Digital Transformation: An Opportunity or Nightmare to Risk Management
Dr Jenny Tan10 Apr 2023 · 1 min read · First published by Digital First Magazine
Writing for Digital First Magazine in April 2023, while President of the ISACA Singapore Chapter, Jenny begins with definitions, because the terms are so often confused. Drawing on Osmundsen and colleagues (2018), she separates digital transformation, a major organisational change enabled by technology, from digitalisation, which reshapes the social and technical structures of how work is done, and from simple digitisation, where neither changes.
Structural change means processes change, and so do the risks. She sees three reasons to treat a transformation as a chance to strengthen risk management: projects come with real budgets, so a risk workstream can be funded from the start; stakeholders are unusually open to new ideas; and after the pandemic, boards care about resilience. Her backup example shows why risk and continuity reviews must be joined up: an enterprise risk review accepts weekly backups, while the continuity plan for the same system says it cannot lose more than three days of data.
The same projects can become a risk manager's nightmare. Data owners assume that moving to the cloud moves their accountability too, often without involving IT or security. Data ownership and governance are left until after go-live. New technology brings new cyber exposure, made worse by incomplete inventories of hardware and software and a shortage of security talent.
Her conclusion is not to be discouraged by failed projects but to learn from them. Risk professionals should take an active seat in transformation programmes rather than a back seat, because everyone in the organisation shares responsibility for risk.
Key takeaways
- Define the terms first: digitisation, digitalisation and digital transformation need different treatment.
- A transformation budget is a rare chance to fund a proper risk workstream.
- Join up enterprise risk and business continuity views, so controls such as backups match what the business can afford to lose.
- Outsourcing to the cloud does not outsource accountability for data.
- Risk professionals belong inside transformation projects, not at the end of them.
Enjoyed this article?
Subscribe for new articles, or invite Jenny to speak on this topic at your next event.
Comments