Risk Management Approaches

Operational Risk Management: “Why did no one see this coming?” That was the question echoing across the room during a post-incident review. A critical system had failed—not due to negligence, but because the warning signs were either missed or never measured. That day taught me something valuable: Operational Risk Management isn’t about putting out fires. It’s about building a system that senses the smoke before there’s even a spark. That’s where tools like Risk & Control Self-Assessment (RCSA), Key Risk Indicators (KRIs), Control Assurance (CA), and Incident Management (IM) come into play. These aren’t just checkboxes—they’re the pillars of a proactive risk culture. • RCSA helps us spot weaknesses before they become issues. • KRIs give us the data to predict and prevent risk events. • Control Assurance keeps us honest about what’s working—and what’s not. • Incident Management ensures that when things do go wrong, we learn fast and recover smarter. Operational risk isn’t just about compliance—it’s about business resilience, reputation, and trust. Let’s prioritize it! #OperationalRisk #RCSA #KRIs #ControlAssurance #IncidentManagement #RiskManagement #Governance #Banking #BusinessContinuity #Leadership #ORM

🚨 AI Privacy Risks & Mitigations Large Language Models (LLMs), by Isabel Barberá, is the 107-page report about AI & Privacy you were waiting for! [Bookmark & share below]. Topics covered: - Background "This section introduces Large Language Models, how they work, and their common applications. It also discusses performance evaluation measures, helping readers understand the foundational aspects of LLM systems." - Data Flow and Associated Privacy Risks in LLM Systems "Here, we explore how privacy risks emerge across different LLM service models, emphasizing the importance of understanding data flows throughout the AI lifecycle. This section also identifies risks and mitigations and examines roles and responsibilities under the AI Act and the GDPR." - Data Protection and Privacy Risk Assessment: Risk Identification "This section outlines criteria for identifying risks and provides examples of privacy risks specific to LLM systems. Developers and users can use this section as a starting point for identifying risks in their own systems." - Data Protection and Privacy Risk Assessment: Risk Estimation & Evaluation "Guidance on how to analyse, classify and assess privacy risks is provided here, with criteria for evaluating both the probability and severity of risks. This section explains how to derive a final risk evaluation to prioritize mitigation efforts effectively." - Data Protection and Privacy Risk Control "This section details risk treatment strategies, offering practical mitigation measures for common privacy risks in LLM systems. It also discusses residual risk acceptance and the iterative nature of risk management in AI systems." - Residual Risk Evaluation "Evaluating residual risks after mitigation is essential to ensure risks fall within acceptable thresholds and do not require further action. This section outlines how residual risks are evaluated to determine whether additional mitigation is needed or if the model or LLM system is ready for deployment." - Review & Monitor "This section covers the importance of reviewing risk management activities and maintaining a risk register. It also highlights the importance of continuous monitoring to detect emerging risks, assess real-world impact, and refine mitigation strategies." - Examples of LLM Systems’ Risk Assessments "Three detailed use cases are provided to demonstrate the application of the risk management framework in real-world scenarios. These examples illustrate how risks can be identified, assessed, and mitigated across various contexts." - Reference to Tools, Methodologies, Benchmarks, and Guidance "The final section compiles tools, evaluation metrics, benchmarks, methodologies, and standards to support developers and users in managing risks and evaluating the performance of LLM systems." 👉 Download it below. 👉 NEVER MISS my AI governance updates: join my newsletter's 58,500+ subscribers (below). #AI #AIGovernance #Privacy #DataProtection #AIRegulation #EDPB

Hello fellow CISOs...We need to stop carrying what isn't ours. Before your next meeting with a business colleague, pause for a moment, ask yourself: Whose risk are we really talking about? Risk often appears to belong to the CISO because of how we communicate, how often we default to “no,” & how quick we are to step in front of decisions. When we do this, the business will keep pretending the risk is ours & then they'll hand us the bill when the bet goes bad. Reality check: Risk acceptance sits with the business, so let's stop talking like the risk is ours. Our job is to surface the risk(s), price it, & advise on the trade offs in clear terms. Influence is describing the situation in an easy to understand way & then pointing to an explicit choice. (Document it too!) Here are a few one-liners you can use...no copyright 😁 ...“I understand you want this shipped fast. Here are the options & the business risks of each.” ...“If you’d like to skip the review, we can proceed. We’ll just need to document that risk acceptance.” ...“My role isn’t to stop you. It’s to make sure you have the full picture before you decide.” ...“Security can advise and enable. Acceptance sits with the business.”

