A Whole Lot of Risk

Holistic approaches to managing operational risk continue to evolve and strengthen.

By Derek Slater

August 31, 2009 —

One of the long-term interests of CSO has been the coming-together of disparate elements of risk management.

We used to use the word 'convergence' a lot, referring specifically to the combination of physical and digital security. Nowadays that concept is fairly well-worn, which is not to say that everyone's caught up yet. (If you need a refresher on some of the critical concepts and practicals, you can brush up with IT and Physical Security Convergence: The Basics.)

Leading-edge thinkers have moved on to even more holistic viewpoints, aiming to add in all forms of operational risk management. This process doesn't necessarily require management by a single person; teams and committees are often drafted on a permanent or temporary basis to survey risk across all dimensions. Such an undertaking can draw in aspects of loss prevention, fraud prevention, audit, privacy, brand protection, business intelligence, human resources (think background checks), safety/OSHA, business continuity, ethics and more.

David Kent heads up such a function at Genzyme, and he'd be the first to tell you that it's a cooperative effort. The excellent folks at the Security Executive Council have also done a lot of good thinking about holistic risk management, with great minds like Francis D'Addario and George Campbell at work.

This year I have been particularly impressed with the cooperation demonstrated by associations ASIS - on the historically physical side of the house - and ISSA from the digital side. We've already seen these two organizations work together with audit group ISACA to form a broad risk management alliance; you can find details in my interview last December with former ASIS head Jeff Spivey.

The collaboration of these groups continues to produce real results. The big annual ASIS seminar is coming up next month in Anaheim; ISSA is "co-producing" thirty or more educational sessions. (I'll be in a CSO booth to meet-and-greet on Monday and Tuesday mornings; if you're at the show, please drop by and say hello.)

I think this level of cooperation bodes very well for the future of security and risk management. In the early years, political infighting and power struggles were often cited as insurmountable barriers to convergence of physical and IT security. The associations and their leadership continue to demonstrate that simply isn't true.