Risk assessment

3 posts

Itâs a normal workday, and then suddenly the fire alarm goes off in the back of the server room. Amidst the chaos, do the IT staff know what theyâre supposed to do besides call 911 and make sure everyone is safe? A comprehensive IT disaster recovery (DR) plan is your playbook. It defines the IT infrastructure and how to restore and resume critical IT functions minimizing the impact on the business including downtime, data loss, and reputational damage.

Start by performing a risk assessment identifying key threats and vulnerabilities to your IT infrastructure including hardware/software failure, cyberattacks, natural disasters, and major power outages. What is the likelihood of each incident and the subsequent impact (enterprise-wide, regional, department-specific, etc.) for your organization? Now you can prioritize your recovery efforts accordingly.

Next, create a comprehensive DR plan that includes the who, what, where, when, why, and how details. For example:

Who = What are the main roles and responsibilities including identifying any essential IT staff? For example, did you have any IT staff turnover? Youâll need to notify stakeholders such as management, vendors, and suppliers so you need the correct contact information.
What = Which systems are mission critical, essential, and non-essential? Criticality will define the order of recovery and ensure that the most critical systems are restored first.
Where = Do you have global data centers or IaaS? A hot site or an alternate cloud-based infrastructure for temporary operations?
How = Step-by-step procedures for recovering systems, identifying which processes need to be done in a specific order.

Backup And Recovery Strategy

âYou need a solid backup and recovery strategy. Perform regular backups including software, configurations, and data. Backups can be onsite, offsite, cloud-based, or a combination depending on the business needs. For mission-critical systems, it may be beneficial to implement redundancy (e.g., deploying backup systems, or redundant hardware) to minimize the impact of an incident.

The IT environment and the business are continually changing so the DR plan needs to be kept current too. Make sure you regularly review, update, and refine the plan to make sure it reflects any changes in your environment. Did you implement a new ERP system or relocate your data center? Or did you have any technology changes that improve the recovery process or enhance the resilience of your systems? If so, you should take the time to update your DR plan.

Testing Your DR Plan

Business meeting to talk about disaster recovery plan

Make sure you regularly test the DR plan which will validate recovery procedures, identify gaps, and ensure data such as stakeholder contact information is correct. There are multiple ways to test including tabletop and scenario-based simulation. Tabletops are good, but simulations including recovery are better. Itâs key to test on a regular basis...with the business (that takes your plan to the next level)! The frequency of your testing may vary depending on the criticality of the systems or any regulatory requirements so stay up to date with any regulation changes that may impact your DR plan requirements. Make sure you document lessons learned (including from any actual incidents) so that you can identify any areas for improvement.

Itâs critical to ensure your DR plan is aligned with the business continuity plan. Within the DR plan, there should be a communication component. When an incident occurs, you need protocols to notify and continually update the stakeholders so that they can respond appropriately.

Encourage a culture of continuous improvement. Encourage and solicit feedback for the DR plan. Although IT is responsible for disaster recovery, it affects the entire business continuity plan. Have a comprehensive and current DR plan that aligns with the business needs, and which is tested regularly. It enhances your readiness for the next disaster and minimizes the impact of disruptions to your IT infrastructure as well as minimizing the impact of potential disruptions.

For more information on taking your DR plan from good to great, follow me on LinkedIn!

Acquiring Job Advance Your Career Career Changing Careers and Employment Education Internship

Is Your IT Disaster Recovery Plan Good …

I was recently working with a midsize business owner/CEO who wanted to know if I thought we were headed to a recession or if what he was hearing on his favorite news show was true about how it wasnât true and I said...

âTIME OUT."

They looked at me and it was silent for a few seconds, and I said, would you be open to a discussion about something? They said of course! I said, âWhat really is the #1 thing on your mind that we should be really talking about?â The person looked away, took a deep breath, and said, âI am really stuck trying to decide where to prioritize my organization given all the uncertainty I am hearing about.â They then rattled off several ideas that all sounded like great ideas to pursue to grow and the individual was very excited and passionate about all of them. They then shared all the risks of changing but they know they need to.

Sound familiar? It led us down a whole different path that ultimately uncovered what so many leaders struggle with when there is so much uncertainty.

