IT Governance, Risk, and Compliance (ITGRC)

Businesses rely on their IT departments and resources for competitive advantages and business to business transactions and cannot afford to apply to IT anything less than the same level of commitment they devote company assets. IT offers extraordinary opportunities to transform the business; however IT must deliver value and enable the business, and IT-related risks must be mitigated. Governance of IT, Information Security, and Risk Management encompasses several initiatives for executive management. At a glance, they must be aware of the role and impact of IT on the enterprise, define constraints within which IT professionals should operate and measure performance, understand risk and obtain assurance.

Corporate Governance:

Before discussing Information Technology and Security Governance, one must look at that broader issue of Corporate Governance in the enterprise. Corporate Governance is defined as a structure for determining organizational objectives and monitoring performance to ensure that business objectives are attained. Corporate Governance became a dominant business topic in the wake of many corporate scandals – Enron, WorldCom and Tyco, and is becoming increasing popular today in the wake of TJX credit card breach case. Companies generating interest in corporate governance is not new, but the severity of the financial impacts of the many scandals undermined the confidence of the investment community and corporate stakeholders.

Good corporate governance is important to investors and shareholders. As a matter of fact, many investors, before making an investment decision, validates and ranks the company’s corporate governance on par with its financial indicators. As a matter of fact, some investment firms are prepared to pay large premiums for investments in companies with high governance standards.

Whilst there is no single model of good corporate governance, it is noted that in many countries corporate governance is vested in a supervisory board that is responsible for protecting the rights of the shareholders and stakeholders. The board, in turn, works with a senior management team to implement governance principles that ensure the effectiveness of organizational processes.

IT Governance Role:

IT governance is the responsibility of the board of directors and executive management. It is an integral part of corporate governance and consists of the leadership and organizational structures and processes that ensure that the organization’s Information Technology sustains and extends the organization’s strategies and objectives. Also, IT governance is the term used to describe how those persons responsible for governance of an entity will consider IT in their supervision, monitoring, control and direction of the entity. How IT is applied within the business will have an immense impact on whether the business will attain its vision, mission or strategic goals. In today’s economy, and with most businesses reliance on IT for competitive advantage, businesses simply cannot afford to apply to their Information Technology anything less than the level of commitment they apply to overall governance.

Who is Responsible for IT Governance and Risk Management:

Board of Directors (BODs) and executive management have a joint responsibility to protect shareholder value. This responsibility applies just as stringently to valued information assets as it does to any other asset. BODs and management must recognize that securing information and information assets is not just an investment; it is essential for survival in all cases and for many it guarantees competitive advantage. Additionally BODs and management must accept the responsibility of ensuring that:

• IT Governance is aligned with the overall Corporate Governance structure within the enterprise.
• IT Governance includes an alignment with the Enterprise Risk Management Program, which is a responsibility of the BODs and Management
• There is a balance of the operational and economic costs of protective measures and achieve gains in mission capability by protecting the IT systems and data that support their enterprise’s business strategy and objectives.
• Risks and threats are identified, categorized and mitigated to acceptable levels.
• IT Governance obtains coordinated and integrated action from the top down.
• IT investments are not mismanaged or misdirected.
• IT Governance rules and priorities are established and enforced.
• Trust is demonstrated toward trading partners while exchanging electronic transactions.

In Closing:

IT governance covers a number of activities for the board and for executive management, such as becoming informed of the role and impact of IT on the enterprise, assigning responsibilities, defining constraints within which to operate, measuring performance, managing risk and obtaining assurance.
IT Governance is focuses two categories: (1) IT’s delivery of value to the business and (2) mitigation of IT risks. In order to have an effective IT and Security Governance strategy businesses must address the following questions:

• What decisions must be made to ensure effective management and use of IT?
• Who should make these decisions?
• How will these decisions be made and monitored?

Always remember that managing information security risks as part of operational risk involves establishing an effective IT governance and control architecture.


Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

Best Practices for Performing Risk Assessments

In today’s blog, we will discuss best practices for performing risk assessments.

Assessing business and information risk, in most organizations, are often challenging and performed in silos. This is why risk experts are encouraging companies to take a closer look at their risk assessment strategies and think of ways to simplify, integrate, and collaborate on their assessment tasks across the enterprise.

