Risk assessments are increasing in utility and popularity – being used for everything from compliance to safety assessments, and used by financial institutions, healthcare organizations, manufacturers, government of the world and think tanks.
Many regulators require formal risk assessments on everything from gauging political risk in an unstable country, to protecting consumer financial information, to assessing workplace violence potential.
Here’s a definition of a risk assessment: A process to determine what controls are necessary to protect sensitive or critical assets both adequately and cost-effectively. Cost effectiveness and Return On Investment (ROI) are required elements of a risk assessment.
A risk assessment is not a democratic process where the most popular answer wins. It is not consensus driven. Instead, it is a business process that manages a security function. Security is very process centered. Because security often consists of many different elements which are critically important, such as managing network access, it makes sense to manage it as a process.
According to the statistics, risk assessments are way up in popularity in 2011. Maybe
it’s economics – maybe it’s result of the previous economic downturn, but the requirements for risk assessments have never been broader, and there have never been more of them than there are now. Here’s a partial list:
The Joint Commission
HIPAA, HITECH, NIST 800-66
FFIEC, BSA-AML,
ISO 27001 and 27000 series; NIST 800-53
Red Flags Identity Theft
NCUA Part 748
FEMA 426, FEMA 428
The exercise of doing a risk assessment affords a level of protection which is related to how many other people actually contribute to the risk assessment results. Using an online compliance survey as a participatory measure takes the onus of absolute responsibility away from the manager/analyst and distributes it throughout the organization where it belongs.
Obviously people are a critical component of information security. In a risk assessment, people are also important to include because they are able to report what’s going on in their workplace every day. How can one analyst know enough to do the entire risk assessment by themselves? They would have to be everywhere at once – in the morning, late at night, on the weekends, and also be able to channel the work of everyone from the newest tech support person to the director of the data center. And the inclusion of a variety of individuals adds weight and power to the risk assessment.
The true value of the risk assessment is in the cost benefit analysis, which details what controls need to be implemented, how much they cost and how much they would protect the organization by either prevent threats from occurring or by mitigating the impact of the incident if it occurs.
While the analysts may be accountable for the reporting or analysis of potential risk, the responsibility for any action that needs to be taken is up at the C level, or with the Board of Directors. In fact, in the FFIEC IT (Federal Financial Institutions Examination Council Information Technology ) Handbook, they spell out, “The Board is responsible for holding senior management accountable”. Often we have found that the actual President of a bank or credit union doesn’t always KNOW that he is going to be held responsible – this information is down another level in the organization.
I recommend getting management to sign off on the basic assumptions, in writing, in the course of completing the risk assessment – and of course, on the final reports. Areas where senior management can review and approve include:
- Calculation of asset values, including the value of the organization in total
- The potential costs of implementing different controls, singly or in combination.
- Validating which controls are currently in place and how well they are working.
- The conclusions from the draft report, and the final report.
The analyst is just the messenger, doing the work of assembling the risk elements and calculating their potential results. But senior management makes the final decisions on each element. There’s nothing like a signature on a piece of paper to foster a climate of accountability.
Risk Assessments have the potential to save corporations and governments millions of dollars by making decision-making based on real analytics, instead of just guesses – plus they are an essential element of compliance. These are good reasons to evaluate whether it’s time for you to do a Risk Assessment!