Technology risk management: How to modernize while successfully managing risk

More businesses than ever are embracing a digital transformation. Cloud-based systems, big data and AI are creating a flood of new opportunities to operate more effectively and better understand your customers.

But is your business prepared to tackle the new risks that emerge when it shifts onto a more digital footing? Or are you taking on unnecessary financial, operational and reputational dangers?

Keep reading to learn more about why your business needs to actively manage technology risk and how to get started.

What is technology risk management (TRM)?

Technology risk management focuses on managing and reducing risks that involve digital systems, data or implementing new technologies. This is a big picture branch of enterprise risk management that includes more focused risk areas like cybersecurity or AI, without being limited to them.

Technology-related risks include practical, operational realities like whether your systems actually function as they should. Vendor management and regulatory issues are also important, as is data integrity.

Your competition may also represent a technology risk to consider. Technology can be a growth driver that helps differentiate your business from competitors or make it easier to uncover new market opportunities. But it can also leave you falling behind if your competitor wields it more effectively.

Technology risk management involves taking all these factors into account and implementing a strategy to mitigate them.

Why technology risk management matters during digital transformation

When a business goes through a digital transformation that involves transitioning its core systems and data into the cloud, it suddenly faces a host of new risks. A thoughtful technology risk management strategy can make this process safer and more effective, while also mitigating ongoing risks.

Technology investments are becoming business-critical

Technology risk management is more essential now than ever before — because technology itself is more deeply integrated into virtually every business. Ten years ago, you didn’t have to be in the cloud, but now, any organization larger than a lemonade stand knows it needs modern digital systems to compete.

As cloud-based technology becomes critical to your day-to-day operations, you can’t afford to write off technology risks as just cybersecurity. You’ll leave your business too exposed.

Digital transformation introduces new operational risks

To understand the breadth of technology risks many businesses now face, consider the example of a community bank. For fifty years, this bank has thrived even as large national banks have opened nearby branches because it offers superior customer service and has built deep lending relationships with local homeowners and small businesses.

Until now. In recent years, customer expectations have shifted wildly, with younger customers (and many older ones as well) preferring to do everything online. That superior customer service doesn’t mean what it used to if the bank’s app is clunky and hard to use, so the bank scrambles to find a vendor that can clean up its customer-facing technology to avoid losing market share.

But is that vendor secure enough to meet banking industry regulatory requirements? Is it reputable and audited? Will the bank itself be able to improve its digital experience enough to meet today’s customers where they are without spending money it doesn’t have? Does it have the data foundation in place to learn enough about those customers to keep them happy while also establishing enough AI governance to avoid exposing their data to public AI models?

That’s a lot of new risk from many different angles.

Risk visibility leads to better investment decisions

Some good news: Technology risk management isn’t just about avoiding trouble. It’s also a way to make smarter business decisions that drive growth and ROI.

Governance — the ongoing process of understanding how your business uses technology and creating guardrails to manage the associated risks — is a fantastic opportunity to think about how technology can improve your daily operations. You can’t set up controls if you don’t know how things work; once you know how things work, you can find new efficiencies.

Governance also increases the reliability of your technology-related outputs. For example, an AI policy to mitigate bias, hallucinations and data quality risks will make answers from AI models you use more accurate, delivering clearer, more useful insights about your customers, operations and financials.

In other words, managing technology risks helps you learn more about your business and your market. That information makes it easier to compete.

What are common technology risks business leaders face?

Businesses face a wide range of technology risks. These include risk areas like platform implementations, cloud migration, third-party vendors, AI and cybersecurity, as well as broad strategic risks like falling behind your competition in how you use technology.

ERP implementation risk

More businesses are transitioning to cloud-based enterprise resource planning (ERP) platforms to manage their core operations and financials. This can be a big boost for your operational efficiency, but it also carries significant risks.

During the transition, you’re moving some of your most critical data from one database to another. Incorrect data mapping, poorly designed processes or corrupted data can blind your team to what’s happening inside your business. Fixing this can be expensive and also create ripple effects that disrupt your operations or carry over into your customer experience.

Cloud migration risk

Moving to the cloud just means transitioning from running your own servers to using servers operated by a vendor. The benefits are huge: You have all the server space you could ever need, without the worry of protecting and maintaining an in-house server bank.

However, don’t assume all cloud service vendors handle those responsibilities appropriately. Sloppy server maintenance can open the door to cybersecurity issues, outages and other disruptions that can interfere with your business or create costs.

Third-party technology risk

Beyond cloud servers, you’re relying on vendors for your ERP, CRM, AI tools and other SaaS products your business uses. Are those vendors protecting your data securely?