Risk Assessment Frequency:

This topic is often debated; however, in my professional opinion, organizations should perform their risk assessments at least annually. The most common approach is that companies asses their enterprise business risks on a calendar year. I also recommend that most organizations review their risk assessment strategies on a quarterly basis as business processes, systems, strategies, etc, may also change during the course of the year. This way the annual risk assessment plan will account for those changes. I am also seeing organizations that have very inefficient risk assessment strategies and some without any at all. The only way to ensure that your organization is risk intelligent is to implement an effective risk assessment strategy that covers the entire organization. Risk assessment results should stored so that risk trending and analysis can be performed.

Tearing Down the Risk Assessment Silos:

The most challenging aspect of a successful enterprise risk assessment strategy involves “the silo approach to risk assessment”. If you search businesses today, you will find that a smaller percentage do not have a “central” ERM group or Chief Risk Officer that will collaborate business process leaders to consolidate risk assessment activities. In order to give BODs oversight of business risks, organizations should seek to improve their efforts by bringing risk assessment efforts under one “umbrella” for centralize management and reporting.

Measuring and Weighing Risks:

There are many ways that an organization can measure and weigh their risks. The most common measurement of risk is likelihood and magnitude of impact. I have also worked with clients that measured their risks based on complexity, speed of onset, and/or dollar value. The key here is to choose a measurement that is right for your business and modify over time or assessment needs change. As far as weighing or ranking risk, I prefer to use the NIST model or approach to do so. It relatively simple and do not require you to be a mathematician to rank and score your risks.

I would like to hear your views on the following:

1. How do you measure and rate your risks?
2. Do you have a centralized risk assessment strategy?
3. Do you have a Chief Risk Officer?

Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

IT Governance, Risk, and Compliance (ITGRC)

Businesses rely on their IT departments and resources for competitive advantages and business to business transactions and cannot afford to apply to IT anything less than the same level of commitment they devote company assets. IT offers extraordinary opportunities to transform the business; however IT must deliver value and enable the business, and IT-related risks must be mitigated. Governance of IT, Information Security, and Risk Management encompasses several initiatives for executive management. At a glance, they must be aware of the role and impact of IT on the enterprise, define constraints within which IT professionals should operate and measure performance, understand risk and obtain assurance.

Corporate Governance:

Before discussing Information Technology and Security Governance, one must look at that broader issue of Corporate Governance in the enterprise. Corporate Governance is defined as a structure for determining organizational objectives and monitoring performance to ensure that business objectives are attained. Corporate Governance became a dominant business topic in the wake of many corporate scandals – Enron, WorldCom and Tyco, and is becoming increasing popular today in the wake of TJX credit card breach case. Companies generating interest in corporate governance is not new, but the severity of the financial impacts of the many scandals undermined the confidence of the investment community and corporate stakeholders.

Good corporate governance is important to investors and shareholders. As a matter of fact, many investors, before making an investment decision, validates and ranks the company’s corporate governance on par with its financial indicators. As a matter of fact, some investment firms are prepared to pay large premiums for investments in companies with high governance standards.

Whilst there is no single model of good corporate governance, it is noted that in many countries corporate governance is vested in a supervisory board that is responsible for protecting the rights of the shareholders and stakeholders. The board, in turn, works with a senior management team to implement governance principles that ensure the effectiveness of organizational processes.

IT Governance Role:

IT governance is the responsibility of the board of directors and executive management. It is an integral part of corporate governance and consists of the leadership and organizational structures and processes that ensure that the organization’s Information Technology sustains and extends the organization’s strategies and objectives. Also, IT governance is the term used to describe how those persons responsible for governance of an entity will consider IT in their supervision, monitoring, control and direction of the entity. How IT is applied within the business will have an immense impact on whether the business will attain its vision, mission or strategic goals. In today’s economy, and with most businesses reliance on IT for competitive advantage, businesses simply cannot afford to apply to their Information Technology anything less than the level of commitment they apply to overall governance.

Who is Responsible for IT Governance and Risk Management:

Board of Directors (BODs) and executive management have a joint responsibility to protect shareholder value. This responsibility applies just as stringently to valued information assets as it does to any other asset. BODs and management must recognize that securing information and information assets is not just an investment; it is essential for survival in all cases and for many it guarantees competitive advantage. Additionally BODs and management must accept the responsibility of ensuring that:

• IT Governance is aligned with the overall Corporate Governance structure within the enterprise.
• IT Governance includes an alignment with the Enterprise Risk Management Program, which is a responsibility of the BODs and Management
• There is a balance of the operational and economic costs of protective measures and achieve gains in mission capability by protecting the IT systems and data that support their enterprise’s business strategy and objectives.
• Risks and threats are identified, categorized and mitigated to acceptable levels.
• IT Governance obtains coordinated and integrated action from the top down.
• IT investments are not mismanaged or misdirected.
• IT Governance rules and priorities are established and enforced.
• Trust is demonstrated toward trading partners while exchanging electronic transactions.

