What are the biggest issues in risk management today, and how are they evolving?
A few points need attention when carrying out a risk assessment or establishing a risk management process:
Risk decision-making structure or framework: Many organisations lack a structure for risk decisions and clear accountability for them. Most business executives are comfortable making risk decisions; the problem is that, in many cases, the right people are not the ones making them. Big risk decisions are often made too low in the organisation, by people who are not incentivised to make the right decision for the organisation as a whole. For example, a project manager may accept a large information security risk that leads to compliance and reputational issues simply because the only thing they are incentivised on is getting the new product out of the door. The executive in charge of the business unit, who is accountable for sustained results, may make a very different decision.
Organisations need a structure that ensures important risk-based decisions are made by the right people: those who are accountable for the impact, good or bad. This typically means a risk governance structure that defines the decision-making authority at each level of the organisation, with oversight and an escalation path for risks that need to be monitored or managed higher up. Current frameworks now make this explicit. The NIST Cybersecurity Framework (CSF) 2.0, released on 26 February 2024, added a sixth function, Govern, alongside Identify, Protect, Detect, Respond and Recover, so that cybersecurity risk strategy, roles, responsibilities and oversight are treated as an enterprise risk for leadership to own.
The lack of a meaningful risk assessment process: Some organisations treat risk management as a compliance exercise and conduct superficial risk assessments. Others simply lack the skills to develop a meaningful process. A meaningful process identifies risks based on the goals of the organisation and describes them in business terms, either qualitatively or quantitatively, using a common risk taxonomy. Being able to compare risks like for like is extremely important for decision makers who must allocate resources across complex organisations. Organisations that take a purely control-based approach to risk assessment often miss the business context needed to make the right decisions.
A common approach is “I’ve compared myself to a best practices list, so anything I am missing must not be a risk”, which misses the point. Best practices should be adopted as controls to manage the risks you have identified. Applying a list wholesale means you are unlikely to spend money on the controls needed for your real top enterprise risks, and likely to overspend in areas that deliver small gains in risk reduction. A true, goals-based risk management strategy allocates risk mitigation resources more effectively and can even save money. The current standards support this approach: ISO/IEC 27001:2022 requires an information security risk assessment and treatment process, with Annex A (93 controls) used as a reference to check that no necessary controls have been omitted rather than as a checklist, and ISO/IEC 27005:2022 gives guidance on carrying out that risk assessment. The transition period for certificates against the older ISO/IEC 27001:2013 ended on 31 October 2025, so certified organisations should now be working to the 2022 edition.
A lack of an open, risk-aware culture: For business managers to be transparent with their executives, the executives must deliberately build a culture that fosters this transparency. Open dialogue about concerns, risks and necessary trade-offs, without “shooting the messenger”, is often missing in organisations that lack effective risk management.
If you would like help building a risk governance structure or a business-led risk assessment process, please contact us.
Sources: NIST, “NIST Releases Version 2.0 of Landmark Cybersecurity Framework”, 26 February 2024 (nist.gov); ISO/IEC 27001:2022; ISO/IEC 27005:2022; IAF MD 26:2023, transition requirements for ISO/IEC 27001:2022.