Applying RiskRisk--basedbased Techniques and Tools to Provide

Technology Risk ManagementTechnology Risk Management

Applying RiskApplying Risk--based Techniquesbased Techniquesand Tools to Provide Higher Leveland Tools to Provide Higher Level

of Assurance Over IT Environmentsof Assurance Over IT Environments

by Phil Leifermann, by Phil Leifermann, MBA, CIA, CCSA, CFSA, CGAP, CRMA, CISA, CFEMBA, CIA, CCSA, CFSA, CGAP, CRMA, CISA, CFEManaging Director, Insight ConsultingManaging Director, Insight Consulting

Technology Risk ManagementTechnology Risk ManagementTechnology Risk ManagementTechnology Risk Management

Insight Consulting2

Technology Risk Management (cont.)Technology Risk Management (cont.)Technology Risk Management (cont.)Technology Risk Management (cont.)

Insight Consulting3

§ Stakeholder needs

§ Enterprise wide

§ Single integrated framework

§ Holistic approach

§ Governance vs. management


Insight Consulting4

Strategy

Execution


Insight Consulting5

Strategy

Execution

Policy

Procedures

Systems

People


Insight Consulting6

Strategy

Execution

Policy

Procedures

Systems

People

Risk


Insight Consulting7

Strategy

Execution

Policy

Procedures

Systems

People

Risk

Control Control


Insight Consulting8

Strategy

Execution

Policy

Procedures

Systems

PeopleAssurance


Insight Consulting9

What is assurance ?

• Certainty

• Confidence

• Freedom from doubt

• Guarantee

• Warranty


Insight Consulting10

Strategy



Strategy

Infrastructure DataPeople Applications Facilities



Strategy

Information

Infrastructure DataPeople Applications Facilities



Strategy

Information

Infrastructure DataPeople Facilities Applications

Risks



Strategy

Information

Infrastructure DataPeople Facilities Applications

Risks

Controls



Challenges:

§ How do we plan audits of technology ?

§ How do we conduct audits of technology ?



Challenges:

§How do we plan audits of technology ?

§ How do we conduct audits of technology ?



A B C

H I J

D E F G



§ Define audit universe

§ Conduct risk assessment

§ Select audits

§ Determine strategy for audits



Define Audit Universe

• Identify all auditable entities

• This becomes audit universe, i.e. all entities

which might be audited



A B C

H I J

D E F G

Define Audit Universe (cont.) Auditable Entities



A B C

H I J

D E F G

Define Audit Universe (cont.) Auditable Entities

Audit Universe



Risk Assessment

• Determine risk factors

• Determine weightings

• Assign scores

• Calculate risk scores

• Assign risk levels



Risk Assessment (cont.)

Risk Factors

• Determine risk factors:

ü Factor A : Financial Risk

ü Factor B : Operational Risk

ü Factor C : Reputational Risk




Weightings

• For each risk factor, determine weighting:

ü Financial Risk : 50%

ü Operational Risk : 25%

ü Reputational Risk : 25%




Scores

• For each risk factor, assign scores:

ü Financial Risk : 8/10

ü Operational Risk : 10/10

ü Reputational Risk : 5/10




Risk Levels

• Multiple weightings and scores

• Calculate totals

• Add totals

• Calculate grand total




Risk Factors Weightings Scores Totals

• Financial Risk 0.5 8 4

• Operational Risk 0.25 10 2.5

• Reputational Risk 0.25 3 0.75

Grand Total 7.25




Risk Levels

• Convert grand total to risk level:

ü High risk : 6.5- 10

ü Medium risk : 3.5 – 6.5

ü Low risk : 1 – 3.5




Risk Factors Weightings Scores Totals

• Financial Risk 0.5 8 4

• Operational Risk 0.25 10 2.5

• Reputational Risk 0.25 3 0.75

Grand Total 7.25

High Medium Low

Risk Levels



A B C

H I J

D E F G


Audit Universe



High Risk Medium Risk Low Risk

A

J

D

G

B

H

F

C

I

E




Challenges:

§ How do we plan audits of technology ?

§How do we conduct audits of technology ?



§ For each auditable entity, identify risks that might affect this auditable entity

§ Assess these risks

§ Measure level of inherent risk

RiskIdentification



§ Impact rating (i.e. 1 - 5)

§ Probability rating (i.e. 1 - 5)

§ Risk = impact x probability

- e.g. 4 x 3 = 12



Level ofInherent

RiskRisk Appetite

Reject



§ For these risks, assess controls that prevent, detect, correct and escalate these risks

§ Measure level of controlled risk

RiskAssessment

RiskIdentification



Level ofControlled

Risk

Level ofInherent

Risk

Reject

Risk Appetite



§ If level of controlled risk exceeds “risk appetite”, design action plans to further reduce level of risk

§ Measure level of residual risk

RiskAssessment

RiskMitigation

RiskIdentification



Level ofControlled

Risk

Level ofInherent

Risk

Level ofResidual

Risk

Accept

Risk Appetite



Impact

Pro

bab

ilit

y5

4

3

2

1 2 3 4 5



Impact

Pro

bab

ilit

y5

4

3

2

1 2 3 4 5

Manage



Impact

Pro

bab

ilit

y5

4

3

2

1 2 3 4 5

Contingency

Plan



Impact

Pro

bab

ilit

y5

4

3

2

1 2 3 4 5

Housekeeping



Impact

Pro

bab

ilit

y5

4

3

2

1 2 3 4 5

Monitor



Impact

Pro

bab

ilit

y5

4

3

2

1 2 3 4 5

A

A

Inherent Risk

Residual Risk

Controls



Inherent Risk

Res

idu

al R

isk

5

4

3

2

1 2 3 4 5



Inherent Risk

Res

idu

al R

isk

5

4

3

2

1 2 3 4 5

IncreaseResources



Inherent Risk

Res

idu

al R

isk

5

4

3

2

1 2 3 4 5

Assess

Controls



Inherent Risk

Res

idu

al R

isk

5

4

3

2

1 2 3 4 5

Not

Applicable



Inherent Risk

Res

idu

al R

isk

5

4

3

2

1 2 3 4 5

Decrease

Resources



1stLin

e of Defen

ce

RiskManagement

InternalAuditManagement



2n

dLin

e of Defen

ce

1stLin

e of Defen

ce

RiskManagement




RiskManagement


2n

dLin

e of Defen

ce

1stLin

e of Defen

ce

3rd

Line of D

efence



RiskManagement


§ Management (with assistance from risk management) are responsible for designing, implementing and maintain controls

Control



RiskManagement


§ Internal audit (with assistance from risk management) are responsible for ensuring controls are effectively and efficiently designed, implemented and maintained

ControlAssurance



RiskManagement


Operate Support Validate

Further InformationFurther InformationFurther InformationFurther Information


§ Phil Leifermann

§ President Director, Insight Consulting

§ Phone: +62 21 250-6696

§ Fax: +62 21 250-6697

§ Email: [email protected]

mailto:[email protected]

Applying RiskRisk--basedbased Techniques and Tools to Provide

Documents

Transcript of Applying RiskRisk--basedbased Techniques and Tools to Provide