In Closing:

IT governance covers a number of activities for the board and for executive management, such as becoming informed of the role and impact of IT on the enterprise, assigning responsibilities, defining constraints within which to operate, measuring performance, managing risk and obtaining assurance.
IT Governance is focuses two categories: (1) IT’s delivery of value to the business and (2) mitigation of IT risks. In order to have an effective IT and Security Governance strategy businesses must address the following questions:

• What decisions must be made to ensure effective management and use of IT?
• Who should make these decisions?
• How will these decisions be made and monitored?

Always remember that managing information security risks as part of operational risk involves establishing an effective IT governance and control architecture.


Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

Understanding Enterprise Risk Management In-Depth

In today’s blog, we will discuss “Understanding ERM In-Depth; Using the Right ERM Strategy as A Catalyst for Addressing Risk, While Improving Audit Outcome”.

Companies are under significant pressure to stay abreast of a wide array of business risks that may impact their organization’s success and sustainability. BODs and senior management’s risk oversight role is becoming as critical to the sound running of an organization, especially for companies with significant market risk exposures. This has caused BODs and corporate officers to become more involved in strategic ERM planning at early stages, rather than just reviewing and signing off on an ERM strategy after it has been fully developed by management. Furthermore, the increasing demands and high expectations from the BOD levels have caused a major shift in how audit committees and chief audit executives approach their internal audit programs. Internal auditors are encouraged to incorporate a risk-based approach to internal controls auditing.

ERM Framework and Strategy:

I’ve seen many clients undergo major efforts in developing an ERM framework that work for their business. Most of these frameworks, in my opinion, appear to be nothing more than an over-engineered process that could have been completed with a COSO-based or NIST-based ERM framework. Bottom line here is to take advantage of frameworks that have already been established so that you are not “re-inventing” the wheel. Your ERM framework should capture ALL key and critical business areas within your organization. Your framework should also account for both, business and information risks. Key word here….ENTERPRISE!

ERM and Internal Audit:

The role of the internal auditor and the internal audit process is quickly changing. Today, internal auditors are encouraged to take a risk-based approach to their audit programs. I am working with a particular client where they are using risk composites to drive or “trigger” their audits. The way it works is that when both the likelihood and the MOI (magnitude of impact) of the threat are equally high, the audit department is notified to audit the control(s) that are supposed to mitigate the risks or threats. As an auditor, I strongly encourage that your audit team employ a risk-based approach to your audit strategy. Additionally, getting integrated with your ERM division offers great rewards in this process. This strategy will also improve your audit outcome. Know the risk….employ the effective control(s)….mitigate the risk….you get the idea!

ERM and GRC (Governance, Risk, and Compliance):

I had a customer ask me. “What is the most critical component of the GRC Process”? Although this is a tough question and every component of the GRC process is important, it is my opinion that cornerstone of GRC is risk (R). Without knowing and understanding the risks that businesses face today, it would be difficult to provide BODs with risk oversight, identify controls that need continuous monitoring, and achieve a risk-based approach to compliance management. Once your risk appetite has been determined and your business risks have been identified, you can perform risk analytics and modeling to further enhance your ERM program and provide BODs and corporate officers with oversight of their enterprise risks. All in all you can see the importance and significance of ERM within a GRC or corporate governance strategy. I’m curious to hear other approaches to this thought.

I would like to hear your views on the following:

1. What is your approach to Enterprise Risk Management?
2. How do you incorporate risk into your GRC or Corporate Governance Strategy?
3. What ERM framework works best for your organization?

Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

Subprime Mortgage Meltdown

In today’s blog, we will discuss the issue concerning the Subprime mortgage meltdown and whether or not Sarbanes Oxley should be extended to the Mortgage Industry.

Currently there is much debate and finger-pointing regarding the Sub-Prime Mortgage Meltdown. According to Bankrate.com, the Meltdown was something that many saw coming, but no one -- not the industry, not the secondary market, not the regulators, or the media --did anything to prevent it.

The Issue:

Subprime mortgage lenders make it possible for many borrowers with flawed credit to obtain mortgage loans, many of which could not afford those loans. While this concept aligned with the American Dream of Home Ownership, many mortgage companies failed to realize one important facet of this concept – RISK!!! It appears that many of the mortgage lenders capitalized on the millions of dollars of inflating interest rates in a low interest market but failed to implement the controls that mitigated the risk of surging federal interest rates, foreclosures, loan defaults, and over extended credit.

