Traditionally, risk management is often considered merely as an activity mandated from the boards, legislator, regulators and institutional investors, as well as pressured by ratings agencies and public at large. However, with the rise of cybersecurity issues, Management has started to look beyond the traditional needs of performing their due diligence; it is now viewed as the means to understand their environment to stave off threats from various risks the organization faces. 

The idea of performing risk management is not just about staving off threats but rather, managing business values against the risks in which the organization is exposed to. With this holistic understanding, C-suites would be able to better manage their risk appetite, justify their investments and staying accountable for their risk decisions.

Understanding the potential benefits that can be reaped from this service, the Management needs to understand that risk management covers a wide range of risk domains and risk management is not a one-off activity. It should be noted that the quality of risk management depends on the depth of risk management as well as the facilitator’s competence and experience. The shallowness of risk management may not allow Management to “deep-dive” into the problem and the incompetence and/or inexperienced facilitator may point Management in the wrong directions. Making matter worse, in situations where risk management are implemented across multiple locations, due to cultural difference, educational difference, program interpretation differences and through the use of different risk facilitators at various locations, risk results may turn out to be just a bunch of numbers with no analytical value.

With 20 years of experience performing risk management activities for our clients, Maximus has developed a methodology that assures the objectivity, consistency and quality needed for risk management. Maximus believes firmly that all risk assessment originates with a business service in mind, it may be services provisioned for internal functions or chargeable services provisioned to its customer. Each business service is then supported through IT systems and business activities, where in turn they comprise of key assets including operating systems, virtualization, applications, information, outsourced services as well as business processes. Depending on the nature of the key assets the organizational possesses, relevant risks are associated and identified.