Technology Risk Does Not Exist in Isolation
Technology has become an integral part of nearly every business process. Financial reporting, customer service, operations, regulatory compliance, communications, and decision-making increasingly depend upon information systems and the data they process.
Despite this dependence, technology risk is sometimes evaluated separately from business risk. Information Technology may focus on system availability, cybersecurity, access, configuration, and technical vulnerabilities, while business leaders focus on financial performance, operations, compliance, and strategic objectives.
Both perspectives are important. However, evaluating them independently can make it difficult to understand the actual impact of technology-related risks on the organization.
A system vulnerability or control weakness becomes meaningful to the business because of what it could affect.
For example, excessive system access is a technology control issue. The resulting business risk depends upon what the individual can do with that access. In a financial application, inappropriate access could allow unauthorized transactions or changes to financial information. In a customer-facing system, it could expose confidential information. In an operational system, it could disrupt the organization's ability to provide products or services.
The technical weakness may be similar in each situation, but the potential business consequences are different. Understanding those consequences is necessary to properly evaluate and prioritize the risk.
Begin With the Business Process
Technology assessments frequently begin with systems, applications, or technical controls. A broader risk perspective also considers the business processes those technologies support.
Understanding the process helps establish why a system is important, what information it processes, who relies upon it, and what could occur if the technology or related controls do not operate as intended.
This is particularly important when evaluating automated controls.
An automated control may prevent an inappropriate transaction, perform a calculation, enforce an approval requirement, or restrict an activity based on configured rules. Evaluating the technical configuration is necessary, but it may not be sufficient. The assessor must also understand the business objective the control supports and whether the configuration appropriately addresses the related business risk.
Connecting the technology to the process provides context that a purely technical assessment may not identify.
Establish a Common Understanding of Risk
Business and technology professionals often approach risk from different perspectives and use different terminology.
A technology team may describe a vulnerability in terms of system configuration, threat exposure, or technical severity. Business management may be more concerned with financial loss, regulatory consequences, operational disruption, or reputational impact.
Neither perspective is necessarily incorrect.
The challenge is translating the technical condition into terms that allow management to understand its potential effect on the organization. This does not require removing technical detail from the analysis. Rather, the technical information should be connected to the business processes, information, and objectives that could be affected.
This common understanding also improves communication between those responsible for identifying risks and those responsible for making decisions about them.
Prioritize Based on Organizational Impact
Organizations typically identify more technology risks and control improvement opportunities than can be addressed at one time. As a result, management must determine where resources should be focused.
Technical severity should be one consideration, but it should not always be the only consideration.
A significant technical weakness affecting a noncritical system may represent less organizational risk than a seemingly moderate weakness affecting a system that supports financial reporting, sensitive information, or a critical business operation.
Evaluating technology risk within the context of business impact allows management to establish priorities based on what matters most to the organization.
Create a More Complete View of Risk
Technology and business risk are increasingly interconnected. As organizations become more dependent upon technology, separating the two can result in incomplete risk assessments, competing priorities, and remediation efforts that do not address the organization's most significant exposures.
A more effective approach connects systems and technical controls to the business processes and objectives they support.
Doing so allows technology professionals to better understand the business implications of technical issues and enables business leaders to make more informed decisions about technology-related risk.
Ultimately, the objective is not to translate every technology issue into business terminology. It is to ensure that technology risks are evaluated according to their potential impact on the organization.