integrated risk management (IRM)

What is integrated risk management?

Integrated risk management (IRM) is a set of proactive, businesswide practices that contribute to an organization's security, risk tolerance profile and strategic decisions. As opposed to compliance-based risk management approaches, IRM focuses on evaluating risks in the wider context of business strategy. An IRM program should be collaborative and involve both IT and business leaders alike.

The term integrated risk management was first coined by Gartner in 2017, in response to a more complex risk landscape brought about by increased digital processes, globalization and heavier reliance on third parties. As described by Gartner, an effective IRM framework should include a clear strategy, detailed risk assessment, a plan for risk response, communication and reporting, risk monitoring and implementation of IRM software.

MarketsandMarkets forecasts the IRM market will grow to $18.7 billion in 2027 up from $9.5 in 2022.

What are the benefits of integrated risk management?

An IRM strategy bridges the functional aspects between organizations, culture and strategic business objectives. Several advantages can come from adopting an IRM strategy, as opposed to a limited-scope approach to business risk management. These advantages include the following:

• Wider range of opportunities. IRM strategies aim to consider the full range of possibilities associated with each business strategy aspect, as opposed to focusing on simply mitigating the downsides. Opportunities to capitalize on potential upsides can arise from the more comprehensive evaluation of each business outcome.
• Improvement of risk identification and management. IRM contributes to a more realistic picture of risk analysis from which organization leaders can improve decision-making. Risks can be identified and communicated between business and IT teams in a productive manner. Organizations with IRM-based strategies are more likely to have appropriate responses planned and resources in place. They're also likely to be more equipped to deal with adverse outcomes and suffer less financial loss.
• Risk-mature organizational culture. By taking a wider, interdepartmental approach to risk awareness and management, the result is a more proactive culture. Organizations view risk as an inherent part of business strategy.

Challenges of integrated risk management

Risk management has its own challenges in relation to business operations, including the following:

• Silos. Traditional risk management often operates in silos, with each department and business unit managing their risk independently. This lack of coordination leads to inefficiencies and missed opportunities to mitigate risks effectively.
• Regulatory compliance. However, Keeping up with the ever-evolving regulatory compliance landscape related to risk management can be daunting and resource-intensive.
• Operational risks. Businesses face a range of operational risks, from supply chain disruptions to cybersecurity threats and vulnerabilities. Identifying, assessing and mitigating these risks can be complex and time-consuming.
• Business continuity. Ensuring business continuity in the face of disruptions, such as natural disasters and economic downturns, is a critical aspect of risk management.
• Environmental, social and governance factors. Managing ESG risks and addressing sustainability concerns is an increasingly important consideration.

What to include in an integrated risk management program

According to Deloitte, an effective IRM framework should cover these five areas:

1. Objective setting. Organizations should collaboratively set primary and secondary objectives. All objectives should be measurable and described within the context of the circumstances.
2. Risk identification. Risks, risk exposures and opportunities should be identified and integrated into the framework with a monitoring plan. Visuals and matrices are useful tools for organizing and presenting information.
3. Risk consideration. Risks should be considered individually, bilaterally and all together. Organizations should answer the following questions about those risks:

• What material risks exist? How impactful and probable are they?
• How should the organization prioritize each risk?
• How do the risks affect the organization individually?
• How do the risks affect the organization altogether?
• How do the risks compare to the organization's risk appetite?

4. Mitigation options. These are also called risk management activities. Risk analysis output should yield detailed plans of acceptable outcomes and retained risks, and unacceptable outcomes with the full list of concrete mitigation options.
5. Quantitative assessment. How metrics are evaluated should be clearly defined, with set plans of action. Vigilance is crucial, and implementation of IRM software can help provide comprehensive views of relevant insights.

