Getting Started with Cyber #5- Enterprise Risk

Every organisation makes decisions that carry risk, whether strategic, operational, financial or cyber. When those risks are not identified and understood early, projects and services can develop hidden dependencies, vulnerabilities and assumptions that only become apparent when something goes wrong.

 

Enterprise Risk helps organisations understand what could go wrong, how significant the impact could be, and what they can do about it. This includes deciding how risks should be treated, for example reducing risk through appropriate controls, avoiding activities where the risk is too great, accepting risks that fall within the organisation's risk appetite, or transferring elements of risk to another party through mechanisms such as cyber insurance or specialist service providers. It also involves building organisational resilience through measures such as business continuity and disaster recovery planning, and managing dependencies through third-party and supply-chain risk policies and controls.

 

For business analysts, understanding these approaches helps ensure that requirements, processes and solution options consider not only what the organisation wants to achieve, but also what could prevent it from achieving those outcomes and how those risks should be managed.

 

In this session of Getting Started in Cyber, host Ahila Puvitharan is joined by John Anderson-Kelly, an expert in enterprise risk and organisational resilience. Together, they will explore how Enterprise Risk fits into cybersecurity, including how risks are identified, assessed and prioritised; how organisations decide whether to accept, avoid, reduce or transfer risk; how disaster recovery and third-party risk management support resilience; and how risks are communicated to support informed decision-making.

 

By the end of the session, you will have a practical understanding of how organisations respond to cyber risk, how business analysts can help uncover risks and dependencies early, and how risk-informed analysis contributes to secure, resilient and trustworthy services.

John Anderson-Kelly is Head of IT Security at IFGL Group, an international financial services organisation headquartered in the Isle of Man.With extensive experience in technology and IT leadership across offshore financial services, John now leads IFGL’s approach to cyber security, helping the organisation navigate the rapidly changing world of cyber risk, emerging technology and digital resilience.

 

Working across technology, senior leadership and the Board, his experience includes cyber, technology and enterprise risk, with a focus on turning complex risks into practical business decisions. He is a strong believer that good security and risk management should enable an organisation to move forward confidently, not simply tell it what it cannot do.