As IT Leaders, we must be able to understand the risks we face, and how to address them. Understanding and managing your IT risks by categorizing them and then rating them are the first steps in being able to address IT risk.

Understanding and Managing IT risksHere are the steps you should take to begin managing your IT risks

Identify Risks. You are probably aware of some of the risks your IT department is facing, but just as likely, you alone are not aware of all of them. Some of your business units may be aware of risks. Your frontline staff and junior managers will be aware of some risks but do not want to raise them to a higher level, perhaps because there is no mechanism available to do so. It is up to you to tap into the collective knowledge of the organization, and identify all known risks.

Categorize Risks. It is important to categorize risks for a number of reasons. Categories may include Infrastructure; Resources; Service Delivery and others. By categorizing, you can begin to understand which areas present the most risk, and allocate appropriate budget and resources to address them.

Rate Risks. Rating your risks allows you to determine the priority in which they should be addressed. It is important to note however, that you may not always be able to address the highest rated ones first. This could be due to resources or something more complex such as political challenges within the organization. Rating is still a very useful process though, as it will give you a guideline on which are the highest priorities. Use a simple rating system of Probability x Impact to give you a score, then list your risks from highest score to lowest.

Address Risks. Now that you have identified, categorized and rated all of your known risks, the next step is to address them. You cannot do this all at once, and so a plan should be developed. Each risk should have someone assigned to be responsible for addressing it. Note that this task uses the work “responsible” and not “accountable”. As an IT Leader, you are ultimately accountable for addressing IT risk. Have the responsible person develop a Risk Response, or how they intend to mitigate this risk. Set attainable target dates to have each risk addressed.

Track Risks. Having performed all of the previous steps, you can’t forget about them. Track all of the identified risks in a Risk Register. Have follow up conversations with those assigned to address the risks. Ensure that the risks are being addressed in a timely manner, and that your risk rating has not changed over time. When risks are mitigated or eliminated, archive them for future reference. You will also need to add new risks as they are identified, and go through the process described above.

Would you like to learn more about effectively identifying and managing your IT risks? Give us a call to discuss how we can help you address what may be keeping you awake at night.

In a future blog, we will discuss how some risks can present value and opportunity for the organization.