How do you communicate IT strategy risks?

In my experience, I have observed that Risk analysis is one of the least liked areas when it comes to working in the Incident & Problem industry. While we have various approaches to capturing risk one of the easiest ways to have Risk documented is using risk registers. They are easy to use and gives us a proactive approach to identifying potential risks and what are the plans to mitigate those. Once we have perfected the art of capturing risks using register we could then start formulating better approaches of identifying riks using SWOT analysis and other methodologies.

Agreeing with the first point I would also add Risk management is also one of the least understood. Generally people don't want to accept that things may go wrong, possibly as a result of pressure from senior leadership to ensure success of a project or just from a personal sense of achievement. Risk assessment is a tick box exercise for many (particularly in the compliance space) and is a task that is done once, usually badly, and forgotten about until the next audit is due.

A thought is creating a dedicated risk management team. This team stays focused on identifying and mitigating risks associated with implementing new AI systems in our rental operations. Actually, I disagree with the notion that only IT should be involved in risk identification. Involving different departments like customer service can provide valuable insights. They deal with customer feedback daily, and their input can help shape a more robust and user-friendly AI system. An example I've seen is during a cybersecurity audit for our AI implementation. The audit highlighted potential vulnerabilities we hadn't thought of. It led us to invest in additional data protection measures, significantly improving our system's security.

when I discover risks and issues in IT the only way to use them is to align them to two areas - impact - ie whether the risk or issue is/will have an impact and where and root cause. I then always align risks to initiatives that are aligned to a future state view, In the work I do for clients it is very pictorial. If you can create your strategy and represent all your risks being solved in a 'big' picture view of your strategy then you have succeeded. We still create big AO posters that clients love to print out and put on their walls and then use that to communicate the strategy.

Risks generally are easier to identify around what you plan to do, but it is equally important to assess the risks of what things you are chosing not to do. Deferred maintenance/patching; continuing another year on technology that is going obsolete, etc. that are often driven by budget decisions.

An example I've seen in the rental industry involves the implementation of an AI-powered recommendation engine. We had identified potential risks such as data breaches and biased recommendations. We used risk matrices to determine the likelihood and impact of each risk. A data breach was rare (low likelihood) but devastating (high impact). Biased recommendations were more likely but had a lower impact. We also noticed an interdependency: poor data management could lead to both risks. By improving data management practices, we could mitigate both risks simultaneously. This assessment helped us prioritize risk mitigation strategies that would most effectively secure our objectives.

One must have a regular cadence setup with leaders from the various teams to discuss the Risks, clear plans for mitigating them, and where the Risk ownership lies. Once we have these things in place it is the onus of the Risk co-ordinator to follow up with the Risk owners and see the progress. The correct priority for the Risks should be provided i.e., Low, Medium, and High; So, we need to work with the appropriate stakeholders to get them resolved. In my experience, I have seen potential escalations have been avoided due to this proactive approach to identifying and resolving risks.

Standard project management approaches to risk to both assess the likelihood of the risk being realized and the degree of impact from the risk should be used to help with prioritization and determining which risks are most urgent to develop mitigation plans. Before Covid, most scenarios only factored in a single region impact, now everyone knows global impacts can and will happen as an example.

Risk prioritization is an ongoing process and should be adaptable to changing circumstances. It requires collaboration and communication among stakeholders to ensure a comprehensive and effective incident management approach. First, we need to identify all possible risks that could impact our organization's operations, assets, or objectives through risk assessments, incident reports, historical data analysis, or brainstorming sessions with relevant stakeholders. Risk Assessment impact needs to be measured as the magnitude of harm or disruption a risk could cause. We will then assign the priority rankings to risks based on their severity, urgency, and potential consequences of not addressing them.

This risk assessment is often added into overall organizational risk assessments and plans that feed up to audit committees and others at the board level. The risk impacts should be clearly stated in business impact, not just purely technical terms.

Determining the most effective communication channel for sharing risk reports with stakeholders is very critical. This could include email updates, meetings, presentations, or using collaboration tools and dashboards to provide real-time visibility into incident management activities. Customizing your communication approach based on the specific needs and interests of each stakeholder group. Senior leadership may require a high-level summary of the risks, while technical teams might need more detailed information about the incident and its potential implications. We need to be clear and concise with relevant metrics, and timely updates to ensure stakeholders are well-informed about the risks and the organization's response efforts.

When reporting IT strategy risks, provide context by explaining how each risk affects the entire value chain and the associated business processes. Highlight the potential impact on critical business objectives, such as revenue generation, cost efficiency, customer satisfaction, regulatory compliance, and strategic initiatives.

A daring example from my tenure as a CIO involved a complete overhaul of our legacy systems. The existing IT infrastructure was slowing operations and couldn't integrate with newer, efficient technologies. The risks were enormous, both in terms of the cost and the potential for disruption to our operations. We took a calculated risk. We didn't just upgrade; we revolutionized. We implemented cutting-edge AI technology and cloud-based systems. Our company was one of the first in the industry to do so at that scale. There were challenges, but by identifying, assessing, & prioritizing our risks meticulously, we managed them effectively. The payoff was massive: operational efficiency skyrocketed, and we set a series of new industry standards.