From Excel to Excellence: Revitalizing IT Risk Strategies for a Future-Ready Landscape

Effective IT risk management is necessary to safeguard valuable assets, achieve organizational objectives, and ensure long-term success. When done properly, it is a crucial tool for informed decision-making. However, keeping up has become challenging in the modern fast changing world of Agile, cloud infrastructure, the massive use of external dependencies and complex and opaque supply chains, and daily changing threats.

Still, IT risk management is often based on traditional management approaches that assume linearity and predictability such as checklist processes, KPIs, and periodic review cycles. Additional implementation problems like excessive documentation demands, limited stakeholder involvement, and a lack of adaptability further contribute to their shortcomings. As a result, IT risk management often struggles with the dynamics of modern software environments. To successfully navigate complexity and continuous change, IT risk management processes will benefit from a more adaptive and collaborative approach that embraces flexibility, continuous adaptation, and engaging diverse teams and stakeholders, while avoiding the pitfall of creating a new rigid framework full of constraints.

Luckily, we don’t have to reinvent everything from scratch; over the years strategy [1] and architecture [2] faced the same challenges in dealing with complexity. Risk management can benefit from adopting similar, more context-aware, approaches based on the ideas of systems thinking, complexity theory, and sensemaking:

• Systems thinking involves considering the entire system and its interdependencies, recognizing that changes in one part can have ripple effects throughout the system [3]
• Complexity theory acknowledges that organizations are dynamic, adaptive, and subject to emergent behaviours that may not be evident [4]
• Sensemaking techniques support the process of making sense of complex and ambiguous situations, involving tools and structures for effective information gathering and interpretation [5]

However, these approaches need to be translated to the risk management context. In this article we will provide some examples on how to do that.

Define Risk Guardrails

Most organizations have operating models based on static rules and principles. If you look at the reality we live in, organizations are sociotechnical systems where individuals interpret, shape, and bend these rules through their (biased) decisions.           

On one hand, this flexibility helps organizations to seize opportunities, take chances, and continuously adapt to change to achieve their goals. However, since every action has risks, every decision should manage the balance of risk and reward. Without this balance, decisions can potentially expose the organization to unacceptable risks.

Complexity theory states that to deal with the unpredictable nature of complexity it is crucial to move from a rule-based system (output) to one based on vision and direction (outcome) [6]. This clarity enables better decision-making and allows teams to make choices autonomously and without confusion.

In IT risk management, this means we need to rethink how we communicate risk appetite (or risk tolerance statement [7]). The challenge is finding a balanced statement that clearly defines the boundaries on how much risk an organization is willing to take to achieve its goals, without dictating how to achieve that. A good risk appetite statement should be usable as a moral compass by everyone in the organization. So instead of using an excel sheet full of numbers and calculations, it should be a document that can be interpreted and provide guidance. A good approach to achieve that is the TASTE [8] approach (readers with a background in LEAN might recognize similarities to the House of Quality [9]). This approach clearly defines the vision (‘True north’), but also defines aspirations, strategies, tactics, and evidence.

The first 3 levels we should be able to construct from the information typically present at an organisation:

• True North – clearly defines what should be prevented; this should be a simple statement that describes the largest threats to be prevented; think of a form like the Agile Manifesto [10] or a level 1 overview in the architectural C4 model approach [11].
• Aspirations – the results we hope to achieve; these go 1 level deeper and describe how to achieve those objectives; this level would resemble the 12 agile principles [12] or a level 2 in the C4 model approach [11].
• Strategies – existing guiding policies that enable us; this is the level we typically create policies on; the challenge here would be to create a clear mapping to the higher levels and create an easily navigable decision tree

The ‘tactics’ level needs some a need some additional translation in an IT Risk Management context:

• Tactics – actions we can take; this should be a collection of actions that provide actual guidance and inspire teams in designing solutions. Again, we can learn from architecture by adopting the ideas behind Architectural Decision Records (ADR) [13]. An ADR database acts as a historical knowledge bank that provides context on how to apply existing strategies and tactics. (It might even be worth investigating if risk decisions can be part of an ADR, as a risk decision is some form of architectural decision.) When taking this approach, it is important to add a ‘time of recording’ and define the ‘trigger to revisit this decision’ to prevent ending up with slow, bureaucratic, and unmaintainable spaghetti policies.

The evidence level is, again, a level we should be able to deconstruct from what we have. However, by combining and implementing it in the TASTE model, it immediately provides examples for validation and testing of the chosen tactics.

• Evidence – the outcomes that measure progress;

By creating a risk appetite in the form of the TASTE framework you can give direction to teams, provide them guidance on how to test their solutions, while at the same time create a historical database of successful and unsuccessful approaches.