IRM plans to kick-start cyber risk management skills

The Institute of Risk Management (IRM) wants to “kick-start” risk manager skills for the digital age with a relaunched cyber group and new digital risk management certificate. The Cyber Risk Special Interest Group, which held its inaugural meeting last month, will initially focus on cyber risk in the context of enterprise risk management (ERM). The group, which meets again in March, will also look at how cyber risk can be incorporated into existing risk frameworks. Organisations take varying approaches to cyber, with many historically relying on cybersecurity and IT functions to manage the risk, according to Mark Clegg, IRM board member and chair of the Cyber Special Interest Group. However, cyber and digital risks have become a broader risk management issue due to digital transformation and increased privacy regulation, most notably the EU’s General Data Protection Regulation (GDPR), he told CRE. “There is no fixed home for cyber risk, but as risk professionals we see it as one of a number of risks that we have to deal with. And with the advent of the GDPR, there is now a recognition that cyber risk management can’t just be subcontracted to the IT department or cybersecurity. Privacy regulation, among other developments, has highlighted this unavoidable truth,” he said. “Organisations face the challenge of digital transformation projects and the higher expectations of consumers around the protection of privacy and data, and these are areas where risk managers have a role to play,” said Mr Clegg, who is also director of safety, risk and resilience at engineering group NG Bailey. While it is early days, the IRM’s special interest group could potentially produce a set of guiding principles on managing cyber risk within an ERM framework, said Mr Clegg. It will also consider the potential skills and tools needed by risk managers to deal with cyber and digital risks. The IRM is currently enrolling risk managers on its new digital risk management certificate. It delivers a six-month distance learning study programme and introduction to digital risk management. According to Mr Clegg, the certificate is proving popular with IRM members. “The take up of the Digital Risk Management Certificate is positive, highlighting the need for such support. I have every faith that the certificate will become widely accepted. If I was looking to recruit a risk manager in my business, I would expect them to be able to demonstrate a level of competency and knowledge of digital risks,” he said. The IRM hopes the qualification will help the profession “raise its game” when it comes to cyber risk. “We have produced a whole new qualification to kick-start the profession into raising its game in the digital field, but our longer-term plans will be to see digital and cyber risk management fully integrated into our more general risk management qualifications,” said Carolyn Williams, IRM director. “However, if our work in this fast-moving field has shown us anything, it is that the world is changing so fast that the most important thing is to be able to respond quickly to what’s needed. So in ten years’ time we could be looking at a specialist qualification in something that we don’t yet know we need,” she said. IRM’s recent research with the Cambridge Centre for Risk cited cyber risk as a key area of concern, as did the World Economic Forum’s Global Risk Report. Cyber also topped the recent Ferma biennial risk manager survey. This also found risk managers are now working much more closely with their colleagues in IT and cybersecurity. “From the risk professional’s point of view, they cannot afford to be left behind in this field. Risk managers have to be reasonably knowledgeable about these developments. If they act fast then they could actually have an opportunity to lead and add value in helping their organisations manage these risks,” according to Ms Williams. “There has been a tendency to treat cyber issues as a technical matter for the IT team to deal with. This cannot continue when it’s clear that the real risks to organisations from digital technology are more about behaviour, culture and business management than about getting the latest piece of network hardware,” she said. All of the skills to manage cyber risk and buy appropriate insurance are already in the risk professional’s toolkit, continued Ms Williams. But they need to be adapted and applied in the digital context, she said. “Context is essential. Risk managers have to understand the main developments taking place in digital technology and anticipate how they may affect their organisations. So when the people from engineering or marketing or finance come along with a whizzy new technological solution, the risk manager is on the front foot in contributing knowledgeably and positively to the process. This includes a reasonable understanding of cybersecurity which, increasingly, will be a required skill for all professionals, not just risk managers,” Ms Williams said. However, as risk managers take on a bigger role in managing cyber risk they may also need to supplement their risk management skills, she added. IT professionals might also need some training in risk management, the IRM director continued. “Risk professionals need to continually update their skills and knowledge to keep abreast of the digital world, because that’s where the risks are coming from. Information security people might also find it useful to get some risk management training in order to align their skills and knowledge more with the organisation’s overall risk management,” she said.

IRM plans to kick-start cyber risk management skills

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Want to read this article?

Read Next

Insurtech partners with USAID on climate adaptation programme

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Related Articles