A data breach at a key vendor can leave your internal or customer data exposed or even shut down some of your core systems. In some industries like financial services, these types of data breaches are actually the most common kind, and the consequences can be just as severe as if your own systems were breached.

AI and emerging technology risk

AI risks like shadow AI, overspending on compute, bias, output quality and data privacy all flare up for businesses moving to integrate AI more deeply into daily operations. These risks can affect everything from your monthly AI bill to the quality of information that flows up to decision-makers to your reputation with customers.

Most can be managed with careful governance, but many businesses are unaware of just how critical that is.

Cybersecurity risk

Cybersecurity is the technology risk area most business leaders already understand. That familiarity doesn’t make it any less vital, as a successful breach can cause financial, operational and reputational harm.

AI has made it easier than ever to launch a cyberattack, and nation-state actors are increasingly pursuing attacks of their own as well, making managing cyber risk an essential pillar of any enterprise risk strategy.

Competition risk

Finally, technology is a major competitive edge for businesses that deploy it most effectively. Because technology changes so quickly, leaders need to constantly assess how their industries are using the latest tools, or risk getting left behind.

However, you must also balance innovation with enough discipline to avoid investing in new technology simply because it’s new, as that can quickly lead to poor ROI and failed projects.

A guide to managing technology risks

Effectively managing your technology risks can help your business both avoid bad outcomes and actively generate good ones. Key steps to doing this include:

1. Align technology initiatives with business objectives

Only onboard new technologies to solve specific business problems or create defined opportunities. Your organization has goals: Technology should be a tool to reach those goals rather than just for the sake of implementing something cool.

2. Assess technology risks before implementation

Before you start using a new technology, assess the risks. For example, consider new risk exposures created by ERP implementation, cloud migration or AI tool as part of your overall process for determining whether to move in that direction.

If you’ve already begun a digital transformation without considering risk, do a risk evaluation for your existing digital systems as well. Also, do your due diligence on any third-party vendors you already or plan to work with: Review each vendor’s SOC report (if a vendor doesn’t have one, run) and make sure it reflects an adequate and comprehensive SOC audit.

3. Strengthen governance and accountability

Effective governance is a pillar of managing technology risk. To establish or strengthen governance, set up an ongoing governance committee (with C-suite presence or active sponsorship) that will evaluate technology risks, create policies and controls and then train team members to follow them.

4. Conduct ongoing monitoring

As you implement new tech tools, conduct ongoing monitoring of technology use. This is both a governance effort to watch for risks and an opportunity to assess whether those tools are delivering ROI.

5. Continuously review and adapt

Continuously review your overall technology risk strategy. Consider what you’re learning from your monitoring efforts, as well as how technologies are evolving and the nature of new risks and opportunities.

Popular technology risk management frameworks to follow

A technology risk management framework is a pre-existing, structured approach to managing IT risk. Often created by institutions, trade associations or international organizations, risk frameworks give you a guidebook for how to assess, mitigate and monitor risk. This is simpler and more effective than creating your own process from scratch.

Two popular risk management frameworks you should be aware of include:

• NIST RMF: Perhaps the biggest technology risk framework, NIST RMF (National Institute of Standards and Technology Risk Management Framework) provides a seven-step process that helps organizations mitigate security, privacy and supply chain risks.
• COBIT: Another major technology risk framework, COBIT (Control Objectives for Information and Related Technologies), defines a series of processes to manage IT-related risks.

If your industry uses a particular technology framework, adopt that one. Otherwise, any established framework is likely a good choice, as most are decades old and heavily vetted.

However, don’t mix and match; pick one framework and stick with it rather than trying to pull together elements from several different frameworks.

Technology risk management helps businesses modernize with confidence

You need up-to-date technology to stay relevant as a business. But how much additional risk do you want to take on as you modernize?

Thinking about technology risks strategically, and as part of an overall enterprise risk management strategy, can help dramatically lower your risk exposure. In practical terms, this means lower odds of financial, operational and reputational damages related to technology risks — like a bad data breach that slows down your operations and drives away customers.

Embracing an active risk management strategy also helps you learn more about how your business functions, as you work to understand your processes and install stronger controls. This can deliver new efficiencies and process improvements.

And finally, consider that managing your technology risk should also boost your confidence in the quality of information that’s coming from inside your organization. You can feel assured that your financial, operational and customer data is accurate, delivering a foundation for smarter business decisions.

How Wipfli can help

We advise businesses and organizations on managing technology risk. Ask us for help conducting a technology risk assessment, handling vendor due diligence and implementing a risk strategy to protect your cash flow, operations and reputation. Start a conversation.

Let’s talk managing technology risk

Read more

• Enterprise risk management strategy: A short guide for CEOs
• Shadow AI: How organizations can avoid this growing risk
• Cybersecurity risk management: A guide for business leaders