The current economic crisis is clearly based on the complete failure of the current cast of security and risk management "experts" employed by institutions. A report by the Risk and Insurance Management Society (RIM) titled “The 2008 Financial Crisis – A Wake-up Call for Enterprise Risk Management" states the obvious. They affirm, truthfully so, that the current crisis is a total failure of risk management thinking and strategies. The report says “…we may have to tear up the manual of enterprise risk management and start over.” We do need to start again with fresh thinking and explore the past to predict the future of security and risk management. The "experts" have been creating and supporting silos of risk, technology, and management saying that organizations should focus on one specialty at a time. This is complete junk, junk thinking, junk consulting...the world is a big, churning, interactive place...these experts want to look at a small slice of risk out of the context of the greater whole...JUNK! Why do they do this? Because they cannot see beyond the end of their noses. They do not have the ability to integrate multiple variables into their planning and contingencies. This is infuriating for me.
The RIMS paper goes on and attributes the failure more precisely to these key factors:
1) Failure to embrace appropriate risk management behaviors
Risk management needs to be an essential component in all key business processes, and every person who participates in those processes needs to be aware of the impact of their actions on risk, and to provide timely information that improves the management of risk related to that business process.
2) Failure to create and reward risk management competencies
People were, and still are not prepared to make prudent decisions to provide the best level of risk for the institution. It goes without saying that effective risk management requires incentives that further that goal, rather than destroy it.
3) Failure to use risk management to inform management’s decision making (for both risk-taking and risk-avoiding decisions)
If your people are diligent about their risk management responsibilities, they still may not communicate accurate and timely information throughout your organization. Then, it’s value is negated.
This thinking is not just in the "financial" sector, it is everywhere..."Silo Thinking". Silo Thinking has led us here; it will lead us down a new path of disaster unless we change. This economic crisis will bring us to a new level of crime, theft, cheating, scamming...it already has. Crime is up. Identity theft is up. Cyber crime is WAY up. And yet we still think that none of this is connected to multiple events, actions, people and risk. IT IS CONNECTED.
We have the tools; we have the knowledge, experience and understanding to create a new interactive risk-intelligent organization to management risk on all fronts. Crime, financial, corporate, intellectual property, clients safety, IT, physical security...it is all related.
These problems are endemic to many institutions, including those that would claim that they have a working and successful risk management model, or worse yet those who believe that they are not susceptible to risk. They seem to think that as long as they have someone somewhere that is in charge of "security" and “risk management,” then everything will be fine and they can rest easy.
Junk thinking because it's Silo Thinking.
What do we do? We need to get out of the Silo Thinking and create a common risk management framework across the enterprise. This is for security, IT, financial, and the administration.
This has many elements, each of which is required to help avoid similar disasters in the future.
Risk - It's a team sport. We need to create a institutional team with outside leadership. Institutional politics must be managed and it my 25 year experience, it cannot be done in-house.
This team must create a set of common processes, terminology, and practices for managing risks of all kinds. Everyone needs to be involved at all levels, not just the police, or security, or IT, or the accountants. The current way of doing business did not work, and it will not work into the future.
We need to understand WHAT is it we are trying to protect and from WHO, then HOW. The risk analysis and the risk tolerances must be fully understood, communicated, and monitored across the institution. People need to understand the risk or improper (and risky) activities will result.
Our risk management practices should be incorporated into all processes and decisions. The team must communicate to every individual their risk-related responsibilities, and how they fit into the risk management model.
And the administration must make decisions openly, outside of the politics of the organization, communicate them freely, and adjust them accordingly. They must execute the risk management plan and deal with the risk and the results through the risk team.
Eliminate the Silo Thinking, open the institution to a safer and more liberated future. Understand that it's not Silos, it's a converged risk that needs to be addressed. The current team has failed, get new team.
Jonathan Kendall is the President and Founder of the Kendall Design Group/Security Solutions Worldwide, a professional services and consulting firm specializing in the convergence of technology, security and management located in the Washington, DC area and Las Vegas, Nevada. Kendall has 20 plus years of experience serving the educational community around the world on over 200 campuses from K-12 to the Ivy League. He has been an instructor for the US State Department and Special Forces, featured speaker at Dartmouth College, the AIA and SCUP national conventions, and has written numerous articles. He is a registered private investigator and certified security officer. Please contact Mr. Kendall at 410-798-9003, email jon@KendallDesignGroup.com, or visit www.KendallDesignGroup.com and SecureCampus.blogspot.com.
Who is doing your credit card processing?
