How can you align operational risk management with emerging cyber threats and climate change risks?

There is no doubt that this is the era of technology, digitalization and climate change. Organizations are now prone to risks like; digital fraud, environmental & social risks which they have never experienced before. To mitigate the aforesaid, these risks should be captured and assessed in the Operational Risk Management tools like RCSAs and KRIs which can be accomplished by updating the governing documents of the relevant functions/ units by incorporating these risks along with the mitigating controls. Furthermore, organizations should align and update their Operational Risk Management Framework as per the local and international regulatory guidelines and standards as well along with capacity building and procuring the relevant solution.

Aligning operational risk management with emerging cyber threats and climate change risks involves integrating these considerations into the organization's overall risk management framework. Here are top 5 steps in my opinion that can help to achieve alignment: 1. Integration of these areas into existing Governance Structure 2. Risk Assessment with specific considerations for cyber threats and climate change risks. 3. Risk Identification and Classification to include identifying and classifying emerging cyber threats and climate change risks. 4. Regulatory Compliance and frequent updates based on new regulations 5. Continuous Improvement: a process to feedback based on experiences/incidents

Add cyber security and climate change explicitly to your risk framework and register. In some industries and jurisdictions, there are specific regulations that must be complied with, such as OSFI's Guideline B-13 Technology and Cyber Risk Management, and Guideline B-15 Climate Risk Management for banks in Canada. Undertake a fulsome review of the risks and apply risk management discipline, from identifying risks and implementing and assessing controls, to risk monitoring, measurement, management, mitigation, and reporting.

To align operational risk management with emerging cyber threats and climate change risks, organizations should systematically identify, assess, and integrate these specific risks into their overall risk management framework. This involves governance, cross-functional collaboration, scenario planning, and the development of robust incident response plans. The continuous monitoring and adaptation of strategies ensure that organizations stay resilient and well-prepared for evolving challenges in the realms of cybersecurity and climate-related disruptions.

Three pointers that come to my mind from my work experiences are: 1. Employee training is absolutely ESSENTIAL! Educate employees on the risks associated with cyber threats and climate change. 2. Continuous Monitoring. Implement continuous monitoring systems for both cyber threats and climate-related indicators. As real-time monitoring helps in early detection and swift response to emerging risks. 3. Incident Response Planning. It is ansolutely necessary to develop and regularly update incident response plans that consider the possibility of simultaneous cyber and climate-related incidents. This ensures a coordinated and effective response to multifaceted challenges.

An example of demonstrating how climate change risk and operational risk management are not mutually exclusive and are intertwined, includes understanding serious changes in weather patterns causing more frequent extreme events that occur in a geographic location where an organisation holds significant operations and/or their services are adversely affected by infrastructure inaccessibility (eg. notable rainfall and flooding). Another instance, may be for an organisation that manages an asset portfolio with a large portion located in a cyclonic-affected region. These are scenarios whereby ORM would be integrated with a climate risk management framework to manage situations by engaging suitable control measures safeguarding PPP bottom line.

Leverage scenario analysis in Operational Risk Management (ORM) to navigate the evolving landscape of cyber threats and climate change risks. This technique involves exploring alternative futures, aiding in anticipating and preparing for potential impacts on operations and objectives. Use scenario analysis to identify and address gaps in your ORM framework, ensuring it aligns with the dynamic risk environment. Communicate effectively with stakeholders, showcasing your proactive approach to risk management.

By aligning operational risk management with emerging cyber threats and climate change risks, organizations can enhance their resilience and readiness to mitigate these evolving challenges effectively. Here are some steps to consider: 1. Identify and assess cyber threats and climate change risks 2. Integrate cyber and climate risks into risk management frameworks 3. Enhance risk identification and assessment processes 4. Develop tailored risk mitigation strategies 5. Foster cross-functional collaboration 6. Regularly update risk management practices 7. Continuous monitoring and improvement