2

Our organization in the process of implementing several digital transformation initiatives including online/cloud platforms.

There are arguments in our Information Security team regarding 'Risk Appetite' of the organization. Team is divided on this argument:

One side argues going digital means the risks/threats are higher hence there should be no flexibility in the organizational level risk appetite and to continue the same value.

Other side argues going digital means increasing flexibility/efficiency/etc, hence security should not restrict the purpose of going digital. Hence they suggests to increase the risk appetite value.

I'm sure, there are several organizations have gone through this journey already globally. I would like to know how the industry approaches the 'Risk Appetite' when going digital transformation?

  • Is "appetite" a function of feeling or a function of a calculated assessment? – schroeder Sep 15 '18 at 20:38
  • 1
    "security should not restrict the purpose of going digital" - I 100% agree, but how does that relate in any way to "risk appetite"? You do not change (or not change) a risk calculation because it is inconvenient. – schroeder Sep 15 '18 at 20:39
  • 1
    @Schroeder, The Risk appetite is the level of tolerance an organization can take in terms of risks (could be any risk - IT, Business, HR, etc). Risk appetite is a calculated value to indicate the tolerance level. For example, if you keep a sheet of information on a safe is more secure (risk levels are low) but when you scan that document and store it on a online folder, that will increase the risk of theft. Even though we may be implementing security measures the risk would be higher in going digital. Hence the question here is whether to increase the Risk Appetite of the Organization. – Sayan Sep 16 '18 at 10:47
  • I'm not sure that you understand Risk Appetite yet. In your "sheet of information" example, you do not talk about the impacts of adverse events happening to that sheet of information and what impacts the org can tolerate. – schroeder Sep 16 '18 at 11:19
  • My understanding of Risk Appetite is same as in this link: en.wikipedia.org/wiki/Risk_appetite Are we on same page...? – Sayan Sep 16 '18 at 11:22
3

Risk Appetite is about how much risk you are willing to take on in order to achieve your mission. Your quotes of the different positions are both talking about only one side of the issue and not actually about Risk Appetite.

  1. "Going digital means increased risk" (a higher likelihood of more and bigger negative impacts). I cannot be sure without more detail, but let's assume so.

  2. "Going digital means increased opportunity". Again, let's assume so.

Great. Neither of these statements is about Risk Appetite.

The question that needs to be asked is if the increased opportunities are worth the increased risk. Will the extra risk impact the company in ways that it cannot or does not want to recover? Will the costs of treating the increased risks be greater than the company can afford? Will the loss of the opportunity negatively affect the company?

Those questions are more in line with Risk Appetite.

And you cannot look at Risk Appetite in isolation to these individual projects and not look at the aggregate risk to the entire company.

So, I find it odd that the Information Security team is trying to assign what the organisation should set as its risk appetite. They are not the correct people to be making this decision. By all means, define and analyse the risks, but I'm not sure that the team is properly placed to assess the opportunities or the more holistic organisational risks in context. That's the job of the business.

As for the "industry approaches" that you ask for, the wiki link you provided gives you the basics:

Derived correctly the risk appetite is a consequence of a rigorous risk management analysis not a precursor. Simple risk management techniques deal with the impact of hazardous events, but this ignores the possibility of collateral effects of a bad outcome, such as for example becoming technically bankrupt. The quantity that can be put at risk depends on the cover available should there be a loss, and a proper analysis takes this into account. The "appetite" follows logically from this analysis. For example an organization should be "hungry for risk" if it has more than ample cover compared with its competitors and should therefore be able to gain greater returns in the market from high risk ventures.

  1. What are the risks?
  2. What are the risk costs?
  3. What are the opportunities?
  4. What are the opportunity costs?
  5. What are the risks, opportunities, and costs in the holistic context?
  6. What are the impacts of doing something vs. doing nothing?
  7. What should our approach be to reducing those risks and pursuing those opportunities?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.