Category Archives: Reputation Risk

Want to scan your crypto wallet for risks? Check: AML crypto BTC, USDT, ETH. Checking cryptocurrency wallets for dirty money.

Seven Qualities of an Impactful Risk Register

Posted on by

You might have resolved to tidy up some processes and press the “reset” button on your risk register in the new year. Whether you’ve started a new position, want to improve your company’s operations or just overhaul your existing register, the basic foundations are out there.

Demonstrating their altruistic nature, many RIMS members have been offering their insight to those seeking suggestions – even going so far as to send their Excel sheet registers. Here are some criteria for your X and Y axes, culled from the OPIS network and existing resources on Risk Knowledge. While they are by no means a finite list, they can act as building blocks for your new template or register.

buy keflex online desiredsmiles.com/wp-content/uploads/2023/10/keflex.html no prescription pharmacy

  1. Exposure. Define the imminent or possible risk event.
    buy lipitor online desiredsmiles.com/wp-content/uploads/2023/10/lipitor.html no prescription pharmacy

    Examples could be a data breach or earthquake.

  2. Risk Category. Itemize by who or what was affected by the exposure. Employees, property, locations, and systems are some examples.
    buy trazodone online desiredsmiles.com/wp-content/uploads/2023/10/trazodone.html no prescription pharmacy

    If the exposure was public-facing, be sure to include your customers and shareholders.

  3. Cause of Loss. In addition to simply entering the risk origin, also detail whether it was on the radar or completely unforeseen. You might choose to add subcategory (or row) if necessary to document the specifics.
  4. Consequences (Primary and secondary). While many exposures impact the bottom line, it might also include damages to systems, infrastructure, and absences. There are other consequences that are tougher to quantify, such as reputation and employee morale. Subcategories for secondary (and tertiary, and possibly beyond) might be necessary.
  5. Target Risk Level. Driven by each company’s risk appetite level, the target risk level should be the mitigated level. “For example, risk appetite for strategic can be 4 (out of 5), operations 3 and safety 2,” wrote one member on an OPIS thread. “Therefore, any risk should be mitigated to the acceptable risk appetite level within each risk category – hence, a safety risk of 4 needs to be mitigated to a 2 level.”
  6. Expected Losses and Gains. Establish value to the projected outcome. There is certainly a downside risk to natural disasters, particularly where injuries, casualties, and property damage are concerned. But not all risks will be negative; selecting a new cybersecurity system, for example, may have costs but also estimated savings.
  7. Assignee. Just because you are the risk manager does not mean you are responsible for solving all the problems or having all the answers to each risk. A data breach would typically be assigned to the IT leader. However, depending on the size and structure of your organization, you might be the de facto authority on certain exposures, such as emergency preparedness and natural disasters. In those cases, enter your own name and get ready to act.

As stated earlier, these qualities are just starting points as you build your register – you should customize it to your organization and personal preferences.

When reflecting upon the makings of the risk register, one member said that the most critical issue was not the format, but rather “the dialogue that surrounds the register,” adding that “the discovery and discussions were what made that part of the ERM activity useful. Of course, having a nice means of communicating it makes it easier to focus the dialogue.”

RIMS also offers suggestions for ERM programs. Visit the OPIS network to get feedback from members and Risk Knowledge for resources such as the ERM Starter Risk Log Template.

Q&A With New National Cyber Security Alliance Executive Director Kelvin Coleman

Posted on by

The National Cyber Security Alliance (NCSA) announced that its new executive director is Kelvin Coleman, who has held high-level positions in the United States Department of Homeland Security, and the National Security Council.

Coleman’s appointment puts him in charge of the country’s leading cybersecurity and privacy protection education and awareness organization, responsible for leading organizational growth; facilitating strategic partnerships and alliances with government, industry and non-profits; and acting as NCSA’s primary spokesperson.

He discussed with Risk Management Monitor the types of cyberrisks he follows, preventative measures and upcoming NCSA events and services.

What are the biggest cyberrisks facing businesses today? How do you plan to advise or collaborate with business leaders to combat them?

buy azithromycin online metabolicleader.com/p7pmm/img/jpg/azithromycin.html no prescription pharmacy

Some of the biggest cyberrisks facing businesses today include email threats, employee activity and vendor security. When it comes down to addressing cyberrisks targeting businesses of varying sizes, everyone needs to start with the basics. It is imperative to get leadership on board with recognizing that cyber resilience is more than just taking technology-focused measures, but also modifying processes and behaviors at all levels in the organization.

What are the attacks that are easiest or most difficult to prevent?

The answer to both is phishing. Attacks come in through three different ways – people, products, and processes. A great product can hold attackers at bay. Similarly, great processes can mitigate a threat. Human beings are the wild cards. People are both the easiest to control and the most difficult, especially when it comes to phishing attacks. One of the NCSA’s tips is “when in doubt, throw it out.” We try to make sure folks understand that if they are not familiar with a link or a website, they need to delete it or ignore it.

