Brief

Symantec IT Risk Management survey

Anil Chakravarthy

With 400 professionals participating from sectors as varied as healthcare to telecommunications to banking and financial services, Symantec Corp’s IT Risk Management Report Vol II, identifies key issues and trends, and analyzes and dispels certain myths. “Now in its second year, the IT Risk Management Report provides IT professionals and C-level executives with unparalleled insight into the discipline of IT risk management—ranging from understanding what’s working and what’s not to providing actionable guidance and best practices for effective program execution. Better understanding of the practice of IT risk management empowers organizations to take calculated risks with confidence and use IT to drive competitive advantage,” said Anil Chakravarthy, VP Worldwide—Enterprise Services, Symantec Corporation.

It revealed the growing importance of managing IT risks amidst several myths that persist. While the report is aimed at assisting the IT risk practitioners towards a continued successful implementation of risk management programmes, it dispels four myths that are commonly associated with IT risk management that it is focused only on IT security, it is project driven, it has already become a formal discipline and technology alone can manage IT risk.

IT risk now is looked at beyond just the security issue; availability, security, compliance and performance being the other concerns in hand. Since 63% of the major IT organizations expected a failure once a year and 69% of the minor companies expected failure at least ten times a year, data loss had a serious impact on the business, which was linked with poor performing control, data asset classification, inventory and management. The report also shed light that while technology has a critical role to play in mitigating risks, people and processes supported by technology determined the effectiveness of an IT risk management programme; lack of training and awareness and ineffective physical and environmental management being the giveaway in this area. Lastly, IT risk management has moved being IT centric to being business centric. The guiding principles are assessing the risk and its scope, creating a culture of awareness, developing people through training and education and then giving the programme time to mature.

Deploying a third party for guidance and assessment, centralizing the responsibilities and giving a clear ownership helps develop and execute an IT risk management programme effectively.