What are the most common ERM pitfalls and how can you avoid them?

It's critical to ensure that the overall strategy and objectives for enterprise risk management are agreed with leadership (and clearly documented) before commencing an ERM journey. It's key to ensure that senior, board-level stakeholders clearly understand the purpose of ERM, its remit, and how it integrates with the firm's strategy, in order to ensure that appropriate support is provided (and expectations on both sides are met) vis-a-vis enterprise risk management.

Common issues arise when there's no clear consensus on ERM's definition, scope, and objectives. This can result in confusion, inconsistency, duplicated efforts, missed opportunities, and increased exposures. To avoid this, establish a shared vision of ERM's significance, its alignment with strategic goals and values, define stakeholder roles, and provide necessary support for their participation.

While cyber risk management helps minimize the potential financial losses in the wake of an event, ensuring resources are spent on innovation and development rather than crisis mitigation, CISOs have typically been unable to make key stakeholders understand that. Cybersecurity is often too technical for traditional executives to understand, and, thus, they believe it to be a business drain rather than an enabler. But by translating cyber risk metrics into event likelihoods, monetary losses, and financial ROI, it's much easier to make this alignment more apparent. With this common language, CISOs can ensure that cyber programs not only bolster business growth but also that upper managment recognizes this value.

Over-relying on quantitative methods in ERM can obscure complex, emerging risks. To avoid this, we need to blend quantitative data with qualitative approaches like interviews, workshops, and scenario analysis. These methods capture behavioural and contextual risk factors, adding depth to your risk assessments. We then apply critical thinking to validate models, acknowledging their limitations. Balancing numbers with real-world insights ensures a more holistic view of risks and improves decision-making, especially when navigating uncertain or unpredictable environments.

Incorporating cyber risk into the broader business objectives and risk managment plans is too often overlooked. Cybersecurity has notoriously been viewed as a siloed department, given its complex nature and technical terminology. However, especially in today's digital age, this can no longer be the case. Organizational leaders and all stakeholders who have a say in ERM need to work with their organization's cybersecurity leaders to understand financial exposure due to cyber events. Once this quantitative information is made known, cyber issues can be taken out of isolation and considered when determining crucial issues such as risk appetite, tolerance, and capital reserve levels. Cyber risk is a broader business risk.

ERM should be embedded in business as usual and not be a side industry. It is important that risk management is part and parcel of day to day activities without being an activity which the users do not feel invested in. ERM procedures need to be tailored to the risk and level of risk being managed driven by the overall risk appetite. Risk management should be fluid so that the effort invested is proportionate to the level of risk beinf managed.

Updating risk assessments regularly still relies on a legacy practice that must be challenged. Risk is dynamic – threats, vulnerabilities and assets that organizations seek to protect are not static. A “snapshot in time” assessment is outdated the moment the process begins. Instead, a risk-based continuous analysis and evaluation approach is needed to account for not only the complexity of the environment but also the interdependencies that exist. By having a unified view of what needs to be protected, enterprise risk owners can establish a common framework for more effectively determining how to work to together in reducing exposure.

Effective cyber risk managment (or any risk factor of ERM, for that matter) relies on effective collaboration with all key stakeholders, which can be difficult due to its many technical and complex components. Cyber risk has to be transformed into a language more commonly used in the business world, such as event likelihoods and potential financial consequences. With on-demand CRQ, this translation process is made relatively easily, allowing organizational cybersecurity leaders to communicate in terms that resonate - and actually mean something - with high-level executives. Keep in mind that no one can effectively manage what they don't understand. So, it's critical to present tangible metrics and KPIs.

Don't use a risk matrix when striving to manage cyber risks at the enterprise level effectively! There's been too much research published demonstrating how risk matrices are unreliable. They are subjective, and there's no way to aggregate risk nor distinguish between two "high-level" risks (aka, there's no way to know which mitigation initiatives to prioritize). Cyber risk evaluation needs to leverage quantification models that incorporate a large scale of global intelligence and can integrate directly with internal security systems. With the quantified results, CISOs can not only defend their prioritization choices but also ensure that programs target the most vulnerable business areas.

These tools are outdated and the use of them only makes a small contribution to a view of risk at a point in time. These are just representations of historic data, converted into R-A-G pictures, mostly as at the end of the previous month, or even worse; as at the end of the previous quarter. Making decisions based on these is like driving on the highway; looking only in your rear-view mirror.

When building a risk analysis matrix and dashboard, we start by defining clear parameters for likelihood and impact. We use both quantitative and qualitative methods to assess risks, assigning scores to each. We then create a dashboard featuring key risk indicators and trends, ensuring visualisations are easy to interpret. We use color-coded heat maps or graphs for clarity. We need to regularly review and update the matrix to reflect evolving risks, sharing it with stakeholders to facilitate alignment and action. This approach keeps the ERM process transparent and adaptable.