Risk control in systems management

Introduction to risk control.

All organizations face a series of risks when carrying out their activity and, therefore, when using their services. The regulator and rating agencies are beginning to take into account the analysis of companies' risk management processes when evaluating their health.

Today, there is no doubt that proper risk management is a competitive advantage over the competition, especially in the current economic situation where trust is one of the most valued aspects among the clients of an entity. Having processes to mitigate risks only increases this confidence.

In the field of IT service management , risks have to be managed to ensure the availability of systems and avoid the loss of confidential data among other setbacks. Having a strategy for risk management becomes essential in the development of the service management strategy. In fact, ITIL includes it as part of the design of the service, since, from the moment it is conceived, it is necessary to consider the different risks that the service will face and the alternatives to minimize their negative effect. Therefore, it is during the definition of the new service that the processes necessary to manage risk have to be considered.

At present, risk management is carried out under a more holistic and continuous approach , adopting what has been called Enterprise Risk Management (ERM) , comprehensive risk management . The concept of ERM appeared in 2003, when the Casualty Actuarial Society (CAS) defined it as a discipline through which organizations of any industry monitor, control, exploit and finance risks from any source with the purpose of increasing, in the short and long term, the value offered to stakeholders. This approach includes methodologies and processes used by organizations in all industries to manage risks and optimize opportunities that allow them to achieve their objectives.

Risk management comprises the identification, monitoring and prioritization phases , as defined in the ISO 31000 standard . To counteract this, it is necessary to monitor and control the probability and impact of the triggering cause of the risk.

ISO 31000 standard.

Although risks are of a very diverse nature, depending on the business environment of the organization that faces them, the ISO 31000 standard proposes standardized guidelines to try to manage it. It was published as a standard on November 13, 2009 , pretending to be applicable and adaptable for any type of public or private company, association or even for the work activity of companies constituted by freelancers. In addition to this standard, the so-called guide 73 was published , which seeks to unify the vocabulary used in risk management processes.

This standard is divided into three main blocks:

1.            Principles for risk management :

1.            Create value to contribute to the achievement of the company's objectives.

2.            Integration with the organization's processes.

3.            Help decision-making by providing information on possible scenarios.

4.            Minimize uncertainty.

5.            Systematic, structured and adequate function to contribute to obtaining reliable results.

6.            Based on the best information available at all times.

7.            Aligned with the internal and external context of the company itself.

8.            It must take into account the human and cultural factors of the organization.

9.            Transparent when it comes to showing the information and participation of all stakeholders in its management.

10.         Dynamic, iterative and sensitive to change.

11.         Contribute to the continuous improvement of the company.

2.            Support structure : risk management must have the support of senior management. It is developed iteratively in cycles that aim to design the best support structure, implement this structure in the most efficient way to manage risk and monitor management activities to continuously improve the proposed structure.

3.            Risk management process : Risk management includes the stages of identifying, analyzing, evaluating and treating risks. There must be constant communication and consultation with the different areas of the organization, as well as monitoring and review.

However, this standard only intends to establish guidelines , but does not intend to implement a uniform risk management model among the different companies. The design and implementation of a risk management plan and a framework for its execution needs to consider the specific variations of each industry, particularly its objectives, context, structure, operations, processes, projects, products, services or assets.