Risk Management

1. Roles & Responsibilities in Risk Management

IT Team

• IT Admin / Manager
  • Identify technology-related risks (network outages, cyber threats, hardware failures).
  • Implement preventive measures (patching, backups, redundancy).
  • Maintain risk register for IT assets.
• Security Officer
  • Monitor access control, CCTV, and cybersecurity compliance.
  • Conduct vulnerability assessments and penetration tests.
• Helpdesk / Support
  • Report incidents promptly.
  • Execute escalation protocols.

Facilities Team

• Facility Admin / Manager
  • Assess physical risks (fire, theft, power outages, HVAC failures).
  • Ensure compliance with safety standards.
  • Coordinate with vendors for preventive maintenance.
• Vendor Managers
  • Validate vendor SLAs for risk mitigation.
  • Maintain emergency contact lists and backup plans.

Leadership / Risk Committee

• Approve risk policies.
• Review risk reports and mitigation plans.
• Ensure alignment with business continuity strategy.

2. How to Do Risk Management (Step-by-Step)

A. Risk Identification

• IT Risks: Cybersecurity breaches, hardware failures, ISP downtime, data loss.
• Facility Risks: Fire hazards, unauthorized access, equipment breakdown, natural disasters.

B. Risk Assessment

• Use Risk Matrix (Impact vs Likelihood).
• Categorize risks: High, Medium, Low.

C. Risk Mitigation Strategies

• IT:
  • Redundant network links (dual ISP).
  • Regular backups & DR drills.
  • Endpoint security & patch management.
• Facilities:
  • Fire suppression systems.
  • CCTV & access control audits.
  • Preventive maintenance schedules.

D. Risk Monitoring

• Continuous monitoring tools (SIEM for IT, IoT sensors for facilities).
• Monthly risk review meetings.
• SLA compliance checks.

E. Incident Response

• Define escalation matrix.
• Create Incident Response Playbook (IT & Facilities).
• Conduct mock drills.

F. Documentation

• Maintain Risk Register (Excel or tool-based).
• Update SOPs after every incident.

3. Best Practices

• Implement ISO 27001 for IT security and ISO 45001 for facility safety.
• Regular vendor audits.
• Employee awareness training.
• Insurance coverage for critical assets.