Top 10 enterprise risk management myths: an executive at a governance and risk technology firm offers a primer on how companies should view enterprise risk, especially from a systems standpoint.

• Author: Burnes, Gordon
• Position: RISK MANAGEMENT

Few companies can grow without taking risks. But poor risk management leads to surprises in business operations that can impact shareholder confidence, regulatory oversight and the bottom line. An unprecedented wave of regulatory oversight in recent years has convinced many organizations how inadequate their enterprise risk management (ERM) policies and procedures really are.

Many of the world's largest companies have responded to external and internal pressures by embarking on a journey to unify governance, risk and compliance (GRC) management across the enterprise. Yet, many organizations that don't have a historical foundation in risk management are still struggling to come to grips with this new discipline and how to embed risk management into the business.

With that in mind, here's a Letterman-like look at the top 10 myths regarding ERM.

Myth Number 10

IT Risk Management = Information Security

Most information security programs place far too much emphasis on the how and what, and far too little on the why. Information risk management, on the other hand, is inherently focused on the why.

Unfortunately, there's always far too much for information technology (IT) staffs to do. There are too many vulnerabilities to remediate and too many controls to implement, so some critical deficiencies will go unmanaged.

True risk management requires a business perspective on these deficiencies to better manage and prioritize the issues that threaten the organization. A check-list approach to information security ignores business impact and criticality.

Myth Number 9

CIOs Embraced Enterprise GRC

To address Sarbanes-Oxley compliance, many companies put in place technology platforms that now support a variety of risk and compliance initiatives. Sarbanes-Oxley solutions were generally purchased with the tacit approval of IT, but few IT organizations standardized on a strategy for managing risk and compliance data. As a result, different parts of the problem are addressed by a wide and disparate range of solutions, including spreadsheets, custom and commercial applications.

In numerous buying decisions, IT is too often at the table in a support role, rather than as a strategic thinker focused on the long-term strategic benefits of a common GRC platform. Scattered risk and compliance data marts will cause an immense amount of pain for risk managers trying to get a clear picture of risk throughout the business.

Myth Number 8

A Rigid, Standardized Approach Is...