The term “risk” gets tossed around constantly in the corporate world. But who is responsible for defining and managing risk? This answer is not black and white, as risk type and appetite will look different for every organization. What should be a universal practice is ensuring that all departments understand the enterprise’s risk types.
Keeping risk conversations and processes within silos can be dangerous and result in noncompliance. This is particularly important with cybersecurity, as threat actors can penetrate any part of the business. With new attack methods emerging and trends changing frequently, all departments must be aware of what cyber risk the organization has assumed and their respective roles in managing such risk. This requires an effort not to silo risk and have everyone work together to achieve compliance with established frameworks and regulatory constraints.
Interplay Between Risk Appetite and Compliance
Risk can come in many different forms such as reputation, cybersecurity, privacy, financial, legal, personnel, and operations. Compliance risk intertwines with all of these categories. For example, failure to protect sensitive consumer…