If I could go back and teach myself just one thing to become a better PM, it would be this: Manage risk using feedback. After 15 years, I’ve cracked the code and here's your guide to the Risk-Feedback Matrix: — Before we dive into everything, let’s first understand the 4 types of risk that come with every product decision: Value → Are we solving the right problem? Usability → Can users actually use it? Feasibility → Can we build it? Business Viability → Will this make sense for the business? Let’s talk about the matrix now. — 𝟭. 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄𝘀 They’re your best tool for tackling: → Value Risk: Understand what users truly need. → Usability Risk: Spot real pain points and frustrations. At Affirm, one hour with a merchant revealed more about needs than weeks of analytics. But let’s be real: interviews can’t solve everything. They’re limited for Feasibility Risk → users can’t tell you what’s technically possible. And for Business Viability → pricing or scalability needs further validation. — 𝟮. 𝗨𝘀𝗮𝗴𝗲 𝗗𝗮𝘁𝗮 It’s the silent witness that tells you how users behave; not just what they say. → Usability Risk: At Apollo, drop-off data pinpointed exactly where users struggled in our workflow. → Value Risk: Validates whether your feature is solving the right problem. But data has its blind spots: It struggles with Business Viability Risk → usage patterns don’t tell you if your pricing works. And Feasibility Risk → it might highlight scale issues, but rarely uncovers the root cause. Pair data with qualitative insights for a full picture. — 𝟯. 𝗦𝘂𝗽𝗽𝗼𝗿𝘁 𝗧𝗶𝗰𝗸𝗲𝘁𝘀 Support tickets are where the rubber meets the road. They’re gold for: → Value Risk: Surface unmet needs. → Usability Risk: Reveal friction points beta tests often miss. Fortnite’s tickets uncovered issues we never spotted in testing. But don’t expect too much from support tickets: They’re limited for Business Viability Risk → volume alone doesn’t explain profitability. For Feasibility Risk → they can highlight bugs but rarely explain technical constraints. So don’t just stop there… — 𝟰. 𝗦𝗮𝗹𝗲𝘀 𝗙𝗲𝗲𝗱𝗯𝗮𝗰𝗸 Sales teams are your direct line to the market pulse. → They crush Value Risk: What’s driving demand and what's not? → They shine for Business Viability: Pricing dynamics, enterprise needs, etc. At Apollo, this led us to reposition our enterprise offering. Sales feedback has its limits. It’s weak for Usability Risk → sales focuses on the big picture, not workflows. And it won’t solve Feasibility Risk → details about implementation rarely come up. — Summarising everything... No single feedback channel solves everything. The Risk-Feedback Matrix balances them all: Customer Interviews → Strategic depth. Usage Data → Behavioral truth. Support Tickets → Unfiltered reality. Sales Feedback → Market pulse.

Understanding "systemic risk" is essential. But we need to be clear about which systemic risks we mean—and what it will take to address them. In a recent blog, my co-authors and I distinguish among climate-related planetary risks, real economy risks, and financial risks (each of which has systemic characteristics). That distinction is not academic—it is foundational to effective strategy. A new report by UKSIF, Scottish Widows and Canbury on systemic risk and portfolio resilience is better than most: it avoids the common mistake of assuming that once asset managers and asset owners understand systemic risks, they’ll naturally take actions that mitigate climate change. That’s not how capital markets work—and it’s not how economic/energy/sectoral systems change happens either. For instance: building resilience to systemic financial risks into portfolios may (appropriately) emphasize corporate-level investments in resilience and adaptation—investments that are critically important for individual firms facing physical climate risks and often far more strategic for those firms that cannot, on their own, shift global emissions trajectories. But these actions—however rational and necessary—will not mitigate planetary risk. They may protect corporate assets (which is important - both financially and for corporate stakeholders) and reduce a portfolio's exposure, but they do not reduce the underlying climate threat itself. That’s because systemic planetary risks—like climate tipping points, biodiversity collapse, and global water stress—operate on different time scales, affect different populations, and require different levers than systemic financial risks. And those levers sit primarily with governments, regulators, and international institutions—not with individual asset managers or company boards. This is not to discount the importance of financial institutions understanding systemic financial risks. They should—and must—do so to fulfill fiduciary duties and safeguard long-term value. But we should not conflate that task with the much larger, more urgent and oft-neglected one: mobilizing bold public policy, institutional reform, and large-scale public and private capital flows to mitigate planetary risk. Understanding this distinction is critical. For each goal (energy sector transformation, systemic resilience, etc.), It's critical to consider what systems change is required, what the necessary policies or investments are, what the barriers are, and which actors can drive solutions. Clarity here is the only way to align actions with the scale of the crisis. 👉 here's the full (short) blog on the importance of distinguishing among planetary, economic and financial risks: https://lnkd.in/ej6kpcDD Denise Hearn Matt Goldklang Perrine Toledano Darius Nassiry Cam Brewer Diana Best Linda-Eling Lee Columbia Center on Sustainable Investment