How to build an IRM framework

Careful planning and execution are required to build an IRM framework. The most important steps include:

• Build a risk assessment framework. Organizations should construct an IRM taxonomy as well as a risk assessment framework that provides a comprehensive view of information and relationships throughout an organization. This taxonomy serves as the foundation for an IRM strategy, ensuring that risks are consistently evaluated and compared.
• Connect risks with goals. The taxonomy approach should be used to align risk activities with an organization's strategic goals. By doing so, organizations can eliminate redundancy in assessments, access controls and testing while simultaneously reducing risks. This approach offers a holistic view that highlights connections between activities and strategic objectives.
• Organize resources. Resource management and process management are key to this approach. Information about resources, including vendors, stakeholders, assets, data and software, must be collected and organized.
• Connect business processes and resources. Establish clear and explicit connections between resources and the business processes that rely on them. An understanding of these relationships can give insight into their impact on the organization. Subject matter experts can provide critical insights into the importance of specific resources for their respective activities.
• Standardize criteria. Common standards and assumptions for collecting risk information across the organization should be implemented. Standardization ensures that the data gathered is objective and quantifiable and can be easily compared to other data.
• Consolidate. Various departments might collect overlapping information. Therefore, organizations must identify areas where controls and tests can be consolidated to eliminate redundancy.
• Centralize. A centralized resource library where information is easily accessible should be created. Centralization reduces duplication of effort when gathering and managing data, benefiting the IRM team and process owners.
• Formalize. Connections between resources should be detected and dependencies identified. Understanding how resources relate to each other reveals critical combinations that are integral to business.

How to implement an integrated risk management strategy

There are key pillars to implementing an IRM strategy are these four practices:

• Align cybersecurity strategy with business strategy outcomes. Communication should take place between IT cybersecurity teams and business leaders to discuss the relationship between business and cybersecurity strategies. Contextualizing information security risks with business strategy can help nontechnical business leaders understand how their decisions factor into the larger cybersecurity ecosystem.
• Build an engaged, risk-aware culture. Changing a company's organizational culture is a daunting task that should be approached gradually and with patience. A focal point of this step is to build critical allies from influential leaders within the organization, who can help shepherd others into an informed, risk-aware mindset.
• Integrate risk into business strategy discussions. It's critical for leaders to understand the natural relationship between business strategy and risk and that making new strategic decisions alters the organization's risk profile.
• Report effectively. Setting goal-based metrics to evaluate performance of risk management is critical. Organization leaders must understand what approaches are and aren't working. A number of vendors offer software-based IRM solutions to streamline the reporting process and compile risk-based insights and analytics into user-friendly dashboards.

Integrated risk management vs. governance, risk and compliance strategy

An IRM strategy focuses on creating a proactive, risk-aware culture, using contextualized risks to create outcome-based frameworks. A governance, risk and compliance (GRC)strategy focuses on checking off boxes that are less specific to the risk profile of an individual business.

Though the two terms overlap, they differ in scope, and GRC functions form the base of an integrated risk management strategy. While IRM forms the overarching business strategy in relation to risk, GRC functions are the concrete, more specific functions that enhance the risk profile. GRC's risk management approach has a narrow focus on technical and operational downsides; IRM widens the focus to form a more holistic perspective of tactics and strategy, which includes upside opportunities and strategic risks.

Factors to consider before selecting an IRM product

Organizations should take into account several factors when considering an IRM solution. These include the following:

• What are the scope and objectives of the IRM framework?
• Do the objectives of the organization's IRM framework match the product's scalability and flexibility?
• Who are the key stakeholders who will be responsible for various aspects of the product?
• Can the key stakeholders easily learn the tool and does it have tutorials and technical support?
• Are there auditing tools that fulfill financial and control-based compliance requirements?
• Can the tool adapt to changing compliance requirements in the organization's field?
• Does the tool have automation features that streamline risk assessment, data collection and reporting processes?
• What is the cost of the product?

Integrated risk management products

Integrated risk management systems and software simplify, automate and integrate the process of managing risk across an entire organization. It provides a comprehensive view of risk-related functions, measures and initiatives, while building platforms that facilitate the collaborative nature of IRM strategies. These products help organizations with the following:

• Risk control documentation and assessment.
• Incident management.
• Risk mitigation action planning.
• Risk monitoring and communication.
• Risk quantification and analytics.

Vendors such as the following offer IRM products:

• Archer.
• Camms.
• Cura.
• Diligent.
• Empowered Systems.
• IBM.
• Ideagen.
• LogicManager.
• MetricStream.
• Navex.
• Onspring.
• Refinitiv.
• Resolver.
• Riskonnect.
• SAI Global.
• ServiceNow.
• SureCloud.

IRM is a necessary part of enterprise risk management strategies. Learn the top 12 risk management skills and why you need them.