Asset-Centric Enterprise Risk Management
A Shift in the Philosophy of Resiliency Planning
A major component of Enterprise Risk Management is the identification of threats and risks that are relevant to the organization's goals. Identification of those risks enables assessing the likelihood of them occurring and the impact of their occurrence on the operations of the business. Risks that cannot be mitigated by conventional means (like insurance) can be mitigated by developing and maintaining plans to assure an effective response to such occurrences.
ERM is about preemptive action that significantly limits any negative impact on an organization and thereby protects value for owners, employees, customers and, in some cases, the community.
Ideally, your ERM system should be operating at a granular level: analyzing risks to each asset (facility, business process, IT application, etc.) but most ERM systems don't. If your ERM system can only manage "big picture" analysis, you and your program may be completely in the dark. While your ERM may be able to tell you what happens if markets change or interest rates turn, it may not be able to help your organization understand what will happen when a particular asset such as a server, a facility, or a single supplier is affected.
Comprehensive Enterprise Risk Management includes an Asset-Centric view of operational risks and business threats. It models processes, operations, and technology in order to identify gaps and vulnerabilities. Asset-based modeling is critically important. It is not enough to simply know what asset is at risk. You must also fully understand what other assets would be impacted by its potential disruption.
You Are More than Your Data Systems
Traditionally, operational Risk Management focused on protecting information technology: mainframes, servers, applications and other data systems. But IT is only one part of an organization's operational strength. Operational risks extend far beyond IT vulnerabilities. Enterprise Risk Management must include the entire spectrum of operational risks in its scope.
To be successful, ERM must operate in real-time, and become woven into the fabric of the organization. Success requires moving the process of risk and gap identification to the operational level. Gaining a complete understanding of operational risks has another advantage. It brings organizations one step closer toward being Incident Ready: able to respond efficiently and effectively to any business disruption.