Risk Appetite, Risk Tolerance & Risk Acceptance: Three Anchors of a Mature Risk Culture In leadership conversations, these terms often come up, sometimes interchangeably yet each plays a distinct role in shaping how organizations navigate uncertainty and opportunity. Getting them right isn’t about definitions; it’s about alignment between strategy, execution and judgment. Risk Appetite; How much risk we want to take This reflects the organization’s strategic comfort zone. How much and what kind of risk it’s willing to take in pursuit of its objectives. Example: A bank may set a moderate appetite for credit risk, comfortable lending to SMEs but steering clear of high-risk startups. Think of it as your taste for spice. It sets your general comfort level. Risk Tolerance; How much risk we can actually handle Tolerance defines the boundaries within the appetite. The variation management can live with before taking corrective action. Example: If the appetite for non-performing loans is 5%, tolerance might range from 4% to 6%. Beyond that, leadership steps in. It’s the difference between liking spice and knowing when it starts to burn. Risk Acceptance; What risk we decide to live with No control framework eliminates all risk. Some exposures are consciously accepted when the cost of mitigation exceeds the potential impact. Example: Accepting a brief system downtime during maintenance because the operational impact is negligible. Like living with a small scratch on your car, fixing it isn’t worth the effort. In essence: Risk Appetite = the strategic desire for risk Risk Tolerance = the operational limit of that desire Risk Acceptance = the informed choice to retain certain risks When these three are clearly defined and consistently applied, leadership drives not just compliance, but confidence creating a culture where risk is neither feared nor ignored, but understood and managed.

All risk is enterprise risk. Cybersecurity Risk Management (CSRM) must be part of Enterprise Risk Management (ERM). Many companies think managing cyber risks is: ╳ Just an IT problem. ╳ Isolated from other risks. ╳ A low-priority task. But in reality, it is: ☑ A key part of the entire risk strategy. Here are the key steps to integrate cybersecurity risk into enterprise risk management: 1. Unified Risk Management ↳ Integrating CSRM into ERM helps handle all enterprise risks effectively. 2. Top-Level Involvement ↳ Top management must be involved in managing cyber risks along with other risks. 3. Contextual Consideration ↳ Cyber risks should be considered in the context of the enterprise's mission, financial, reputational, and technical risks. 4. Aligned Risk Appetite ↳ Align risk appetite and tolerance between enterprise management levels and cybersecurity systems. 5. Holistic Approach ↳ Adopt a holistic approach to identify, prioritize, and treat risks across the organization. 6. Common Risk Language ↳ Establish a common language around risk that permeates all levels of the organization. 7. Continuous Improvement ↳ Monitor, evaluate, and adjust risk management strategies continuously. 8. Clear Governance ↳ Ensure clear governance structures to support proactive risk management. 9. Digital Dependency ↳ Understand how cybersecurity risks affect business continuity, customer trust, and regulatory compliance. 10. Strategic Enabler ↳ Prioritize risk management as both a strategic business enabler and a protective measure. 11. Risk Register ↳ Use a unified risk register to consolidate and communicate risks effectively. 12. Organizational Culture ↳ Foster a culture that values risk management as important for achieving strategic goals. Integrating cybersecurity risk into enterprise risk management isn't just a technical task. It's a strategic necessity. 💬 Leave a comment — how does your company handle cyber risk? ➕ Follow Andrey Gubarev for more posts like this

