What is risk management?
Risk Management is the process of assessing and discovering the risks to an organization’s operations and determining how those risks can be controlled or mitigated. By identifying the vulnerabilities in an organization’s information systems and taking steps to assure that the losses experienced by the systems are within the risk appetite of the organization, we can implement or repair controls to assure the confidentiality, integrity and availability of the organization’s information. There is no such thing as a 100% secure environment. Every environment has a certain degree of vulnerabilities. The skill is in identifying these threats, assessing the probability of them actually occurring, and the damage they can cause, and then taking the right steps to reduce the overall level of risk in the environment up to where the organization considers acceptable.
We have all heard the saying, “Give a man a fish, and you feed him for a day. Teach a man to fish, and you feed him for a lifetime.” Let me revise that from a risk management standpoint: “Put out a manager’s fires, and you help him for a day. Teach a manager fire prevention, and you help him for a career.” If a manager understands good risk management, he can worry about things other than firefighting. Unfortunately, most people who look for risk management help are seeking to know the steps to put fires out. After all, being a good firefighter has its rewards! Take a look at your organization’s personof- the-quarter listing for the past few years. Who is on it? Typically listed is the person who put out the worst fire. What about people who avoided the fires in the first place? Therein lie the problems with good risk management: people who avoid fires do not get noticed, and the risks they avoid do not get documented. Risks that are well understood and controlled tend not to become fu