Should Sarbanes Oxley Be Extended to the Mortgage Industry?

In my opinion, this is an unconditional yes and if you research the section 13a or section 15d of the Securities and Exchange Act of 1934, some mortgage lenders may be obligated to comply with SOX but are not. Here’s the deal according to the law: Companies that issue asset-backed securities are must report under section 13a or 15d. All sub-prime loans are issued as asset-backed or mortgage-backed securities. If a mortgage company issues asset-backed securities on the open market and remains the master-servicer of the loan pool, the company's reporting obligation under sections 13a or 15d of the Securities and Exchange Act of 1934 is not suspended — it continues. So you see that many subprime lenders should already be accountable to Sarbanes Oxley.

My Conclusive Analysis:

In order to minimize the risk of mortgage meltdown in the primary markets, Sarbanes Oxley should be extended to the Mortgage Industry. Furthermore:

• Congress should ultimately enforce the SEC laws as well as force mortgage executives to retrain their loan officers to pitch programs that are better suited to their customer’s unique financial situation.
• Mortgage companies must implement controls and key systems that automatically detect an over-extension of credit as well as implement thresholds that minimize business risks.
• The industry should quickly come to the conclusion that Sarbanes Oxley applies and would make mortgage lenders document, test, assert, and attest to the effectiveness of their internal controls according to Section 404.
• Similar to the insurance industry, mortgage lenders should do a better job of assessing risks when extending credit to subprime borrowers.

Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions

Understanding Enterprise Risk Management In-Depth

In today’s blog, we will discuss “Understanding ERM In-Depth; Using the Right ERM Strategy as A Catalyst for Addressing Risk, While Improving Audit Outcome”.

Companies are under significant pressure to stay abreast of a wide array of business risks that may impact their organization’s success and sustainability. BODs and senior management’s risk oversight role is becoming as critical to the sound running of an organization, especially for companies with significant market risk exposures. This has caused BODs and corporate officers to become more involved in strategic ERM planning at early stages, rather than just reviewing and signing off on an ERM strategy after it has been fully developed by management. Furthermore, the increasing demands and high expectations from the BOD levels have caused a major shift in how audit committees and chief audit executives approach their internal audit programs. Internal auditors are encouraged to incorporate a risk-based approach to internal controls auditing.

ERM Framework and Strategy:

I’ve seen many clients undergo major efforts in developing an ERM framework that work for their business. Most of these frameworks, in my opinion, appear to be nothing more than an over-engineered process that could have been completed with a COSO-based or NIST-based ERM framework. Bottom line here is to take advantage of frameworks that have already been established so that you are not “re-inventing” the wheel. Your ERM framework should capture ALL key and critical business areas within your organization. Your framework should also account for both, business and information risks. Key word here….ENTERPRISE!

ERM and Internal Audit:

The role of the internal auditor and the internal audit process is quickly changing. Today, internal auditors are encouraged to take a risk-based approach to their audit programs. I am working with a particular client where they are using risk composites to drive or “trigger” their audits. The way it works is that when both the likelihood and the MOI (magnitude of impact) of the threat are equally high, the audit department is notified to audit the control(s) that are supposed to mitigate the risks or threats. As an auditor, I strongly encourage that your audit team employ a risk-based approach to your audit strategy. Additionally, getting integrated with your ERM division offers great rewards in this process. This strategy will also improve your audit outcome. Know the risk….employ the effective control(s)….mitigate the risk….you get the idea!

ERM and GRC (Governance, Risk, and Compliance):

I had a customer ask me. “What is the most critical component of the GRC Process”? Although this is a tough question and every component of the GRC process is important, it is my opinion that cornerstone of GRC is risk (R). Without knowing and understanding the risks that businesses face today, it would be difficult to provide BODs with risk oversight, identify controls that need continuous monitoring, and achieve a risk-based approach to compliance management. Once your risk appetite has been determined and your business risks have been identified, you can perform risk analytics and modeling to further enhance your ERM program and provide BODs and corporate officers with oversight of their enterprise risks. All in all you can see the importance and significance of ERM within a GRC or corporate governance strategy. I’m curious to hear other approaches to this thought.

I would like to hear your views on the following:

1. What is your approach to Enterprise Risk Management?
2. How do you incorporate risk into your GRC or Corporate Governance Strategy?
3. What ERM framework works best for your organization?

Thank you

James Sayles
MBA, BS, CISSP, CISA, CISM
Vice President, Chief Risk and Compliance Officer
Favored Solutions