Table Of ContentAgile Enterprise Risk Management
Security, Audit and Leadership Series
Series Editor: Dan Swanson, Dan Swanson and Associates, Ltd.,
Winnipeg, Manitoba, Canada.
The Security, Audit and Leadership Series publishes leading-edge books
on critical subjects facing security and audit executives as well as business
leaders. Key topics addressed include Leadership, Cybersecurity, Security
Leadership, Privacy, Strategic Risk Management, Auditing IT, Audit
Management, and Leadership.
Rising from the Mailroom to the Boardroom: Unique Insights for
Governance, Risk, Compliance and Audit Leaders
Mark Tarallo
Modern Management and Leadership: Best Practice Essentials with CISO/
CSO Applications
Mark Tarallo
Agile Enterprise Risk Management: Risk-Based Thinking, Multi-Disciplinary
Management and Digital Transformation
Howard M. Wiener
Operational Auditing: Principles and Techniques for a Changing World
(Second Edition)
Hernan Murdock
CyRMSM: Mastering the Management of Cybersecurity
David X Martin
The Complete Guide for CISA Examination Preparation
Richard E. Cascarino
Blockchain for Cybersecurity and Privacy: Architectures, Challenges, and
Applications
Yassine Maleh, Mohammad Shojafar, Mamoun Alazab, Imed Romdhani
The Cybersecurity Body of Knowledge: The ACM/IEEE/AIS/IFIP
Recommendations for a Complete Curriculum in Cybersecurity
Daniel Shoemaker, Anne Kohnke, Ken Sigler
Corporate Governance: A Pragmatic Guide for Auditors, Directors, Investors,
and Accountants
Vasant Raval
The Audit Value Factor
Daniel Samson
Managing IoT Systems for Institutions and Cities
Chuck Benson
Fraud Auditing Using CAATT: A Manual for Auditors and Forensic
Accountants to Detect Organizational Fraud
Shaun Aghili
How to Build a Cyber-Resilient Organization
Dan Shoemaker, Anne Kohnke, Ken Sigler
Agile Enterprise Risk
Management
Risk-Based Thinking, Multi-Disciplinary
Management and Digital Transformation
Howard M. Wiener, MSIA, CERM, PMP
Cover image: Howard M. Wiener
First edition published 2022
by CRC Press
6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL
33487-2742
and by CRC Press
4 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN
CRC Press is an imprint of Taylor & Francis Group, LLC
© 2022 Howard M. Wiener
Reasonable efforts have been made to publish reliable data and
information, but the author and publisher cannot assume
responsibility for the validity of all materials or the conse-
quences of their use. The authors and publishers have
attempted to trace the copyright holders of all material
reproduced in this publication and apologize to copyright
holders if permission to publish in this form has not been
obtained. If any copyright material has not been acknowledged
please write and let us know so we may rectify in any future
reprint.
Except as permitted under U.S. Copyright Law, no part of this
book may be reprinted, reproduced, transmitted, or utilized in
any form by any electronic, mechanical, or other means, now
known or hereafter invented, including photocopying, micro-
filming, and recording, or in any information storage or
retrieval system, without written permission from the
publishers.
For permission to photocopy or use material electronically
from this work, access www.copyright.com or contact the
Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive,
Danvers, MA 01923, 978-750-8400. For works that are not
available on CCC please contact mpkbookspermissions@tandf.
co.uk
Trademark notice: Product or corporate names may be
trademarks or registered trademarks and are used only for
identification and explanation without intent to infringe.
ISBN: 978-1-032-03703-5 (hbk)
ISBN: 978-1-032-03704-2 (pbk)
ISBN: 978-1-003-18860-5 (ebk)
DOI: 10.1201/9781003188605
Typeset in Sabon
by SPi Technologies India Pvt Ltd (Straive)
Content
List of Illustrations xv
Acknowledgments xvii
About this book xix
Introduction 1
What’s driving the change we’re experiencing? 2
Technology and technology-driven business models
and the shift from capex to opex 2
Process automation can displace people, even high-level people 3
Cloud infrastructures level the playing field between
startups and established companies 3
Your company’s valuation depends on your
keeping up with these trends 3
Societal changes 4
How can you prepare to compete? 5
Implementing Agile ERM 6
Agile ERM Artifacts 6
Agile ERM operational processes 6
Where do we go from here? 7
1 Context—COVID, BLM and upheaval 9
Covered in this chapter 9
VUCA: our current state 11
Agile vs. agility 12
Business agility, the one thing you need to survive 13
The challenges you’re facing 13
The pressure to execute a digital transformation 14
Managing your business and risks as you transform 15
Traditional approaches to strategy are losing validity 15
Forces driving the need for new strategic approaches 17
Traditional business management practices that no longer work 21
Traditional risk management practices are seriously flawed 22
v
vi Content
All management is risk management 23
You already manage risks—you intuitively know how to do this 24
But are we actually any good at it? 25
Why you need multi-disciplinary, integrated risk management 25
Why multi-disciplinary? 26
Why integrated? 26
Any transformation has risks 28
Controlled transformation is key to managing transformation risks 29
The disciplines you will need to execute your
controlled transformation 30
Chapter summary 33
2 Enterprise risk management today 35
Covered in this chapter 35
Introduction 36
The emergence and evolution of risk management 38
RM vs. TRM vs. ERM vs. AERM 39
Current state of RM 42
The ERM process 43
Set context in which ERM will operate 43
Establish risk appetite and tolerance 44
What is risk? 44
Inventory risk sources 48
Identify, map and prioritize where general
operating risks occur 49