When it comes to small to midsized business owners/CEOs, there are typically three reasons I see that lead to them stalling out in their growth.

Reasons Why CEOs Get Stuck In Their Businesses

CEO/businesswoman leads a meeting at work

A. They are paralyzed and work to rationalize why they have not changed anything they are doing, knowing that they need to. I hear things like, âI am too busy,â âDo you know how hard it is to find good help,â âI am still working on sizing the market,â âI think this or that,â âDo I invest, retrench, and just ride it out and hope for the best?â

B. They donât know where/how to begin, or stick to what they know. This often explains why they use the phrases above as excuses for not moving forward.

C. FOMO (fear of missing out). If they were to prioritize they could miss out on something else so they keep all options open and see what happens.

The problem with all three reasons above is they risk creating financial, operational, and emotional issues that ultimately could take the company downâand result in employees losing jobs.

The Costs Of CEO Neglect: Financial, Operational & Emotional

CEO and other executives talk about their business plan during a meeting

When CEOs fail to address their reasons for getting stuck, A LOT can go wrong. Financially and operationally, there are potential revenue and profit declines, market share losses, and higher costs. Emotionally there will be decreased morale, increased stress, decreased trust, and anxiety without a clear vision and an effective communication plan.

FACT: The #1 mistake that small and midsize business owners make during uncertain times is failing to adapt quickly enough to changes in the market or consumer behavior.

This can manifest in a few different ways:

Sticking with the status quo: Some business owners may be reluctant to change their business models or processes, even when it becomes clear that the old way of doing things is no longer effective.

Clinging to familiar methods or routines: Usually, out of fear of the unknown, even as the business suffers.

Cutting too many corners: Conversely, other business owners may panic and overreact to uncertain conditions by making drastic cuts across the board.

Trying to save money in the wrong places: They may lay off too many employees, reduce marketing and advertising budgets, or stop investing in new products or services altogether.

Failing to communicate effectively: During times of uncertainty, it's crucial for business owners to communicate clearly and frequently with employees, customers, and other stakeholders.

Hesitating to share bad news or admit to uncertainty: Holding back on the truth can lead to confusion, mistrust, and frustration.

Over-communicating: Sharing too much or too vaguely may also create confusion and uncertainty.

The decisions above may provide some immediate relief, but they can hurt the long-term health of the business.

How CEOs Can Properly Assess Business Opportunities & Challenges

CEO shakes hands with another executive during a meeting

Here are ideas on how to assess the various opportunities and challenges you are facing:

Conduct a risk assessment: A risk assessment can help you identify potential risks and opportunities that could impact your business. You can do this by analyzing your business processes, reviewing your financial statements, identifying potential legal or regulatory issues, and assessing your competition. Once you have identified these risks, you can prioritize them based on their likelihood and potential impact on your business. Solidify your current business foundation first and foremost!
Develop a strategic plan: A strategic plan can help you prioritize opportunities that align with your business goals and objectives. This plan should outline the steps you need to take to achieve your goals, including the resources required and timelines for completion. By prioritizing your opportunities, you can focus on those that have the most potential to drive growth and profitability.
Seek expert advice: As a business owner/CEO, you may not have all the expertise required to identify and prioritize risks and opportunities. Seeking advice from experts such as consultants, lawyers, accountants, or industry peers can provide valuable insights and help you prioritize your risks and opportunities effectively. Joining peer advisory groups to bring outside perspectives in a confidential/safe place can confirm your decisions, catch risks you didnât see, and/or provide new ideas for you to consider.

In summary, having a solid business foundation is crucial for a CEO before pursuing new products or services because it ensures they have a clear understanding of the market, and provides financial stability, operational efficiency, risk management, and strategic planning abilities.

Overall, prioritization is essential for small/midsize business owners to effectively manage their workload and achieve their goals. It's important to identify any barriers to prioritization and work to overcome them to ensure that tasks are completed in a timely and efficient manner.

If you want to connect with me to discuss further or provide other insights please let me know at [email protected] or connect with me on LinkedIn.

