Effectively Communicating Risk to Management By Bikash Barai and Allan Alford

Effective risk communication to management or board members is essential for informed decision-making. This clip explores various models and approaches for communicating risk, ranging from traditional methods to more visually-oriented techniques.

 

 

Here is the verbatim discussion:

How would you uh communicate that risk to the management or board members right so the traditional model of the 5x5 matrix likelihood and impact and you know high medium low etc it's the most popular model it's a model that many boards respond to well and and it's a model that will resonate with those boards there are plenty of detractors in our industry who will point out that that likelihood impact is is a messed up mess um some people will talk about how the scales are ordinal and yet some people use it as a multiplicative in other words  five and five is twenty-five not ten uh you multiply the numbers instead of adding them which with an ordinal scale makes no sense but helps to demonstrate the drama of this is really bad this is really good yo know 1 to 25 is a much more pronounced scale some people do that and the boards respond to it quite well some stick with the standard ordinal and math and that seems to work well some people don't even put the numbers and simply do a heat map i had one company i worked for where reporting upstairs um was literally just the red yellow green hea map but in a very nice gradient manner without the numbers words there but not numbers there of likelihood and impact and um arrows with the dot and the line and the triangle at the end to show we started here and we got to there and you can show where we reduced likelihood dramatically but impact stayed the same or we managed to partially reduce likelihood and impact both or whatever.
 
 
 

Highlights :

Traditional 5x5 Matrix: Likelihood and Impact

  • Widely used model for risk communication.
  • Some critics highlight issues with ordinal scales and multiplication.
  • Boards often respond well to this model due to its familiarity.

Alternative Approaches:

  • Some use multiplication of likelihood and impact for dramatic effect.
  • Others opt for a simple red, yellow, green heat map without numerical values.
  • Visual aids like arrows and symbols can enhance understanding of risk trends and mitigation efforts.

 

Risk communication requires tailoring to the audience's preferences and understanding. Whether utilizing traditional 5x5 matrices or visual heat maps, the goal is to convey risk effectively to facilitate informed decision-making by management or board members.

 
 
Speakers:
 

Bikash Barai is credited for several innovations in the domain of Network Security and Anti-Spam Technologies and has multiple patents in USPTO. Fortune recognized Bikash among India’s Top 40 Business Leaders under the age of 40 (Fortune 40-under-40).Bikash is also an active speaker and has spoken at various forums like TiE, RSA Conference USA, TEDx etc.

Earlier he founded iViZ an IDG Ventures-backed company that was later acquired by Cigital and now Synopsys. iViZ was the first company in the world to take Ethical Hacking (or Penetration Testing) to the cloud.

 

https://twitter.com/bikashbarai1

https://www.linkedin.com/in/bikashbarai/ 

 

Allan Alford was in the CISO/CTO at TrustMAPP, a cybersecurity performance management company. With 20+ years in information security, he has served as CISO four other times in three industries. Alford parlayed an IT career into a product security career and then ultimately fused the two disciplines.

He has led security efforts in companies from five employees to 50,000 and executes a risk-based approach to security, as well as compliance with many, many frameworks. Alford gives back to the security community via The Cyber Ranch Podcast and by authoring articles and speaking at conferences. Alford holds a Master of Information Systems & Security, a Bachelor of Liberal Arts (with a focus on leadership) and a now-expired CISM certification.

 

 https://twitter.com/AllanAlfordinTX

https://www.linkedin.com/in/allanalford/

 

 

E-mail me when people leave their comments –

You need to be a member of CISO Platform to add comments!

Join CISO Platform