February 25, 2019
- Gartner client? Log in for personalized search results.
Digital Business Requires Integrated Risk Management
Contributor: Katie Costello
Risk management programs must address a widening array of IT threats associated with digital business.
In 2019, organizational risks are turning into significant operational surprises, and the frequency will only increase as digital business requirements grow. There is no longer room for siloed risk management programs. Instead, security leaders must focus on building integrated risk management programs.
“ Risk management programs mitigate the impact of uncertainty on business performance”
“Risk management programs mitigate the impact of uncertainty on business performance,” says John A. Wheeler, senior director analyst, Gartner. “By 2021, more than 50% of large enterprises will use an integrated risk management solution set to provide better decision-making capabilities, up from approximately 30% today.”
What is integrated risk management?
Many organizations are good at domain-specific risk management, but struggle to harmonize the three key pillars of a successful security and risk management program — a strong framework, a solid set of metrics and flexible, integrated systems. Integrated risk management can remedy this challenge. Integrated risk management improves decision making and performance through an integrated view of how well an organization manages its unique set of risks. It’s a set of practices and processes supported by a risk-aware culture and enabling technologies.
Integrated risk management uses a holistic analysis of internal and external risk factors. Successful organizations design a framework that seamlessly connects risks at the strategic, operational and IT levels. “To understand the full scope of risk, organizations require a comprehensive view across all business units and risk management functions, as well as key business partners, suppliers and outsourced entities,” says Wheeler.
Why is integrated risk management important?
The integrated risk management solutions market (including consulting services and implementation) will grow to $8 billion by 2021. Digital organizations are prioritizing the need for risk management programs. “Security and risk management leaders need to evolve their risk thinking to a global context,” says Wheeler. “Implementing an integrated risk management solution to meet the demands of digital transformation will move their organization forward in a safe, profitable way.”
Where do I start with integrated risk management?
Integrated risk management can be compared to a road trip: Your GPS maps the route and shows progress, while the vehicle enables you to reach your destination. Similarly, an integrated risk management framework maps an organization’s risk, metrics measure progress and systems drive an organization to meet their goals. Security and risk management leaders can take these four steps to develop an integrated risk management program to bridge the gap between enterprise risk, IT/cybersecurity risk and digital risk for a more overall view of operational risk:
- Develop an effective framework that is unique to the organization’s risk profile.
- Employ metrics to identify how risk influences the behavior and ability of individuals to achieve the organization’s goals.
- Use a pace-layering methodology to design, implement and integrate risk management systems.
- Grow the maturity of an organization’s risk management disciplines to mitigate future digital business risks.
This article has been updated from the original, published on June 13, 2017, to reflect current conditions and research.
Experience Information Technology conferences
Join your peers for the unveiling of the latest insights at Gartner conferences.
Recommended resources for Gartner clients*:
Gartner clients can learn more about the state of risk management in Top 10 Factors for Integrated Risk Management Success by John A. Wheeler.
*Note that some documents may not be available to all Gartner clients.
