1. kpmg Information Risk Management IT Governance & Risk Management A paradigm of the relationship between Information Risk Management and IT Governance Graham Blain Partner, KPMG Information Risk Management

2. kpmg Information Risk Management Presentation Road Map 1st IT Governance vs Risk Management? 3 rd Roles of Audit and Management 2nd Risk Management & Process Maturity

3. kpmg Information Risk Management IT Governance and Information Risk Management are synonymous… from a certain point of view! Risk is “the chance of something happening that will have an impact on objectives” (AS/NZS 4360) Risk management is “the culture, processes and structure which come together to optimise the management of potential opportunities and adverse threats” (AS/NZS 4360) IT Governance is “A management framework which ensures the delivery of expected benefits of IT in a controlled manner” (Poole V) 1st IT Governance vs Risk Management?

4. kpmg Information Risk Management Risk Management can be practically applied as a comprehensive Governance approach… Risks should be stated in terms of organisational objectives Treatment of risks should comprise a combination of structure, processes, projects and specific actions In the long term, appropriate structure and process maturity should be the goal

5. kpmg Information Risk Management A suggested distinction between inherent and residual risk… Inherent Risk is the chance of something happening that will have an impact on objectives in the absence of structure and processes to optimise opportunities and threats Residual Risk is the chance of something happening that will have an impact on objectives despite the structure and processes that are in place to optimise opportunities and threats 2nd Risk Management and Process Maturity

6. kpmg Information Risk Management There is a relationship between inherent risk, process maturity and residual risk

7. kpmg Information Risk Management The Seven Inherent Risks

8. kpmg Information Risk Management The relationships between inherent risk and targeted process maturity

9. kpmg Information Risk Management The focus of IT Management, Risk Management, Internal and External audit in IT Governance Internal Audit IT Management Risk Management External Audit review Internal Audit’s work 3rd Roles of Audit and Management

10. kpmg Information Risk Management Conclusions Information Risk Management and IT Governance can be considered synonymous, depending on your point of view and approach Process maturity improvement programmes can (and should?) be driven from a risk management based approach Focus of relevant parties should be as follows: -IT Management on High Residual Risks -Internal Audit on Mature Processes -Risk Management on the Risk Management Process -External Audit on Internal Audit’s work

11. kpmg Information Risk Management A car has brakes to allow it to go faster…

12. kpmg Information Risk Management IT Governance (Information Risk Management) Graham Blain Partner kpmg Information Risk Management 85 Empire Road, Parktown (011) 647 7853 graham.blain@kpmg.co.za