT risk management being perceived as a one-off project and an ongoing program.
Risk management is not checking boxes – you need to be constantly improving. Measuring the effectiveness of your risk management activities is crucial for ensuring that the program lives up to its mandate. It also allows you to communicate a compelling value proposition to senior leadership.

Impact and Result

To prevent your IT risk management program from becoming an artifact, conduct quarterly, biannual, or annual health checks to reassess your risk portfolio and identify new threats and vulnerabilities.
Develop and track metrics to measure the success of IT risk management and illustrate the value of the program to senior leadership.
Create consultant-quality deliverables that inform senior leadership about IT’s risk recommendations, highlighting the potential cost of IT risks and the value created by IT risk projects.
Get better at identifying and assessing IT risk and measure the improvement.
Institutionalize the IT risk management program by consistently engaging key stakeholders within and outside of IT.

Revive Your Risk Management Program With a Regular Health Check Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should revive your risk management program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Revive Your Risk Management Program with a Regular Health Check – Executive Brief

1. Refine IT risk management governance

Assess the maturity of the risk management program and build an improvement plan.

2. Reassess IT risk events and identify new threats

Reassess previously identified IT risk events and identify new threats.

3. Develop risk responses and communicate priorities to the business

Establish monitoring responsibilities, identify risk responses, and communicate priorities to the business.

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Table of Contents

Need Extra Help?
Speak With An Analyst

Get the help you need in this 3-phase advisory process. You'll receive 9 touchpoints with our researchers, all included in your membership.

Guided Implementation 1: Refine IT risk governance management

Call 1: Identify successes and challenges of risk management processes, people, and technology
Call 2: Build an Risk Management Program Improvement Plan
Call 3: Assess business context changes and assess their impact

Guided Implementation 2: Reassess IT risk events and identify new threats

Call 1: Assess the success of implemented risk responses and their impact on risk severity
Call 2: Re-apply identification methodologies and augment with capability mapping
Call 3: Assess severity of new risk events and calculate expected costs

Guided Implementation 3: Develop risk responses and communicate priorities to the business

Call 1: Prioritize assessed risks and set up monitoring responsibilities
Call 2: Identify and assess risk response actions
Call 3: Communicate risk priorities to the business

Authors

Scott Janz

Eric Dolinar

Contributors

Sterling Bjorndahl, Director of IT Operations, eHealth Saskatchewan
Ken Piddington, CIO and Executive Advisor, MRE Consulting
Tamara Dwarika, Internal Auditor
Michael Fossé, Consulting Services Manager, IBM Canada (LGS)
Steve Woodward, CEO, Cloud Perspectives
Anne Leroux, Director, ES Computer Training
Additional interviews were conducted but are not listed due to privacy and confidentiality requirements.