Tangible and Intangible Risks - Term Paper Example

? Risk Assessment Plan Tangible and Intangible Risks Like any other financial SunnyVille is vulnerable to many tangible risks such as those that result from crime, poor weather, and accidents. The institution is well versed with most of these risks and should put measures to avert them accordingly. However, there are many not be readily visible risks, which are associated with different aspects of the company’s intellectual capital. The following is a review of the potential intangible risks, which are divided into four major components. i. Structural capital This category of capital includes the huge range of knowledge that is found within SunnyVille. At one end are the patents and trademarks, which are legally protected and formally recorded. What follows is the knowledge incorporated in formal process and software. There is also the knowledge found in instructions, manuals, as well as other written sources. At the other end is the unwritten knowledge that is enshrined in the way people do the way they do. The risks associated with this category of capital includes: weak and inconsistent work process, inadequate documentation and diffusion of knowledge, and inadequate protection of proprietary knowledge. ii. Human capital Human capital includes all people that work in SunnyVille. The key risks associated with human capital includes: failure to create a culture that values learning and accepts change, inconsistent dissemination across the company and insufficiency of skills levels, and vulnerability to and probability of key staff and management turnover. iii. Relationship capital. Relationship capital includes customer relationships, external network of vendors, partnerships, and outsourced services among many others. The key risks associated with this category of capital include the: threats to the brand, relationship loyalty to individuals, and vulnerability, and probability to partner defections or customers. iv. Business recipe This is the company’s strategy, because the appropriate strategy is an asset. The key risks associated with business recipes include the: exposure to economic cycles, potential substitutes, and threats of new competitors. Project Scope Statement During SunnyVille’s recent IT audit, the final report mentioned that the company’s risk assessment needs greater detail, the IT policies are inadequate, and the overall management of risk itself is unsubstantiated with little oversight from the board of directors. Following these observations, the risk assessment team met on June 10, 2013 to review the scope of risk assessment to be conducted in order to deliberate on how address the problems identified during the audit. The team reviewed the entire risk structure of the company, with strong emphasis being paid on IT policies, intangible risks, as well as the role of board of directors in mitigating risks. The findings of these assessments, reviews, and audit were used to develop risk assessment scope statement. On June 13, 201, SunnyVille’s staff conducted the risk assessment. The aim of this process was to identify threats that could have contributed to the issues raised following the audit. Different stakeholders, including the employees and board of directors were involved in the process of risk assessment. Qualitative/Quantitative Risk Analysis A quantitative method can be used for the risk analysis, whereby the risk will be presented using a variety of scales or through the financial extent as forecasted amount of losses associated with different types of risks (Szczepankiewicz & Szczepankiewicz, 2006). This method will rely on the available data; though where data is not available qualitative approach can be used. For the purpose of setting values, definition of the information will be done in order to ensure proper achievement of different business processes and their relevance for functioning of the company’s units and as a result the whole company (Galach, 2004). There are many Qualitative approaches to risk analysis, including NIST 800-30, CRAMM, and Failure Mode and Effects Analysis (FMEA), and Failure Mode and Effects Criticality Analysis (FMECA) methodologies. For the purpose of this risk assessment, FMEA/FMECA will be used. The significance of FMEA/FMECA methods is to analyze the impact of very potential defect on the performance of the entire system and in accordance with the order of severity. In addition, FMECA introduces analysis of the extent of defect severity and assesses the presence of critical character for performance of the entire assessed system. However, qualitative approaches are somewhat laborious, they are supported by specialist tools, they require knowledge of experienced persons, and they use components of knowledge fuzzy logic and engineering. Business Impact Analysis Business Impact analysis will be used to help in formulating questions to bring forth responses for incorporation into exact categories. This will help in collection of data and hence facilitate the process of categorizing the most significant business functions, the operational and financial impact if they are interrupted, time frame targets to attain them, and strategies to recover them. SunnyVille IT Head Count Parent Process Priority Ranking RTO RPO PP Depends on PP Required by 1. Business Unit Name – SunnyVille IT 2. Head Count – Number of full-time staff that work in SunnyVille IT 3. Parent Process – concise description of the major tasks SunnyVille IT performs 4. Priority Ranking – Subjective ranking of parent processes in line with SunnyVille IT criticality 5. Recovery Time Objective (RTO)– Time needed to pull through the parent process to business more or less routinely after a interruption 6. Recovery Point Objective(RPO) – a duration when parent process work should be reinstated after an interruption 7. Parent Process Depends On (PP Depends on) – Names of processes and organizational processes needed for normal operations 8. Parent Process Required By (PP Required by)– Names of processes and organizations that require the parent progression for usual operations Time Needed to Recover employees Qualitative Impact < 4 hrs 1 day 3 days 1 week 2 weeks > 2 weeks 1. Qualitative Impact – Non-financial impact to the business, such as loss of customers and loss of reputation. 2. Time Needed to Recover Staff – shows how many employees can be recovered to the almost normal process of the business, for a given time. Gap Analysis Company name: SunnyVille Gap analysis date: June 13, 2013 Strategic objective Current standing Deficiency Action plan Increase oversight by board of directors The board of directors have little involvement in oversight Poor oversight To design policies for oversight To Increase IT control systems The control system is somewhat watertight, but some problems often arise. Some control loopholes To appoint a committee of experts to undertake an audit on the current systems and give recommendations References Galach, A. (2004). Instruction of IT system security management (In Polish): Osrodek Doradztwa i Doskonalenia Kadr. Gdansk: Publishing House. Szczepankiewicz, I., & P. Szczepankiewicz, P. (2006). Risk analysis in the IT environment for the purpose of operational risk management. Part 2 – Risk assessment stage. Monitor Rachunkowosci i Finansow, Magazine no 7/2006 Read More