CERM® Risk Insights

Guest Post by Ed Perkins (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Unsuspecting consumers, thinking they have found a bargain, or that they have joined the latest gadget trend, or both, can be unpleasantly surprised, according to recent revelations on how mobile and IoT (Internet of Things) devices can have built-in security issues. [Read more…]

Guest Post by Ed Perkins (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

In an earlier post [1] we looked whether ‘plausible deniability’ was now a dead strategy in the face of enterprise risk management (ERM) and the likely impact of the US SEC (Securities and Exchange Commission) guidance [2] regarding disclosure obligations relating to operational and cybersecurity risks and cyber incidents. The SEC noted that “a number of disclosure requirements may impose an obligation on registrants to disclose such risks and incidents. [Read more…]

Guest Post by John Ayers (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

There are many design rules of thumb I have heard over the years. For example: KISS (keep it simple stupid); make it idiot proof; be realistic with tolerances; do not make assumptions that are not realizable (zero gap for instance); and many more. The most important rule of thumb I have experienced is “common sense”.   To illustrate my point, I have a few examples that are below. [Read more…]

Guest Post by Geary Sikich and Joop Remme (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Introduction

In this article we posit three questions. The first question is: “Is it a social responsibility of companies that they undertake a comprehensive risk assessment?” The second question: “Does the notion of conscience and its application to the generation and use of risk information and information in general, create an obligation for the organization to disclose the results of the comprehensive risk assessment?” The third question “How do the people in the organization communicate the information from the comprehensive risk assessment to stakeholders and yet preserve security and protect the organization?” [Read more…]

Guest Post by Geary Sikich (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Many aspects of risk management are deeply rooted in mathematical formulae for determining probability. This heavy dependence on mathematics to determine probability of risk realization may create “false positives” regarding a risk that can be either positive or negative. There is also a limitation on how much data can be gathered and assessed in respect to the development of the probability equation regarding the risk being assessed. [Read more…]

Guest Post by John Ayers (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Some people say take what you love in college. Problem is, not too many high school seniors know what they love. Others say college should be an intellectual journey. Problem is many degrees will not prepare you for the real world in terms of making a good living. I believe college is to prepare you for a career which can support you and a family down the road. If important, intellectual studies can take place outside of work using the internet. [Read more…]

Guest Post by Greg Hutchins (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

We’ve been discussing how ISO 9001:2015 has adopted Risk Based Thinking that will impact 1.2 million companies.  ISO 14001:2015 will impact 400,000 companies.  Now, government agencies are adopting and putting into statute risk management.

We’ve been talking up the fact the US government is requiring Enterprise Risk Management (ERM), specifically Office of Management and Budget Circular OMB A 123, of all US departments.  This is a game changer for federal agencies.  In this article, we’ll look at some of the significant changes in ERM for Federal agencies. [Read more…]

Guest Post by Geary Sikich (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

The Nine Circles of Planning Hell (Adapted from Dante’s Inferno)

Introduction

Inferno, the first part of Dante’s Divine Comedy that inspired the latest Dan Brown’s bestseller of the same title describes the poet’s vision of Hell. The story begins with the narrator (who is the poet himself) being lost in a dark wood where he is attacked by three beasts which he cannot escape. He is rescued by the Roman poet Virgil who is sent by Beatrice (Dante’s ideal woman). Together, they begin the journey into the underworld or the Nine Circles of Hell. [Read more…]

Guest Post by Greg Hutchins (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

The idea of supply chain risk management has been around for about 10 years. It is only in the last 5 years, that it has become popular. We are still at the early stage of supply chain risk management adoption and deployment.

In terms of total dollar amount, external suppliers provide a significant portion of a manufacturer’s product. For U.S. firms, 50% to 80% or more of the final price of a product can be the cost of purchased goods.  In Japan, it can be even higher.

For these reasons, any supply disruption can kill a supply chain.  As a result, supply chain risk management is now critical to a company’s competitiveness. [Read more…]

Guest Post by Geary Sikich (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

If you want senior management to pay attention give them something that challenges their focus – and understand that their focus is not on how many computers you have or RTO, RPO stats. It is on business survivability – will we be in business tomorrow given the issues that we face today. [Read more…]

Guest Post by Geary Sikich (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Heightened Awareness or Reactive, Backwards Looking?

From financial crises to energy catastrophes to earthquakes and threats of terrorism, we hear a lot about events that challenge our ability to identify and manage risk.

Unfortunately, some of the things that emerge from many of these events are reactive regulatory rules and requirements. [Read more…]