I’ve just uploaded a short video showing one of the functional assessment apps in use. Although the methodology is different from the full DCDR tool, the approach and functionality is very similar: Fast? Check! Simple? Check! Easy to use? Check! So here’s a taster of what the DCDR app is going to look like. Enjoy! [Video: https://video.wordpress.com/embed/xThbiOro?hd=0&autoPlay=0&permalink=1&loop=0&preloadContent=auto&muted=0&playsinline=0&controls=1&cover=1]
Opportunity overload continues to be the biggest threat to DCDR right now: I keep finding myself being seduced by thoughts of what the app could do, rather than what the core feature set should be. Luckily, I am getting good advice from Matt and from the several thousands of hours of podcasts and interviews I have consumed. As usual, the problem isn’t getting the right advice. Following the advice, however, is always more difficult. I am finding Paul Graham’s advice particularly useful and his ‘Startups in 13 Sentences‘ essay has become my roadmap. ...
I confess to having a love / hate relationship with standards. On the plus side, having an agreed way of doing things is incredibly attractive. There is no need to spend long periods trying to design a system; shared terms, concepts and processes; easy collaboration between different groups. So when they work well, standards are great and definitely have a lot going for them. Yay! However, there are also drawbacks. ...
For most people, this will be a busy time of the year: end of year performance reviews, last-minute budget planning, holiday parties or a final push to achieve their annual goals. All of this adds up to a very busy time when all you want to do it take a break. However, there’s one other thing I’m going to suggest you squeeze in before you start next year’s ERM program. ...
Meet the expert – Crisis Communications with Price Floyd We are kicking off our ‘meet the expert’ series with an interview with Price Floyd, the founder of the Engaging America Projectand an expert in risk and crisis communications. Price has over 25 years of experience in government and the private sector and here he shares over a dozen key lessons he has learned including: The difference between communications in government and the private sector How digital media has improved crisis communications Why it’s too late to call the communications team when things start going wrong The number one skill for communicators Why it’s important to tend the garden (and what this means) Watch the video to hear these and many more key lessons that you can put into action today. ...
I’m trying to improve my videos so apologize for the quality but here’s a quick video with 10 quick thoughts on risk management. [Video: https://video.wordpress.com/embed/zX8wUAWO?hd=0&autoPlay=0&permalink=1&loop=0&preloadContent=metadata&muted=0&playsinline=0&controls=1&cover=1] Let me know what you think!
Enterprise security risk management (ESRM) has been a topic of increasing interest for security managers over the past few years. ASIS International has identified it as a strategic focus. However, after a review of the literature, beginning with the 2010 CSO roundtable paper on ESRM, two issues are raised that could make ESRM implementation difficult. The initial papers on ESRM appeared to encourage security to fill the gap left by traditional enterprise risk management (ERM) systems, which often focused on financial and market risk exclusively. Although an effective ERM system should incorporate all risks, having security fill these gaps via the ESRM system would quickly overwhelm the chief security officer (CSO). ...
Completion of the assessment and development of risk mitigation strategies help the organization understand their risks and what it can do to bring these risks within the levels of its risk tolerance and appetite. The elements that ensure that these risks stay within the permissible levels are risk governance and system controls. *Controls are what help keep the system in equilibrium or prompt a reaction where things begin to deviate from ‘normal’. Governance provides oversight to ensure that the risk management system is operating properly and that risks are being identified, elevated and managed at the appropriate levels. * ...
*Integrating a risk management system into your department or organization will be a major endeavor and while there are significant benefits to making this change, the degree of effort required should not be underestimated. Moreover, the overall workload of the organization and other major initiatives that might also be underway are major considerations when planning ERM implementation. This article will refer to ERM systems but the same principles will apply if the implementation is for a less expansive risk management system. Importantly, as a supporting function and not an operational activity, risk management must be shaped to fit the organization. It should not try to shape the organization to fit it. Implementing a risk management system requires thorough planning, a careful combination of change and project management and a high degree of cultural sensitivity. * ...
Once an organization’s risks are understood, it is important that appropriate action is taken to address these risks to ensure that the organization’s objectives are protected or enhanced. Some risks are severe enough to require immediate action. Others can be dealt with in the short term whereas some risks require longer-term attention over months or even years. This essay explores the key ideas and terms associated with addressing risks and outlines the steps to take to ensure that the appropriate action is taken once a risk is identified concentrating on five main options: avoid, tolerate, treat, transfer and terminate. ...