CISA has released its new Operational Technology (OT) Cybersecurity Guide, and it deserves board-level attention. For years, OT systems, the technology behind our power grids, water systems, manufacturing plants, and pipelines, were designed for reliability and safety, not cybersecurity. But as IT and OT environments have converged, the attack surface has expanded dramatically. We’ve already seen what this means in practice: ⚠️ Colonial Pipeline (fuel supply disruption) ⚠️ Oldsmar Water Plant (attempted poisoning) ⚠️ Ransomware groups are increasingly threatening physical operations to force payment. The CISA guide is a practical step forward, outlining what every OT-dependent organization should do: ✔️ Know your assets. Visibility is the foundation of OT security. ✔️ Segment IT and OT networks. Strong separation is essential. ✔️ Secure remote access. Enforce MFA, monitor, and log everything. ✔️ Patch with care. Use compensating controls when downtime isn’t possible. ✔️ Prepare for incidents. OT-specific monitoring, response plans, and recovery options must be in place. ✔️ Build resilience. Backups, redundancy, and even manual controls as a fallback. ✔️ Train people. Both IT and OT teams need a shared understanding of cyber risk. This isn’t just a technology problem. It’s a resilience problem. For executives, OT risk belongs on the same agenda as financial, legal, and regulatory risk. The impact of failure isn’t just data loss; it’s downtime, safety hazards, and national security implications. CISA’s guide is a reminder that OT security is no longer optional. It is a core part of modern business continuity. Please feel free to contact me if you need help or want more information on this. 🔔 Follow me for more real-world takes on cybersecurity, leadership, and tech strategy ♻️ Useful? Share to help others! #CyberSecurity #OperationalTechnology #RiskManagement #CriticalInfrastructure #CISA #BusinessContinuity

🚗 Risk Capacity, Appetite, Tolerance & Acceptance — The Roadmap You Actually Need Most debates about “risk appetite” get lost in jargon. Here’s the simple, road-trip version—and how to turn it into action. Risk Capacity – The highway’s physical limit. How much loss, volatility, or disruption the organization can absorb before breaching covenants, capital ratios, or survival. Think: the max speed the car can handle before the engine blows. Risk Appetite – Your chosen cruising speed. The level of risk leadership is willing to take to hit strategic goals. You could drive faster, but you decide not to. Risk Tolerance – The wiggle room on the speedometer. Acceptable variation around appetite for specific metrics (e.g., SLA breaches ≤ 2 per quarter, VaR ≤ X). Cross the line? Alerts and escalation kick in. Risk Acceptance – Hands on the wheel when the pothole shows up. A conscious decision to live with a specific risk (after cost–benefit thinking). Document the rationale, owner, and review date: “We’ll take this detour—for now—because fixing it costs more than the impact.” ⸻ How to Make It Real • Quantify Capacity first (capital, liquidity, regulatory buffers). • Translate Appetite into plain-English statements tied to strategy (“We will take moderate tech risk to digitize onboarding”). • Set Tolerances as measurable thresholds with clear escalation paths. • Log Acceptances formally—no silent risks. Revisit them quarterly. Bottom line: Understanding risk isn’t just about appetite—it’s about limits, flexibility, and conscious choices at every turn. #RiskAppetite #RiskManagement #Governance #StrategyExecution #ERM

You can’t manage risk if you don’t measure it. Most organizations track incidents. Few track risk performance. Risk Management is not a policy exercise. It is a measurable control system. If your dashboard only shows “number of incidents,” you are already behind. A mature risk KPI structure should cover the full lifecycle: 🔎 Risk Identification ✔ Risk Register Coverage ✔ Emerging Risk Detection Rate ✔ Risk Assessment Frequency 📊 Risk Assessment & Analysis ✔ Risk Exposure Index ✔ High-Risk Concentration ✔ Risk Velocity Score 🛡 Risk Mitigation ✔ Mitigation Plan Completion % ✔ Control Effectiveness Score ✔ Residual Risk Level 🚨 Incident Management ✔ Incident Frequency Rate ✔ Incident Severity Index ✔ Mean Time to Resolve (MTTR) 📑 Compliance & Governance ✔ Policy Compliance Rate ✔ Audit Finding Closure Rate ✔ Regulatory Breach Incidents 🏢 Operational & Strategic Risk ✔ Operational Loss Events ✔ Business Disruption Time ✔ Strategic Risk Exposure ✔ Risk Appetite Breach Rate 👥 Risk Culture & Awareness ✔ Risk Training Coverage ✔ Reporting Participation ✔ Risk Awareness Score The difference between reactive and proactive organizations? Leading indicators vs lagging indicators. Risk KPIs should: • Align to risk appetite • Support board reporting • Drive accountability • Enable early detection If your risk dashboard went to the board tomorrow, would it show control… or chaos? #RiskManagement #GRC #EnterpriseRisk #InternalAudit #Compliance #RiskKPIs #Governance #OperationalRisk #StrategicRisk #CIA #IIA