Siloed approaches to running businesses, where individual departments or units operate in isolation as opposed to coordinating goals, systems and data enterprise-wide, are perpetually under fire.
Nonetheless, siloes persist. The latest evidence comes from a cyber and risk survey by Grant Thornton, in which fewer than half (48%) of the 1,100 participating business leaders said their organization practices integrated risk management or has a company-wide operating model for risk.
In fact, even some of those that do coordinate risk management may not consider the approach to be working optimally. A majority of those polled (61%) said insufficient integration of the risk function leaves them with an incomplete view of risks.
Those are curious findings, given that 67% of survey participants said enterprise risk management and governance is a top priority for risk and compliance transformation.
“Many organizations still manage cyber, compliance, fraud and audit risks through separate teams and disconnected data,” said Tony Buffomante, Grant Thornton’s national managing partner for cyber and risk advisory, in the report. “That's creating blind spots at exactly the moment AI is making threats faster and harder to detect.”
Besides the incomplete risk visibility, insufficient risk integration invites a host of additional problems, including delayed incident detection, delayed response and recovery, missed emerging risks, and operational disruption.
Gaining an enterprise-wide view of exposures must start at a granular level, with data cleansed and standardized across functions, Grant Thornton wrote. While two-thirds of survey participants named enterprise risk management and governance as a top priority, an equal proportion said the same for shoring up data, analytics and reporting.
“To facilitate consistent evaluation of risks across functions and over time, a common set of risk definitions and assumptions needs to be established,” the report said. “The shared view should be overseen by an owner or governing group with visibility across the enterprise and accountability for how risks connect.”
Three-quarters (74%) of surveyed finance and operations leaders said cybersecurity incidents are the biggest risk to their organization’s performance over the next two years. Yet only 49% of business leaders said they have high or very high confidence in their organization’s ability to detect advanced cyber and privacy threats.
Cyber risk rarely comes from a single system or decision, Grant Thornton noted. Rather, risks stretch across a connected environment of cloud platforms, data and third parties that can’t be understood in isolation.
Survey participants identified identity and access management as their top priority for cyber investment for the next 12 months, followed by data protection and SaaS and cloud security.
