Very few people get excited by risk management. Even fewer get excited about an IT Risk Register.
Whilst the activity might not be desirable, the outcomes & benefits certainly are.
Similar to Technology Roadmaps, a well executed IT Risk Register can provide enhanced clarity, reduced risk and ultimately save you money.
This doesn’t need to be complicated or time consuming. In this article we’re going to explain the basics of IT risk management and how it will benefit your business.
What is an IT Risk Register?
An IT risk register is a document that identifies and manages risks associated with your business’s IT. The structure and methodology is more or less identical to common risk management practices, albeit focused more succinctly on technology risks.
Due to the specialist nature of IT information and insights, it’s ideal for IT risks to be flagged and reported by your IT service provider. This information can then be distilled & absorbed into the company wide risk register where appropriate.
IT risk registers don’t need to be overly complex. As an example, we provide our clients simple colour coded ratings based on the risks impact & probability.
Why you need an IT Risk Register
Here are 3 reasons to why you should have an IT risk register.
Improved Reporting & Understanding
Perhaps the most difficult aspect of managing IT risk is the technical nature of it. Business owners, directors, CEO’s, etc. often struggle to understand the importance of certain issues. A well constructed and managed IT risk register removes the complexity by translating technical limitations into potential commercial impacts.
As an example, consider the following:
- Technical Limitation: The daily backups are stored on a single medium prone to corruption, it’s recommended to use 2 different media types to reduce risk.
- Commercial Impact: In the event of a significant power surge or cyber attack with the current setup the business would likely lose up to a weeks worth of transactions/data and may take as much as 4-5 days to be back up and running.
The later can be easily converted into a dollar value. This makes it easier for non technical people to understand and act on the vulnerabilities in their business.
Increasing Compliance
Even for small businesses, compliance around data and cybersecurity is becoming increasingly common. Government funding, private tenders and common supplier agreements are including more and more questions regarding data security and cyber protection.
Prioritising Risk
When it comes to cyber security and IT risks, you can’t do it all. It’s important to be able to prioritise the items that pose the most risk to business operations. Not all IT risks are created equal and it’s important not to get hyperbolic when discussing risks in a vacuum.
An IT risk register will help you see the forest from the trees. This prevents you from over investing in inconsequential items (see 3 Things To Know When Investing In Cyber Security Services).
Tips for Creating an Effective IT Risk Register
We have a number of tips and insights regarding IT risk management. Below are some of our suggestions.
Risk Identification
Whilst it makes sense to be thorough, try to avoid identifying too many risks early on. It’s important to establish your risk management process and get into a rhythm before adding too many items.
Avoid items initially that are out of your control or very low impact. You can always add these items in later once you’ve mastered the process. It’s better to get traction with a handful of high impact risks than to get bogged down with too many small items.
Additionally, how you define these risks is very important.
Risks on the register should be specific in nature and include an event, cause, and the result if the event was to occur. We recommend the following format:
[Event that has an effect on objectives] caused by [cause/s] resulting in [consequence/s].
Example: a data breach caused by the lack of MFA being enabled on all accounts could result in the loss of 20% of customers through direct impacts and reputational damage.
Risk Assessment
Once identified, you want to assess your risks based on impact and probability. That is, the level of impact it would have on your business commercially, and the likelihood of the event happening.
Word of warning, it’s natural to overstate the impact of a risk as we tend to focus on the emotional impact of the event. As a rule, you want to try to ignore the emotion and simply focus on the commercial impact.
The easiest way to do this is to use a risk matrix to score each risk. Assign values 1-5 for impact (eg. very minor, minor, moderate, major, catastrophic) and probability (eg. very unlikely, likely, possible, probable, near certain) and multiply them together.
eg. Moderate (3) x Unlikely (2) = 6
You may find all your risks are very highly rated at first, once you have a few, compare them and adjust accordingly. Something that appears catastrophic at first may be moderate or major once you’ve had time to separate the emotion and compare side by side with other risks.
Mitigation Strategies
When it comes to risk mitigation, the goal is not to solve every item. Truth is, you will never remove all risk from your IT in the same way that you’ll never remove all risk from your business.
Focus on the highest rated ones first. If you can solve the risk all together that’s great. More likely however is that you should look to reduce the impact or probability of occurrence; lowering the level of risk.
As an example, consider the hypothetical risk of “A failure of the local server due to it’s old age could disable office phones, email, access to data and access to the finance package/LOB application“
The impact of the risk could be reduced by migrating services such an email and data to the cloud. The likelihood could be reduced with better maintenance, environment and/or some added redundancy.
Summary
In summary, an IT Risk Register is a powerful tool that all small businesses should adopt. It provides a structured approach to identifying, assessing, and mitigating IT risks; ultimately saving time and money.
Whilst this may appear counter intuitive, the increased clarity and structure makes decisions easier, faster, and less likely to lead to sunk costs.
Want to learn more? We’d love to chat about what things might look like with greater visibility and control over technology spending – Book a Chat.