Information Technology Risk Automation Creates Better Outcomes

Information technology risk management is the foundation for all compliance programs. Documenting risks and the controls that mitigate those risks takes time, effort, and attention. When the information technology risk are spread throughout the entire organization it becomes more difficult to access the right information. The consequence is that resources (time and money) are poorly deployed and your environment is less secure. GRC automation enables effective risk management, which leads to better compliance audit outcomes which ultimately leads to better financial and productivity outcomes valued by executive management and shareholders.

Information Technology Risk Automation and Risk Management

The first step to information technology risk automation is understanding the complexities of risk management in the context of your organization. Symantec’s white paper notes:

It is impossible to completely eliminate risk in today’s challenging IT environment. The best approach therefore is to adopt a risk-reduction strategy by implementing a solution that allows your organization to prioritize security and compliance efforts based on risk level. For example, by using an industry-standard risk scoring algorithm (Common Vulnerability Scoring System) you can assign an externally facing Web server or a PCI server a higher risk value than a print server so that deficiencies or problems on these high-risk assets are given priority status in terms of remediation efforts. You may even decide that to improve the overall security posture of your environment you need to have tighter configuration controls on these high risk assets.
For procedural controls, it should be possible to conduct risk-weighted surveys following the distribution of new policies and rate responses based on risk. Ultimately, your IT GRC solution should help you to focus on high-priority controls in order to meet risk and compliance goals on time, and within budget.

GRC tools can not only assess your risks but also show you where to focus your controls. This creates a safer, more efficient approach to information security. Mapping the information technology risk can allow your organization to better address them in your policies. Effectively addressing risks leads to better audit outcomes because your organization has engaged in meaningful review and documented that review for auditors to follow the company’s thought process. For organizations that use audit reports to build customer confidence, better audit outcomes lead to more revenue. 

Information Technology Risk Identification and Information Silos

Information technology risk identification can seem overwhelming for a company with multiple departments, with  different and conflicting processes. When it comes to information technology risk analysis, the problem of silos can add to your organization’s security concerns. David Strom from TechTarget says that when looking for a GRC tool, one of the most important questions to ask in terms of risk is:

Do you want a common framework for identifying risk across all your outward-facing enterprise applications? It may not be necessary if just one department is responsible for most of your response. On the other hand, if you have conflicting risk assessments being conducted by different departments, a common ground may be useful to speed up the questionnaires that are all part and parcel to these products.

Using a GRC tool creates a common language across multiple departments. Because everyone is now viewing compliance through the same lens, departments are more effective at reducing and mitigating information technology risk. Jason Mefford of Mefford Associates who also owns cRisk Academy adds:

One of the real benefits of having GRC tools in place at an organization is providing a common platform and language to use in the organization. Often the various groups involved have their own words to describe the risk assessment process. Having the common tool and language requires the individuals to use consistent terms and processes. Over time this helps to develop a positive culture that allows the groups to work better together…

…having a common GRC tool also allows better management oversight, and the ability to directly map the organization’s response activities to the underlying risks and other exposures they face. 

Information silos naturally create inefficiency which often lead to conflict or even noncompliance, both of which cost your organization money. Creating common ground synergizes compliance throughout the organization ensuring  both greater communication and consistency. In addition, by bringing together all the departments, automation of the information technology risk process creates a feedback loop that connects audit outcomes to risks. For example, a failed control mapped back to a risk gives feedback on the control’s impact. By removing this communication barrier, the GRC tool makes audit outcomes meaningful. Not only does the shared communication lead to a lowered chance of fines or risk, it also streamlines your workflow. Streamlining the workflow adds hours of productivity across the organization which translates into financial value. 

GRC Information Technology Risk Automation Tool and Culture of Compliance

Creating a culture of compliance not only strengthens audit outcomes but also provides long term protection of your assets. GRC tools play a critical role in creating this culture. Paddy McGovern, head of compliance content strategy for Interactive Compliance Training advises that one way to create a culture of compliance is to “[u]tilize innovative tools that promote maximum retention. If employees are bored, they won’t retain information. Instead, make use of the tools and systems available that will allow your employees to learn, and apply compliance policy like never before.”

Using a GRC tool is one way to promote maximum information retention. When you task employees with the evaluation of Information technology risk and then give them access to the policies that help promote the mitigation of those risks, they will be more likely to understand the integration of the two. Studies show that understanding is the key to retaining information.  By incorporating the appropriate employees into the information technology risk assessment process, the organization creates an overall sense of compliance ownership.

While IT departments want the ease of integration, senior managers care about the return on investment.  A culture of compliance needs to be driven by senior management. Using a GRC tool is an excellent way to create a powerful compliance culture.  When trying to sell the GRC tool’s cost to senior management, it’s important to discuss financial gain rather than compliance. An Ernst & Young white paper from 2015 identifies three areas of value a GRC tool provides companies:

• Operational efficiency: By creating a common risk management approach, it is possible to potentially consolidate processes, remove redundancies and reduce duplication and effort. Through automation, manual intervention can also decrease.
• Risk mitigation:If the level of risk is reduced in your organization,then it stands to reason that there will be less of it to manage. Audit costs and regulatory  fines can come down, as well as the cost of corrective actions, incident management, reporting and data manipulation. It is also possible to realize some indirect benefits such as lower insurance payments and cost of capital.
• Business performance:With a more risk-savvy culture, decisions impacting investments, productivity, partnerships, mergers and acquisitions, and growth could all lead to better  financial performance. 

Since GRC tools reduce information technology risk with efficiency , they create a strong  financial incentive for the organization to adopt and employ.   The combination of financial incentives along with increased employee productivity should be compelling enough reasons to bring senior management to your corner.

A strong information technology risk analysis requires communication across the organization and employee participation. Using automated tools to enhance the efficiency provides senior management a scalable method for creating a top down culture of compliance.  Therefore, the importance of incorporating a GRC tool into your compliance landscape can be sold to senior management as being about the financial and productivity outcomes. This can help you succeed in obtaining those important compliance tools needed to do your job best and benefit the organization as a whole.