Operational Risk and Resiliency Frameworks

A tale of five risk management characters and how they fit into your organization.

By Tyson Macaulay

October 30, 2006 — CSO —

Prologue

Five guys walk into a bar: a banker, an ex-cop, a technology nerd, a mandarin (or skilled administrator)

and a soldier. The banker pops off his cuff links, rolls back his sleeves and orders a cognac. The cop

puts his hat on the table and gets a pint. The nerd orders a colano ice. The mandarin gets a gin

and tonic, and the soldier orders Scotch. They are old friends from before they were professionals. They

are all now risk managers, and good ones.

These five have rekindled their relationship now that they all claim the same occupation. The cop, the nerd

and the soldier have been seeing each other frequently in recent years and work together pretty well.

They appreciate and are intrigued by the mandarin and have taken to inviting him out, but he is

traditionally an introvert and his instinct is still to work alone. The banker, well, no one really knows

what to make of him yet, and the feeling is mutual. Everyone sees a convergence of interest, which

has brought them together this evening.

"Well," says the banker as the Hennessy warms him. "I manage financial risks, which are the most important

of all because money makes the world go 'round, and puts roofs over heads. I work with credit risk,

debt risk, derivatives, interest rate fluctuations and equity valuations. I forecast for and warn

institutionsand individuals to a small degreeabout how, when and where to place their

money with the least risk and the most possible upside. That is what risk management is all about."

"Rubbish!" says the cop as he wipes a little stout off his moustache. "I manage physical risks, which

are the most important of all because this is a mean world full of beasts in people's clothing. I

work with cameras, digital video recorders, door locks, motion detectors, proximity cards and RFID

tracking of people and goods. I design and implement security systems for institutionsand

individuals to a small degreeto allow them to reduce and manage risks from either external

or internal threat agents. That is what risk management is about."

"You all seriously overestimate your midi-chlorian-count!" says the nerd as he orders another cola.

(Only those who have a high midi-chlorian count

in their bodies can be Jedi.) "I manage information and communications technology risks, which are the most

important of all because from traffic lights to paying for these drinks, IT keeps our world running.

Without IT, the world we live in stops in its tracks. I work with broadband pipes, firewalls and

intrusion-detection systems, antivirus, antispam and high-availability data centers. I design

information management and data communications systems for institutionsand individuals to

a small degreeto create resilient services to reduce and manage risks from either external

or internal threat agents. That is what risk management is about."

"Please!" sputters the mandarin, gently swirling the ice cubes in his cocktail. "I manage natural

and man-made disaster risks, which are the most important of all because losses from these events

are measured in lives, not dollars, property damage or downtime. I am talking about hurricanes,

blackouts, pandemics and bombs. I work for institutions and with first responders conducting

exercises involving emergency services like police, fire and paramedics. I design tests and

develop plans and procedures to manage the unimaginable. That is what risk management is about."

"You all need a reality check," says the soldier as he savors the malt. "I manage confidentiality

of information, which is the most critical because it deals with national security and personal

privacy, which is about our ability to be sovereign as a nation and individuals. We are talking

about defending our data against malicious entities that would use it against us, and to their

advantage. Lives can easily be at stake, but very large sums of money too. I deal mostly with

government and militarywho best appreciate the requirement for 'confidentiality first.'

That is what risk management is about."

At the Confluence of Risk

• Print