Introduction to Risk Management

Introduction to Risk Management 26 September 2014 Peter Fowler CPPD

“There are “known knowns”. [These are things we know that we know.] There are “known unknowns”. [That is to say, there are things that we know we don't know.] But there are also “unknown unknowns”. [There are things we don't know we don't know.]” Donald Rumsfeld (Feb 12, 2002)

“The major difference between a thing that might go wrong and a thing that cannot possibly go wrong is that when a thing that cannot possibly go wrong goes wrong it usually turns out to be impossible to get at or repair.” Douglas Adams in Mostly Harmless (the fifth book in the Hitchhiker's Guide to the Galaxy trilogy)

Risk Management Definitions • Uncertainty - changing circumstances or situation • Risk - effect of uncertainty on objectives • Opportunity - the positive impact on objectives • Issue - an event that has happened or will happen

Types of Risk Management • Safety risk management • Insurance risk management • Financial (Investment) risk management • Project risk management • Business risk management • Information risk management

Tasmanian Government Information Security Policy 1. Purpose The purpose of the Policy is to provide a consistent approach to managing information security risks across Government.

2. Scope This Policy applies to Tasmanian Government agencies as custodians of information on behalf of the Crown. 3. Policy Principles This Policy is based upon the following information security policy principles: • Availability: information is accessible and usable to authorised entities. • Integrity: the accuracy and completeness of information is protected.

• Confidentiality: information is not made available or disclosed to unauthorised individuals, entities or processes. • Proportionality: measures to protect information are relative to the risk of loss or failure of availability, integrity and confidentiality.

Tasmanian Government Information Security Policy Manual • Information security risks are threats or vulnerabilities that introduce uncertainty regarding the availability, confidentiality or integrity of information. • Structured risk assessments help to prioritise risks and implement appropriate risk management procedures. • Information security risk management can be undertaken as part of a broader agency risk management approach. • Each agency MUST identify, quantify and prioritise risks against risk acceptance criteria and determine appropriate controls to protect against risks.

After completing a risk assessment there may be residual information security risks where the agency has: • elected to accept a risk by doing nothing, or • adopted a mitigation strategy that does not completely eliminate a risk.

Process from AS/NZS ISO 31000: 2009

Common failures when managing risks • Not establishing the context: • Misunderstand organisational attitudes and risk appetite

• Risk attitude. Organization's approach to assess and eventually pursue, retain, take or turn away from risk • Risk appetite. The amount and type of risk that an organisation is willing to pursue or retain Source: ISO GUIDE 73: 2009 Risk management — Vocabulary

Common failures when managing risks • Not establishing the context: • Misunderstand organisational attitudes and risk appetite • Not focussing on the appropriate risks (business efficiency vs information security)

• Business efficiency risk – Information cannot be located quickly as a result of poor categorisation resulting in more time/ resources required to find records. • Information security risk. Information cannot be located as a result of poor file categorisation resulting in not finding important records.

Common failures when managing risks • Consequence – If the event occurs what will the consequence be: • Not establishing the context: • Critical • High •• Misunderstand organisational attitudes and risk appetite Medium But what do these terms mean? Lowfocussing on the appropriate risks (business efficiency vs information •• Not • security Very low

• Likelihood - What is the likelihood that the event will occur and result Inappropriate measures used for the analysis in• the consequence indicated: • • • • •

Almost certain Likely As likely as not Possible unlikely

But what do these terms mean?

Common failures when managing risks 1.• Not Inappropriate categorisation establishingfile the context: 2. Cannot find board meeting minutes

• Misunderstand organisational attitudes and risk appetite

State the full story: What could happen, why could it happen (cause) Not focussing on result the appropriate risks (business efficiency vs information and •what would the be security “Board meeting minutes cannot be located as a result of poor file categorisation resulting in disputed decisions • Inappropriate measures used for the analysis having to be reversed”

• Generalisation of risk statements (leads to misunderstanding)

Common failures when managing risks 1.• Not Ensure establishing board meeting the context: minutes are categorised appropriately • Misunderstand organisational attitudes and risk incorrectly appetite Would that stop people categorising • Not focussing on the appropriate risks (business efficiency vs information 2. Provide securitytraining for staff on board meeting minute categorisation

Only appropriate if not already • Inappropriate measures used for the analysisbeing done!

• Generalisation of risk statements (leads to misunderstanding) • Fake treatment (either won’t mean anything or not followed through)

Questions?

Introduction to Risk Management 26 September 2014 Peter Fowler CPPD