Defending Against Cyber Supply Chain Risk in an Interconnected World (Compliance)

Organisations strive to utilise risk management frameworks to provide a structured approach to managing risk. These frameworks help teams manage various risk categories, including operational risk and the unique elements of risk management associated with each category.

In partnership with PRMIA, AuditBoard’s new eBook Fragmented to Connected: Achieving Cohesion by Unifying Risk Management explores how organisations should implement risk management frameworks. It emphasises the role of people as an essential component of these frameworks and the implementation challenges caused by scarce resources and siloed communication.

 

Chief Risk Officers, risk management consultants, and others often laud the benefits of such an approach, which include:

 

 

Ideally, adopting such an approach should foster a common understanding of risk across the organisation, reducing so-called ‘silos,’ particularly within the three lines of governance, risk,

and compliance (GRC), and enable these three lines to connect more effectively. However, this ideal is not always realised. Some of the issues that have been seen with this approach include:

 

Complexity: Developing a risk management framework can be complex, particularly in large firms with diverse locations, goals, and obligations. In turn, maintaining a complex risk.

Management framework can also be difficult, especially if documents for its underlying elements become outdated or inconsistent.

 

Resource Intensive: Implementing a risk management framework that is truly firm-wide can require significant resources, often including time, personnel, and technology. Large asks for resources dedicated to risk management might be seen to be wasteful to those not

familiar with the approach and its benefits.

 

Cultural Resistance: Related to the above, sometimes, employees and management outside of risk management may resist changes associated with risk management frameworks, particularly if they see them as adding bureaucracy or limiting flexibility.

 

Misunderstanding of Roles: The risk management function in the second line of the GRC model sometimes plays a “challenge” role that people may misconstrue. Those responsible for oversight and ensuring effective risk management can appear detached or misallocate

resources. This perception often leads to friction between risk management teams and business units, resulting in increased cultural resistance.

 

Taking action based on the following points is critical:

 

Some attempts to implement risk management frameworks have struggled due to lacking resources and understanding. Whilst many accepted the lack of understanding of roles and responsibilities as a source of success, organisations do not always implement it effectively.

 

To address these challenges, we suggest the following:

 

Finally, organisations should include emerging risks in risk assessment activities. However, they need to recognise the increase in cybersecurity threats and their potential to “kill a firm in one day.”

 

Download the ebook to learn how to adopt new technology to optimise existing resources.