Comments on: Do we really need an IT Risk Control Department? http://www.highlanderprinciple.com/2009/11/do-we-really-need-a-it-risk-control-department/ One IT Architecture Wed, 09 Dec 2009 14:56:39 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: David Lodge http://www.highlanderprinciple.com/2009/11/do-we-really-need-a-it-risk-control-department/comment-page-1/#comment-90 David Lodge Wed, 09 Dec 2009 14:56:39 +0000 http://www.highlanderprinciple.com/?p=205#comment-90 I think the question is less whether we need an IT Risk Control function, but what the function looks like and how it operates. Most companies I've seen operate a 3 line of defence model (Function, independent risk, and audit) but they work to different objectives. I am a risk controller by profession, and can see real benefit in controlling IT risk with a thorough understanding of the IT Function (CIO) and Business objectives. With these in mind, risk decisions can be taken with a real understanding of the implications such decisions will have on driving the business forward and the trade offs that must be considered. IT Risk is, afterall, Business risk. However, if IT Risk decisions are taken only considering a single IT risk factor (IT Security say) then the likely implication is that the IT function and business will be constrained in other ways. I think the question is less whether we need an IT Risk Control function, but what the function looks like and how it operates. Most companies I’ve seen operate a 3 line of defence model (Function, independent risk, and audit) but they work to different objectives.

I am a risk controller by profession, and can see real benefit in controlling IT risk with a thorough understanding of the IT Function (CIO) and Business objectives. With these in mind, risk decisions can be taken with a real understanding of the implications such decisions will have on driving the business forward and the trade offs that must be considered. IT Risk is, afterall, Business risk.

However, if IT Risk decisions are taken only considering a single IT risk factor (IT Security say) then the likely implication is that the IT function and business will be constrained in other ways.

]]>