At NCSA, our focus is on the human side of cyberattacks, and we work to get people to change their behaviors as well as understand the processes for keeping their devices and online accounts safe, particularly as phishing attacks become more sophisticated.

Speaking of the human side, which professionals are most exposed to cyberrisk?

All of them. Cybersecurity needs to be embedded into the company culture from the most entry-level positions to the most senior, because hackers can access information at any level. We’re all vulnerable, from the break room to the boardroom. We often tell small business owners that they must also train their employees to recognize malicious links and emails, as employees can often be the weakest link when it comes to cybersecurity at the office.

What is your reaction when you learn that the information of 500 million Marriott guests may have been exposed?

Marriott is a great example of a company doing as much as it can to prevent an attack but still being targeted. They were not laissez-faire about their security. So, I see it as a warning for everyone to remain extremely vigilant in the face of increasing numbers of cyber attacks. If it happens to Marriott, we’re all vulnerable to an attack of this nature.

Small businesses seem just as susceptible to cyberrisk as large ones. How would you advise small businesses to protect themselves?

buy diflucan online metabolicleader.com/p7pmm/img/jpg/diflucan.html no prescription pharmacy

Small businesses are more at risk and they often have information, such as customer data, that’s just as valuable to hackers as that of the customer data from large corporations. Small businesses often don’t have the resources to invest in a prevention plan, nor do they have the capital or leadership or knowledge about cybersecurity. This is why they’re often targets for hackers.

Our advice for small businesses doesn’t vary much from what we advise to all people: Keep a clean machine by keeping software updated, use stronger authentication and passwords, recognize and avoid phishing links, etc. If [a small business] decides to hire a third-party vendor for cybersecurity, we advise them to do their research and hire a reputable vendor. We also encourage them to attend our regional CyberSecure My Business events in their local community, or take part in a CyberSecure My Business webinar.

What new initiatives or campaigns will you be overseeing for in 2019?

In 2019, our overarching goal is to empower individuals and – at the same time– focus on educating businesses to respect privacy, safeguard data and enable trust. This means that consumers need to know how organizations collect and use personal information and companies of all sizes need to be transparent and communicate in an accurate and consumer-friendly language to their customer base.

buy keflex online metabolicleader.com/p7pmm/img/jpg/keflex.html no prescription pharmacy

We will share key messaging and provide actionable tips to help protect privacy. NCSA and our highly engaged partners will host numerous events that will shine a spotlight on the rapidly changing technology landscape and forging ahead toward the future of privacy. We plan to engage industry leaders with diverse perspectives to address opportunities and challenges. In addition, we will soon be launching our Champions program which is a way for both individuals and businesses to officially show support. We expect to launch the Champions portal – along with additional Data Privacy Day information – in mid-December 2018.

What changes or improvements are in store for National Cyber Security Awareness Month (NCSAM)?

I don’t believe NCSAM needs a shiny new toy each year. Our plan is to engage a much larger audience. NCSAM continues to reach more and more people every year, but there are still significant numbers of Americans who need to hear our message – not just during October but throughout the year. We want to connect these folks more with our proven tips for staying safe and secure online. Our goal at NCSA is reinforcing our cybersecurity best practices among a broader audience to better impact online behavior.

RIMS ERM 2018: Earning the ‘Mandate’ and a ‘Seat at the Table’

Posted on by

MONTREAL – More than 300 risk management professionals and students attended the 2018 RIMS ERM Conference on Monday and Tuesday in an effort to gain insight from, and network with, the industry’s enterprise risk management leaders. Wisdom, data, and motivation within the ERM space were on tap during all the sessions and workshops.

buy proscar online sinusys.com/email/img/jpg/proscar.html no prescription pharmacy

On October 29, Martin Vilsoe, partner of the Implement Consulting Group, opened the two-day event by highlighting the importance of ERM’s worldwide capabilities and how to operationalize the best ERM practices. Vilsoe said that risk managers need to “earn the mandate” to work with ERM, and focused on the idea that risks can equal opportunities.

He said that ultimately the risk manager’s job when implementing an ERM framework is to “enable brave decisions” and to maintain an organization’s best direction. With a visual aid of a freighter and individual boats in an ocean, he rhetorically asked: “Is your framework similar to a supertanker or 15-speed boats going in separate directions?”

He also spoke to the importance of risk management’s value to an organization without the sole reliance on analytics.

“Risk management’s purpose is to show value. If it is about value, then we better bring it,” he said. “We don’t always communicate that. There’s a big difference between calculating and measuring value versus communicating value. You can do it without having complete proof – you shouldn’t lie to people, but you should tell them you’re doing something great for the organization.

buy addyi online sinusys.com/email/img/jpg/addyi.html no prescription pharmacy

”

He encouraged the audience to consider their current roles as a consultant – and the importance of “winning customers” in this alternate role. This involves some sales prowess, he said, and the ability to tell a core story or narrative that describes what you do to engage with stakeholders. Build a core story around the ERM program and send different messages to different stakeholders around your core story.

