5. Effective IT risk management processes reduce costs and can provide top-line benefits.
Most organizations are expecting a high return on their investment in IT risk management. They are looking to achieve enhanced business value in the form of process, risk and control efficiencies; elimination of redundancies; expense reduction; issues and risk prioritization; risk mitigation; greater return on investments; more effective resource management; and legal and regulatory compliance. While the direct, bottom-line cost savings from an effective IT risk management program can be significant, it is the top-line benefits that result from actionable risk reporting, more strategic investments and enhanced organizational performance that will be significantly more valuable over the long term to the individual organization and the financial services industry as a whole.

The Future of IT Risk Management

Based on the current marketplace, it will take two to three years on average to build an effective and mature IT risk management framework that will enable organizations to better manage their IT risk and compliance requirements. Businesses will realize the convergence of key processes that will in turn create integrated approaches, and ultimately promote coordinated risk and control activities. Firms will realize that incorporating IT risk management into their overall enterprise risk management programs can help protect client information, safeguard assets and provide shareholder value without stifling innovation. Doing so will not only improve performance but can also reduce costs and minimize events that may negatively impact the organization.

Regulatory compliance will continue to be a key driver impacting IT risk management programs. The challenge will not only be an organization's ability to take a risk-based approach to regulatory requirements, but also to recognize the many other business benefits resulting from an IT risk management program. Overcoming these challenges will contribute significantly to increasing the maturity and effectiveness of an organization's IT risk management program. The ultimate benefits could include control optimization, rationalization of appropriate investments, balanced decision making, reduced overall costs to the organization and more timely identification of new risks.

Bill Barrett is a partner and practice leader of the Technology and Information practice in Ernst & Young's New York Financial Services Office. He can be reached at 212-773-2999. Tim Purtell is a senior manager in the same practice and can be reached at 212-773-1232. For a copy of Ernst & Young's Managing Information Technology Risk: A Global Survey for the Financial Services Industry, please contact Tim Purtell.