How to Develop a Risk Management Strategy

Assessment should also consider the organization's current requirements, capabilities and vulnerabilities. Finally, this stage involves identifying and classifying threats, issues, vulnerabilities and weaknesses and assigning each a priority according to risk.

Phase 2—Quantify Business Impacts

Quantifying business impacts is typically the most challenging step—and the most important. Until they have quantified the impact, positive or negative, of addressing an area of IT risk, IT leadership may be unable to attract their colleagues' attention to it or the funds needed for mitigation.

Quantification of business impacts typically follows a two-phased approach:

Phase 3—Design Solution

At this point, the organization knows the scope and components of its IT risk management program, its current status and the priority and quantification of each area of IT risk.

The next step is to design a set of remediation solutions, across the classic elements of people, process and technology, each with requirements, specifications, goals and functions.

This phase also includes detailed costing analysis to keep costs and benefits of proposed initiatives aligned to organizational goals.

Phase 4—Align IT and Business Value; Implement Solution

Implementation determines whether risk-mitigation initiatives are deployed successfully across people, process and technology with close involvement of organizational stakeholders. This phase also requires closed-loop measurement and continuous improvement in order to achieve efficient mitigation across the different risk priorities. With a coherent system of metrics and performance management capabilities, organizations set the stage for collection of baseline data, performance tracking and assessment of program effectiveness against the original business case.

Phase 5—Build and Manage Unified Capability

Once implementation of the first wave of IT risk solutions is underway, organizations should institute programs for continuous improvement and ongoing governance of their IT risk management program.

By adapting their efforts as their experience and effectiveness grow toward maturity, organizations can avoid or overcome the most common implementation challenges, such as guesswork, reactive projects and lack of quantifiable progress.

While there is no magic formula for IT risk management, this process can help organizations marshal their resources effectively to achieve real, lasting improvements in IT risk management, often while reducing the complexity and cost of IT infrastructure.

Samir Kapuria is the managing director of Advisory Services at Symantec.