Enterprise Risk Management Just Got Easier

Enterprise risk management is a highly important concept within business continuity. How would you define it?

Enterprise risk management involves identifying and quantifying threats and vulnerabilities and assessing how well controls are applied to those threats and vulnerabilities. It covers everything from financial and market risk to operational risk. Good enterprise risk management programs mitigate where possible and plan around what cannot be mitigated – that is, around residual risk.

Please discuss the need you had to conduct detailed, comparable risk assessments across Aureon’s sites.

When you think about mitigation, you want to focus on your biggest risk exposures. At Aureon, we have over 100 transport locations for our network and multiple office locations. We cannot identify and address our largest risk exposures unless we measure and score all locations equally.

How did you historically conduct site risk assessments?

Initially, we had a paper-based process in place, using spreadsheets to document the exposures, threats, controls, and scores of our sites in detail. The first go around we looked at 21 locations. This system worked, however, it took a significant amount of time and effort. As the number of sites to be assessed increased to nearly 50, paper was simply too cumbersome and time-consuming. We needed a better solution.

How did the Fusion Framework meet your need for streamlining and automating the site risk assessment process?

Fusion brought us multiple advantages. First, it enabled me to customize the items I considered important to assess and measure. Second, it created a repeatable process that measured key risk indicators equally across all locations. Third, it allowed us to develop a method whereby we can measure sites consistently quarter over quarter and year over year.

It also enabled me to associate our selected mitigation strategies to sites and to assign and monitor progress of those strategies. Additionally, it allowed for risk acknowledgement of the current state of corporate risks by those ultimately responsible. With the history reporting we have the evidence we need for auditors verifying our risk management program is functioning as stated.

Would you describe how you used to conduct a site risk assessment with the paper-based process and compare it to how you now conduct a site risk assessment using Fusion?

Previously, I would take an entire day to drive to and collect data at a single site. Then each evening I would review my hand-written notes and transcribe any comments I recorded while on site. All this information would then have to be organized and typed manually into the spreadsheets. The next day I drove to another location to start a new assessment.

Now, when I go to a site, I have access to the Fusion Framework on my tablet. This allows me to enter data directly into the appropriate fields of the risk assessment while walking through the site. I can capture photos of relevant subjects and record verbal comments using the speech-to-text feature that stores it in the appropriate field in Fusion. Depending on the distance there were times I could collect data for two or even three locations in one day.

Additionally, when sites are similar in some fashion – for instance, if they have the same governance or technology in place – I can clone the data from one location to another for that section of the site assessment. All these features save a massive amount of time, eliminating redundant activities, and minimizing the opportunity for errors.

How much time has Fusion saved you in conducting site risk assessments?

When you multiply the time savings over our network of sites, it adds up to multiple hundreds of hours saved. For instance, it took me three months to conduct assessments for 21 sites using the paper-based system, then took another month to compile, analyze the data and create the reports. Most days were 10 to 12-hours long during that period. With Fusion, I conducted assessments for 47 sites, with the reporting and analysis being highly automated. All of this was complete in just three months with normal working hours. That is a conservative estimated 340 hours for over double the locations! That’s huge savings for Aureon in people hours.

What are the top benefits of having all this site data housed within the Fusion Framework?

The benefits are extensive! One key benefit is that we can now make data-based decisions regarding risk mitigation by identifying where a certain line item is ranked consistently as a high risk across multiple locations. This gives us a very clear picture of where to invest our dollars for mitigation and where to make plans around residual risk.

Another major benefit is that we have unlimited reporting options. We can create queries and pull reports at any time to demonstrate where we are today or to show trends over time. Plus, the informative and intuitive dashboard is always available when executives want to see our overall risk profile, compare locations and vulnerabilities, or check the status of mitigation efforts.

What are your future plans with Fusion?

We have currently implemented two of the seven phases of risk management that we have planned. We intend to continue building out the platform to help us better monitor risks in areas such as process, IT, vendor management, and more. We are confident that the Fusion Framework will support us in all such endeavors to strengthen our enterprise risk management program.