Heightened Human-centric Risk Assurance in Digital Era

In this June 2023 article for CXO Magazine, Jenny challenges the belief that automation can replace human judgement in risk management. People design, build, roll out and use every digital solution, so bias, ethics and negligence are human issues before they are technical ones. Any risk assessment, whatever the technology involved, has to include human-centric controls.

She describes four groups that make up human-centric risk assurance. Developers, including vendors and the citizen developers that low-code tools now allow, often have no technology risk training, and IT may not even know their projects exist. Testers work from incomplete test plans, and vendor-led projects tend to favour test cases their product will pass. Users inside and outside the organisation need to know how corporate and personal data must be handled, and what happens when it leaks. Governors, the board and management, need to treat risk management as part of strategy rather than an item for the risk committee alone.

For each group she offers three practical steps. Examples include registering every project with a project office before procurement, requiring targeted ethics and security training before work starts, balancing the mix of vendor, system and user-designed test cases, running data-leak crisis simulations, and checking the control environments of vendors from time to time.

Her closing point is that training only works when it fits what people actually need to do. Whether an organisation is deploying cloud, AI or the internet of things, a breach can escalate into a crisis quickly, and well-prepared people are what keep it resilient.

Read the full article at CXO Magazine