Identify external drivers or forces that create
risks and opportunities 50
Identify recurring and ad hoc decision processes 51
Perform a risk assessment: inventory and analyze risks
and develop management strategies 52
Identify risks 53
Analyze risks 53
The traditional way 53
A better way: quantitative analysis, incorporating
uncertainty and variance 55
Evaluate strategies and alternative treatments for each risk 63
Select treatment for each risk 64
Document your plan 65
Establish integrated RM controls, policies and processes 65
Implement, execute and monitor ERM performance 66
Risk audit and risk assurance 67
Evolve and improve your ERM 70
Causes of substandard risk management 71
Your goals for improving your risk management 72
Content vii
Why won’t traditional approaches to managing
risk work going forward? 73
Chapter summary 75
3 Digital transformation, business agility and risk 77
Covered in this chapter 77
Invention and innovation 78
Invention and innovation cycles drive markets 78
Various models illustrate cycles’ impact 79
The BCG Growth-Share Matrix 79
The Invincible Company: a portfolio of businesses 80
Parallels among the models 80
Implications for your business 81
Digital’s strategic impact is forcing enterprises to rethink execution 83
A strategy that reflects today’s digital realities demands
revised operational capabilities 85
Traditional enterprise structural and management
models that will have to change 86
The goals and challenges of transformation 86
How and why risk management needs to change 89
Chapter summary 89
4 The company you need to be 91
Covered in this chapter 91
Forces driving the target model of a business
architected for the future 92
Why do I need a digital transformation? 93
The anatomy of your company—enterprise
and business architecture 94
A definition of enterprise 94
Enterprise architecture 94
Business architecture 100
The anatomy of a digital business 100
Operational infrastructure and API services 101
Operational infrastructure 101
API services 102
Digital products and services factory 103
Business intelligence and analytics 104
Partner development platform 105
Distributed governance model 105
Digital transformation means transforming your
enterprise architecture 108
A preview of the transformation journey 110
viii Content
As-is EA and BA models 110
To-be EA and BA models 112
Gap analysis and implementation initiatives 112
Execution competency and capability gaps 113
Roadmap and execution plan 113
Risk management and the controlled transformation journey 114
Haven’t I already done some of this? 115
AERM and the digital enterprise 116
Chapter summary 118
A bi-level model for early-stage and established businesses 119
The case: a street cart 119
Pre-MVP risk management—experimental and
developmental phases 121
Experimentation 121
Development 124
An enterprise and business architecture model of the business 124
Applying the EA model to manage risk: elementary AERM 125
5 Planning the transformation journey and managing its risks 129
Covered in this chapter 129
Change vs. transformation 131
Risk management and the transformational digital enterprise 132
Three layers of risk 132
Managing risks in conjunction with transformation 134
Scoping and planning the transformation journey 138
Establish who’s governing during the transformation and after 139
Articulate your strategy 139
Establish your physical model infrastructure—EA/BA
models, KM repository, pattern library 141
Establish the logical designs of your metadata repositories 142
Your EA/BA models 142
Your Taxonomy 142
Your Pattern Library 145
Initiate and monitor the ongoing governance and management
processes of your EA/AERM effort 145
Scope, plan and conduct your discovery effort 146
Prioritize and schedule your discovery tasks 147
Focus on business processes 148
Business process discovery and management decision mapping 148
Example: an order management process 150
Inventory and document management and
governance processes 153
Execute discovery 154
Compile the as-is EA/BA model 156
Populate your as-is model 156
Content ix
Map known risks to your as-is model 157
Establish your preliminary to-be model 158
Precepts underlying to-be design decisions 158
The to-be model framework 161
Operational Infrastructure (OI) 162
API services (API) 163
Digital Products and Services Factory (DPSF) 164
Business Intelligence and Analytics (BI/A) 164
Partner Development Platform (PDP) 165
Distributed governance model 165
Define to-be governance and management processes 166
Map as-is to to-be and conduct gap analysis 167
AERM’s EA-driven approach to managing the
risks of transformation 169
Distill transformation initiatives and populate portfolio 171
Analyze the portfolio and develop your
transformation program 174
Establish concrete business goals 174
Establish priorities to sequence your transformation 175
Chapter summary 178
Company overview 178
HiCTools’ strategic transformation goals 179
Transformation risk considerations 181
As-is model 181
Organization and governance 182
Product management and customer-facing elements 182
Operational Infrastructure, API services 184
Business intelligence/analytics 184
To-be model 184
Redesign of the organization, responsibility
allocation and governance model 185
Product management and the digital products
and services factory 186
Perform market research 187
Produce product design and prototype 188
Perform market test, exposing product to customers 189
Commercialize and roll product out 189
Operational Infrastructure, API services 191
Business intelligence/analytics 191
Partner development platform 192
Gap analysis 192
Organization and governance—people issues 192
Operational Infrastructure 193
API management 194
Product management 194
Business intelligence and analytics 194