“I don’t see enough of this in risk management programs because of the idea that it is ‘too big,’ or ‘I can’t communicate it,’” he said. “You can do it. We have to move past that mentality.

buy chloroquine online sinusys.com/email/img/jpg/chloroquine.html no prescription pharmacy

“The misconceptions is that risk management is about IT systems. And if you’re thinking as a risk consultant, be aware that putting stuff in systems will not help you manage your risks. Your ability to facilitate awareness, promote decisions and execute them, will.”

Day 2

Dovetailing on the idea that risks can become opportunities, October 30 opened with “Advancing Risk Management: Having A Seat At The Table,” presented by Laura Cisi, the Clorox Company’s vice president of global risk management, and Soraya Wright, founder and CEO of SMW Risk Management Consulting LLC.

In a fireside chat-style setting, the duo used Clorox – a 105-year-old company – as a case study to demonstrate the effectiveness of its ERM initiatives.

A 25-year veteran of the risk management industry, Cisi has been with Clorox for the past four years and said her ERM initiatives evolved from being viewed as the “insurance department” to a “strategic business partner,” with Wright’s collaboration with Cisi’s team to take the company on its ERM journey.

The duo said its ERM framework was built on routines, which provide “an outline that enabled us to use [it] to use as a tool,” for decision-making and assessing its critical risks as well, such as embracing a change in its formula during the manufacturing process.

“We decided to convert from chlorine to high-strength bleach,” Cisi said. “That risk bubbled up through our ERM committee and the actions that needed to be taken, and the methodology behind that came up through ERM.”

ERM was also a key influence when assessing the decision in 2014 to close Clorox Venezuela and cease operations in the country. “‘Should we be the first to exit?’” was the question on stakeholders’ minds for a long time before they discontinued operations, Cisi said. The company was required to sell more than two-thirds of its products at prices frozen by the Venezuelan government. As a result, Clorox Venezuela had been selling its products at a loss, causing ongoing operating losses despite attempts to reach a pragmatic solution with the country’s government. “Looking back, it was a good decision.”

Ultimately, the risk manager’s seat is one of many at a table occupied by executives, stakeholders and the C-suite. Cisi and Wright advocated not for being the loudest one there – but for bringing sound ideas and options. And perhaps coincidentally, Cisi and Wright’s approach seem to be putting Vilsoe’s mantras of engagement and alignment into practice.

“I think every day we get to demonstrate ERM, and not something we just do annually. For example, the ways we engage with product development and business development – we used to be thought of as compliance… and a department that said ‘no,’ Cisi said. “To shift that conversation to create more open engagements where you say ‘I’m your partner and it’s my job to identify these risks. Ultimately, it’s your business decision as to whether or not you go forward with them.”

It was then, she continued, that the risk management department was being consulted on the potential for new products by executives and other groups.

“That was when the conversation shifted from risks to opportunities,” Cisi said, adding, “and that was something they could relate to.”

RIMS members can access the live, uncut audio from “A Seat At The Table” via RIMScast.

An all-access RIMScast episode featuring conference speakers is available here.

Data Breaches Taking Slightly Longer To Detect, Study Finds

Posted on by

Despite rising global awareness of data breaches in various industries, organizations experienced an increase in the number of days to identify a data breach over the last fiscal year. According to a new study conducted by the Ponemon Institute and published by IBM, it takes an average of 197 days for a company to identify a breach – up six days from 2017 – and an average of 69 days to contain it (which also showed a three-day increase from 2017).

“We attribute the increase in days to the growth in the use of IoT devices, extensive use of mobile platforms, increased migration to the cloud and compliance failures,” study authors said in 2018 Cost of Data Breach Study: Impact of Business Continuity Management.

This year’s study included 2,634 employees from 477 companies in 17 industries in 13 countries and two regions. The study found that the average total cost of a data breach in 2018 is .

buy biaxin online imed.isid.org/wp-content/uploads/2023/10/jpg/biaxin.html no prescription pharmacy

86 million; $1.45 million is attributable to the most-costly component, which is lost business cost. The least expensive component is data breach notification at The least expensive component is data breach notification at $0.16 million.

Ponemon also included a framework for measuring the cost of mega breaches, which are breaches involving at least 1 million compromised records. There is also a special analysis of the cost to recover from a data breach.

buy cytotec online imed.isid.org/wp-content/uploads/2023/10/jpg/cytotec.html no prescription pharmacy

Some notable findings include:

  • The average cost per compromised record at the surveyed organizations was $148 in fiscal year 2018, up from $141 in 2017 but down from $158 in 2016.
  • The larger the data breach, the less likely the organization will have another breach in the next 24 months.
    buy robaxin online imed.isid.org/wp-content/uploads/2023/10/jpg/robaxin.html no prescription pharmacy

  • Healthcare organizations took an average of 55 days to detect a breach, but 1,037 days to contain it.

To download IBM’s survey, click here.