Will IT GRC Become IRM?

The differences in risk management information gathering, tools, and processes used by business operations and IT teams is at once introducing redundancies in the way that these two groups operate and gaps in how they communicate. According to a recent analysis by Enterprise Strategy Group (ESG), many enterprises are examining how to better roll up IT governance, risk and compliance (GRC) into a broader framework called integrated risk management (IRM).

"Risk management problems often arise because business operations and IT teams have access to different information and tools. This inevitably leads to redundant data collection, overlapping processes, and higher costs," wrote Jon Oltsik, senior principal analyst for ESG, in a recent paper on the topic. "To alleviate this inefficiency, many organizations are starting to explore the possibilities of more integrated governance and security risk management across the enterprise."

According to a survey of 141 risk management executives conducted by ESG and sponsored by Agiliance, within IT risk management alone, 65 percent use more than software platform to carry out its risk management activities. And that isn't even counting even more business operational focused enterprise risk management platforms frequently in tandem use. The numbers show that organizations are trying to find ways to consolidate. Approximately 27 percent of enterprises are already engaged in a consolidation project and 51 percent are planning such a project within the next two years, hoping to produce better metrics and guidance across their organizations, according to Oltsik.

[Is your organization only paying lip service to its IT risks? See Doing More Than Paying Risk Management Lip Service.]

Oltsik believes that a gap between what he calls security risk management (SRM) tools and processes and governance risk management (GRM) tools are causing an operational disconnect. Whereas most GRM tools were born out of Sarbanes-Oxley requirements that focus on financial and legal controls and processes primarily for compliance purposes, SRM systems are more data-driven based on security operations. The problem, he says is that the data from SRM is primarily "mapped to GRM solutions via spreadsheets."

"CISOs are now required to address risk in a form that business units understand" he wrote. "Most business risk owners don’t understand the language of security, let alone see the causal chain between a critical IT asset disabled by a cyber attack, a failed or missing security control that may have prevented it, and the impact on their business operations."

While other experts in the IT risk management world agree that the language gap and lack of integration between multiple tool-sets can definitely stand in the way of an organization-wide view of an enterprise's risk positioning, the idea of moving to a single risk team working on one platform still remains contentious.

"In many cases, organizations have a best-of-breed set of tools for managing different types of risk that they are happy with," says Chris Goodwin, CTO of LockPath. "Consolidation really doesn't get them where they need to be. Instead, they need to make sure their tools can inter-operate, which allows them to roll-up risks across the enterprise into a true enterprise risk register."

According to Yo Delmar, vice president of MetricStream, enterprise risk management isn't likely to move away from disparate, specialized teams anytime soon.

"GRC is carried out by multiple teams within an organization, and in our view, will likely continue to do so for decades to come," she says. "Rather than one monolithic, integrated program, we see organizations adopting a federated model, where different groups, such are operational risk management, vendor management, audit, IT, and security can maintain their own perspective on risks, that are then rolled up to an enterprise view."

Instead, where Delmar sees the work being done in integration is developing more common taxonomy that covers how risks, controls and scoring are defined so that work can be rationalized across those federated groups.

"The real challenge for security and IT teams is to start expressing vulnerabilities, control failures and exposures in terms the business can understand," she says. "While a common ERM or GRC platform provides the context, the real issue here is one of a common high-level taxonomy. Going beyond that, a common ontology, that extends the taxonomy by adding rules and calculations on how risk is measured."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.