Risk mitigation plans at many organisations fall short simply because they fail to take into account all the risks they actually face.

Abstract: A successful governance and risk mitigation strategy must operate at multiple levels with broad coverage. Risk mitigation plans at many organisations fall short simply because they are not comprehensive and fail to take into account the reach and range of all the risks that they actually face. Often this occurs when organisations only focus on specific areas of risk categories, only plan for certain types of risk or don’t understand all the different areas in their organisation that particular risks will impact. For example, in the area of disaster recovery, most plans fail to account for the following areas of concern:

• Human issues — Plans are often inadequate for ensuring communication with, support for and mobilisation of employees, decision makers, suppliers and customers, as well as providing the means to protect families.

• Infrastructure issues — How will the organisation deal with prolonged power failures, travel and transportation restrictions and logistics disruptions? Are there adequate fuel supplies? Are resources such as generators staged in safe locations?

• Business issues — The traditional view of disaster recovery has primarily been focused on data and the IT infrastructure, but many of the impacts of a disaster are business-related issues that affect people, business processes, facilities, transportation, communications and regulatory compliance.

• Community issues — Organisations must not neglect their responsibility to help employees and their local communities and regions recover from major disasters.

This white paper discusses common types of risk, the considerations for each and the steps organisations must take to develop an effective risk mitigation strategy.