Acquiring Job Advance Your Career Career Changing Careers and Employment Education Internship

3 (Hidden) Costs Of CEO Neglect

4 Critical Components To Risk Management Success

I spoke to a senior business leader who talked about how the thoughts of navigating the risks associated with some of the business processes he currently manages keep him awake. He leads the segment of his company that coordinates customers' activities, mobile transactions, and e-commerce payments. Some of the reasons why he was worried were:

Possibility of a hacker compromising customer data for spam or identity theft
The fear that a customer data breach will result in a reputational damage
Concern that someone might use a stolen card to make an online purchase
Thoughts of an employee mistakenly sending confidential data to a wrong email

Addressing all these concerns requires a risk management strategy. An effective risk management strategy is extremely important to mitigate potential risks that might prevent the achievement of business objectives. A survey from EY showed that 84% of board members do not believe their organizations have a highly effective risk management strategy. Risk management strategy is a vital part of the risk management process, which involves the following steps:

Asset Identification & Prioritization

The first step of the risk management process is to identify the organization's assets, including physical assets, employees, information, and intellectual property. After identification, the assets are prioritized based on criticality. Assets could be classified as high, low, or medium based on their criticality to business operations.

Risk Assessment

This helps to identify, prioritize, and determine how risk is treated. It involves three (3) steps:

Risk Identification - This involves identifying threats and vulnerabilities that place business assets at risk that might impact the achievement of business objectives. Example: What are the threats to data in the data warehouse? What harmful event may cause damage to physical assets? What are the harmful events that could cause danger to company employees at work? What could cause damage to business assets? Is our software susceptible to a malicious cyberattack?
Risk Analysis - Based on information obtained from the risk identification process, the risks are analyzed and prioritized based on the likelihood of a threat's occurrence and impact.
Risk Evaluation - This examination of the risk analysis results and comparison with established risk evaluation criteria to determine whether the risk is acceptable or additional controls are required to manage or mitigate risk.

Risk Management Strategy

This is the third phase of the risk management strategy. It is also known as risk treatment. It is the approach adopted by an organization to address risk. It leverages the information and results from the risk assessment process which includes identification threat, determining their probability of occurring an impact. It varies based on the company's risk appetite.

Risk Transfer - This strategy transfers risk to an external party. It is often adopted when a company cannot mitigate the risk associated with a business activity due to a lack of expertise or other complexities. Risk transfer doesn't discard the risk but transfers the responsibility of risk treatment to another party. An example is hedging an exchange rate risk through a derivative control or outsourcing a software development project to an IT company.
Risk Acceptance - This is also known as risk retention. It applies when an organization is aware that risk related to a business activity is known and accepted because it is unlikely to occur or is within the company's risk appetite. An example is when a company decides to limit resources allocated to perform review checks for transactions below a set threshold because the probability of fraud occurrence is low.
Risk Reduction - This is also known as risk mitigation. The strategy attempts to prevent a risk occurrence by implementing a control to mitigate the risk. An example is a company implementing a customer feedback mechanism to address customer concerns and avoid customer attrition. Also, human resources can implement an exit interview process to reduce employee turnover.
Risk Avoidance - This strategy eliminates risk from occurring due to costly consequences. It applies where an organization does not engage in a business activity because its associated risk exceeds its risk appetite. An example is when the company considers an opportunity to expand its product line but decides not to continue after analyzing the business plan and discovering that it's too risky and will significantly impact the organization.

Risk Monitoring

The risk management process is an ongoing exercise. After the risk has been identified and analyzed and an appropriate risk treatment strategy has been determined, there is a need to continuously monitor risk by tracking changes in the environment, its impacts on business objectives, and existing risk management strategies. This process will help adjust strategies as required to ensure they are still relevant and effective.

There is no business without risk. Developing and implementing a risk management strategy that allows business executives to identify, address, and monitor risks is crucial to risk management success. Effective risk management creates a healthy environment to achieve business objectives and helps business leaders identify opportunities and actions they need to take.

If you're interested in learning more about how risk management can help achieve your business goals or have any questions, please feel free to follow/connect with me on LinkedIn.

Acquiring Job Advance Your Career Career Changing Careers and Employment Education Internship