Mind the Gap: Failures and promises in achieving 'better' risk, security or resilience outcomes and desired states
Ridley Tony
Experienced Leader in Risk, Security, Resilience, Safety, and Management Sciences | PhD Candidate, Researcher and Scholar
The notion of 'gap analysis' seemingly takes place every day in organisations when it comes to risk, security and resilience.
That is, as threats, hazards, vulnerabilities and the world evolves, so too does the required scales, complexity and levels of risk, security and resilience management.
Therefore, formal and informal gap analysis is taken by individuals, departments, organisations and governments.
Only some of these gap analysis initiatives are documented and even less are research, analysed and structured plans.
Not surprisingly, results vary, original or 'current' state is forgotten and everything presents as evolution, progress and better than it was....but is it?
Change comes with its own risks, security concerns and may even undermine resilience.
Moreover, clever marketers, consultants and organisations remain skilled in selling gap analysis solutions, which upon inspection and analysis lack foundational evidence, valid, objective units of measure or reliable guidance on what in fact is 'better' and why.
Risk, security and resilience is no different.
If anything, risk, security and resilience remain perennial buzz words with many a failed project, initiative or desired state pursued in vain in the name of risk, security or resilience.
领英推荐
In other words, failure, fear, loss, threat or hazard remains a powerful motivator and call to action for organisations and governments to change, and pursue 'better' risk mitigation, security or resilience. However, desired state and realities routinely fall well short of the sales sizzle and anticipation of 'better'. Even worse if not measured, structured or planned in detail.
In sum, anyone can use the term gap analysis.
The ability to analyse current state, devise an actionable plan based on a valid body of knowledge, research and evidence, to inform both the plan and desired state, especially when it comes to risk, security and resilience... less common, qualitative or realistic.
Buyers, professionals and practitioners remain frustrated on both sides, especially when 'cheap', elegant, brand or visual where the real reason for purchase and commitment, as opposed to evidence, experience and qualifications.
As a result, history is littered with failed (expensive) and mediocre risk, security and resilience initiatives due to poor choices, understanding or procurements.
Therefore, in practical terms, the real gap for analysis is why this continues to occur and how far competent and capable is from the dream and promise of achieving risk reduction, security or resilience.
Tony Ridley, MSc CSyP MSyI M.ISRM
Security, Risk, Resilience & Management Sciences
Risk and BCM
2 年(clever marketers, consultants and organisiations remain skilled in selling gap analysis solutions, which upon inspection and analysis lack foundational evidence, valid, objective units of measure or reliable guidance. ) I saw this so many times and unfortunately the criteria used by the gap analyst even in the big consulting firms are a ticking list which is developed to guide the practitioners in how to conduct the gap analysis but it’s not for use to the context, culture, and organization management system. Mostly, Risk is taken as part of compliance objective to show evidence that there is a risk management in the organization but Not as a navigation ?? tools to help the organization to see through the foggy weather. Specially when the risk management is currently practiced by the audit in most of the organizations I heard of it make it sound like a watchdog process not as consulting opinion that the process owner would rely on and seek its participation. Even the the risk matrix, the risk factors and the risk profiling are becoming a copy past tools for all.