The Power of Human-Centric Risk Assurance: A Journey to Success

Published by Business Outstanders in May 2024, this piece revisits the framework Jenny first set out in CXO Magazine the year before, in a shorter form for business readers. Her starting point is unchanged: technology supports risk management but cannot stand in for human oversight, because people create, run and use every system, and with them come bias, ethical choices and error.

She names four groups to focus on. Developers need technology risk training and should build security in from the design stage. Testers need proper training and complete test plans that include cases designed by users. Users need education on data protection, and vendors and other external users must know the organisation's data policies. Governors, meaning the board and management, should treat risk management as part of business strategy and be honest about gaps in their own risk knowledge.

Her five recommendations are a project governance process across every business unit, mandatory project training that includes ethics and security, an information security policy on the use of freeware in corporate projects, crisis management simulations for staff, and periodic checks on the control environments of external users.

The result, she argues, is more than compliance. It builds a culture of transparency and accountability, and an organisation resilient enough to keep pace with changing technology.

Read the full article at Business Outstanders