Communicating IT Risks to Stakeholders By Abdulaziz Ahmed Al-Duaij Manager, Information Technology, KNPC

Agenda: 1. What is Risk 2. What is an IT Risk 3. IT Risk Communication 4. Recognizing a Challenge 5. Three Keys to Success 6. Four IT Risk Communication Strategies 7. Q & A

What is Risk ? Risk is a natural part of the business landscape. If left unmanaged …

What is an IT Risk ? Too often overlooked, IT Risk is a business risk, related to the use of IT. Measure of an IT risk: Product of threat, vulnerability and asset values IT Risk = Threat x Vulnerability x Asset Value http://it-risk-management.com/

What is an IT Risk ? A more current Risk management framework for IT Risk would be the TIK framework IT Risk = (Threat x Vulnerability/ Countermeasure) x (Asset Value at Risk) http://it-risk-management.com/

Risk Communication Communicating Risk to Stakeholders is the Top Task for Today's Risk Managers {Reveals a study by The Global Association of Risk Professionals (GARP)}. https://www.prnewswire.com/news-releases/communicating-risk-to-stakeholders-is-the-top-task-for-todays-risk-managers-300039598.html

Recognizing Challenges Even though stakeholders may be familiar with the risk assessment process, stakeholders often have different perspectives on the significance of the findings of the risk assessment and appropriate risk management actions. Risk perception involves the influence of subjective factors on how risks are understood and valued - USEPA’s Risk Communication Handbook (USEPA 2007e). Risk communications must not underestimate the importance and validity of risk perception. For example, while odors may present no physical risk, failure to address them in a timely manner may elevate other concerns about the credibility of the cleanup. The assessment and reduction, removal, or control of chemicals in environmental media. Cleanup is synonymous with other terms such as "corrective action" and "remediation" used in various state, local, and federal programs. process.

Key 1 : Communicate Early Three Keys to Success: Key 1 : Communicate Early “Communicate Early and Communicate too often” - Steve Cullum Early discussions with stakeholders help to identify potential areas of concern and enables stakeholders to take early actions to address those concerns, before they turn into crises. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/60907/communicating-risk-guidance.pdf

Key 2 : Be transparent Three Keys to Success: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/60907/communicating-risk-guidance.pdf

Key 3 : Collaborate Three Keys to Success: Avoid - I, me, mine Avoid negatives: “I can’t,” “I won’t,” … Keep referring to a common goal: – e.g. “In the interest of our Company… Encourage others to share their opinion Recognize people Engaging stakeholders in an inclusive relation of collaboration ensures that the decisions made incorporate stakeholders’ views and experience. This creates a firm ground to base decisions on sound evidence and analysis, which in turn leads to better and more focused decisions. https://www.fastcompany.com/40546622/these-5-speaking-habits-make-people-want-to-collaborate-with-you

The 80–20 Principle: Engaging stakeholders in an inclusive relation of collaboration ensures that the decisions made incorporate stakeholders’ views and experience. This creates a firm ground to base decisions on sound evidence and analysis, which in turn leads to better and more focused decisions. https://www.fastcompany.com/40546622/these-5-speaking-habits-make-people-want-to-collaborate-with-you

Four Risk Communication Strategies: Strategy-1: Expert hearings Opinions from experts with differing positions Experts with different positions are asked to give their opinion about an issue to a representatives of the organizing institution (often a regulatory agency). Specific questions are asked to each of the experts and once every expert has had a chance to give an answer the organizing committee can try to reach a conclusion on the subject. Hearings are a good way of developing understanding about an issue but may not always allow for a conclusion or final decision to be reached.

Four Risk Communication Strategies: Strategy-2: Expert Committees: Bringing experts together Bringing experts together in commissions, advisory boards or committees can be a good way to gather expert opinion.  These group seetings allow the experts to talk openly about the issues in a manner that is independent from the organization that they report to.  Disadvantages are that it may take a long time to reach a consensus and that the public opinion has not been consulted. 

Four Risk Communication Strategies: Strategy-3: Stakeholder hearings Understanding both from the stakeholder's point of view and that of the organization Stakeholder opinions can be gathered through hearings during which time information can be shared and positions on the issues are better understood both from the stakeholder's point of view and that of the project organization. Hearings should be seen as a means of gathering information not resolving conflict.  Often hearings can lead to heated debates so do not expect to end the hearing with solutions.

Four Risk Communication Strategies: Strategy-4: Round tables (advisory groups): Bring a variety of stakeholder groups together in a working atmosphere Round Tables are used to bring together a variety of stakeholder groups together in a working atmosphere.  Unlike a hearing the groups aim to share perspectives and come to conclusions about management options.  Because heated debates are common in these settings it is useful to have a moderator, or someone to control the atmosphere, and direct the debates in a productive manner.  The moderator needs to be someone with no direct interest in the outcome.

Have a Strategy Communicate Early Be Transparent Collaborate Conclusion: Have a Strategy Communicate Early Be Transparent Collaborate

Conclusion: Thank You

Conclusion: Q & A