At SimpleRisk, we frequently get asked by prospects and customers alike if there is a template or road map that can be used to establish a foundational GRC program. We’ve learned over the years that every organization is different and there is no “one size fits all” approach.
While Governance, Risk Management and Compliance are interconnected and organizations need to have a sound framework within which to manage risk, our view is that “Risk Management” is the engine that drives any successful GRC program and there are certain key components of Enterprise Risk Management that we’ve found to be universal. We want to share our insights with you in this blog that focuses on how to incorporate the “R” into GRC.
In our Risk Management 101 blog, we outlined a series of fundamental questions to address when first establishing an ERM program. In this blog, we’ll explore each of those questions in further detail and provide some additional context and guidance that will enable you to establish a solid foundation upon which to build out your GRC program.
1) How do I identify risk?
There are numerous ways to identify risk, so it can be difficult to know where to start. We recommend beginning by identifying the more obvious potential issues for your business that would result in the most significant negative impact. Below are some ways for you to identify and capture risks. Once entered into the system, you can then organize, assign and track all risks at a corporate, business unit and/or department level.
2) How can employees be encouraged to document risk they may uncover?
3) How can I effectively rank risk to prioritize mitigation efforts?
After creating your risk registry, the next step is to plan mitigation efforts. While it’s not essential when you are just getting started, as your program matures, we do recommend adding values to your assets to enable quantitative risk assessments, which provides you with a more accurate picture of your risk exposure. Below are short descriptions of the six scoring methodologies supported in SimpleRisk that can be used interchangeably depending on the risk type, and the system automatically normalizes all scoring on a 1-10 scale.
4) How do I set up a risk mitigation process?
To plan mitigation efforts, first associate your risks with controls and add mitigation dates. You can then perform regular reviews of your risks with management to prioritize action and determine whether to approve a risk or reject and close it. If approved, you can define the next step, which generally will fall into one of these four categories: a
After adding review dates, we recommend organizing your risks by next review date, followed by the inherent risk score. This will help you to prioritize your risk reviews and mitigation efforts. As a best practice, below are the three risk categories to adopt for classifying your risks.
Another effective strategy is to focus on mitigating risks that have a high risk score and require minimal effort to address, resulting in a significant impact without a significant workload. SimpleRisk provides a “Risk Advice Report” to automatically gauge and inform you which risks fall into this category.
5) Who should be responsible for risk mitigation?
Even though management is not responsible for risk mitigation, determining how to manage risk should ultimately be their responsibility. Depending on the size of an organization, security specialists or practitioners are often responsible for mitigation efforts whereas larger or more mature organizations may have a dedicated risk manager or SME who is heavily involved in the process and can provide input and guidance on the most effective ways to mitigate risk. As a security practitioner, your primary function is to:
The risk manager’s main goals are to:
6) How can the risk mitigation life cycle be tracked effectively?
Risk management is a cyclical process, and the risk mitigation life cycle requires that it be repeatable and scalable in order to effectively track and manage risks. In SimpleRisk, this can be accomplished by:
7) How often should risks be reviewed?
We recommend a monthly cadence to review all risks, and these reviews should be performed in the following sequence:
Although timeframes may vary, we recommend using the Inherent Risk Score as the key metric to determine how frequently each risk should be reviewed. For example, you may want to automatically set the review dates for risks as follows:
8) How can risk be communicated to management?
One common dilemma confronting security practitioners is how to bridge the communication gap that often exists between themselves and management. Given that management has the authority to allocate budget for risk mitigation efforts, it’s incumbent upon security practitioners to get key stakeholders and management on board with risk ownership. Below are three ways to accomplish this:
Conclusion
There are multiple questions and choices to consider when you are first establishing a GRC program. Once your overarching guidelines and policies have been established and you’ve identified which control framework(s) you need to be in alignment with, implementing an effective risk management process will become the underlying foundation that links governance, risk management and compliance together. If you're interested in launching your GRC program with SimpleRisk, you can download our free and open-source platform, SimpleRisk Core, and begin submitting risks in minutes!
Want to see more content like this? Sign up for the SimpleRisk mailing list to stay informed!
Related articles:
Normalizing Risk Scoring Across Different Methodologies
How to Calculate Inherent vs. Residual Risk
How does an Asset’s Value Affect Your Risk?
Why Management Doesn’t Understand Your Security Woes
How to Perform Risk Assessments (with SimpleRisk)
Should Vulnerabilities and Risks be Managed in the Same Place?