In the corporate world, security professionals often face an uphill battle. Despite their crucial role in protecting organisations from ever-evolving threats, their business peers frequently view them as undereducated. This perception undermines their authority and limits their ability to make strategic decisions aligning with the organisation’s goals. Here I look at the ASIS report, “THE INFLUENCE OF SECURITY RISK MANAGEMENT: Understanding Security’s Corporate Sphere of Risk Influence,” released in June 2023, and what it says about these challenges and how to overcome them.
What the ASIS report on the influence of security risk management found
Limited influence
Corporate security professionals are often labelled as specialised technical professionals rather than business enablers. This pigeonholing restricts their decision-making authority and influence compared to general managers. It’s time to break free from this stereotype and showcase the multifaceted skills and knowledge that security professionals possess. Showing how security events affect strategic objectives increases their influence. It also establishes them as indispensable contributors to business success.
Operational vs strategic focus
Climbing up the risk hierarchy, security is frequently viewed as an operational risk concern with limited strategic implications. While general managers prioritise risks directly impacting strategic objectives, security risks are often relegated to a lower position. To enhance their influence, security professionals must show how security incidents can disrupt strategic goals. The result can be reputational damage, financial loss or regulatory non-compliance. They can secure a seat at the decision-making table by linking security to broader organisational risk categories.
Lack of enterprise-level recognition
Cybersecurity risk receives due attention because of its strategic importance. Physical security risk, by contrast, often gets treated as merely a subset of operational risk. Security professionals must strive to integrate security disciplines collectively into the broader organisational risk framework. Professionals who understand how risks connect across the enterprise gain influence and the recognition they deserve.
Communication with decision-makers
Speaking the language of risk, security professionals need to bridge the communication gap with corporate decision-makers, including general managers. Developing the skills to identify, engage, and communicate directly with key stakeholders is essential. Aligning the security risk message with organisational objectives helps convey its value. It also earns the buy-in security needs for decision-making authority.
Separation of risk diagnosis and treatment
Security professionals often need more autonomy to move from risk diagnosis to treatment with approval from higher-level managers. Recognising that risk diagnosis and treatment are distinct decision processes is vital. Security professionals can support informed decisions and timely mitigation. The key is to set out the business impact of each risk, with a cost-benefit analysis of the treatment options.
Organisational context
Legislation and compliance-driven actions, the influence of security professionals is significantly influenced by the organisational context. Security professionals tend to wield more authority in environments where security is legislatively mandated, such as industries dealing with sensitive data or critical infrastructure. However, in non-mandated settings, security risk management often takes a backseat to compliance-driven actions, hampering the influence of security professionals. Security leaders should advocate for proactive risk management, and a culture of protection, in every industry.
Professional respect and perception
Many people still see corporate security as a profession for those from policing or military backgrounds, rather than university-educated specialists. Security professionals must enhance their business acumen, pursue certifications, and bridge the gap between academia and practice to gain professional respect. With the right skills and qualifications, they can challenge misconceptions. They can then stand alongside traditional professions like law or accounting.
Language and communication barriers
The sheer number of risk management models and terms often causes confusion, and that weakens the influence of security professionals. To overcome this challenge, security professionals must become proficient in translating security risks into the language of business, something I cover in this guide to justifying your security budget. Using business metrics, and showing how security measures support organisational objectives, gets the message the attention it deserves.
Individual characteristics and leadership
Security as a specialised field may have limited corporate influence. Individual security professionals, though, can achieve far more through personal leadership. Education, experience, communication skills, and the organisational risk context all play a role in determining an individual’s influence. By developing these qualities and leading in their own roles, security professionals can move past those limits and drive change.
Conclusion
The challenges faced by security professionals in gaining influence and recognition within their organisations are real and multifaceted. However, by embracing the recommendations outlined in the ASIS report, security professionals can break free from undereducated perceptions and shape their sphere of influence.
It is time to redefine security professionals as business enablers. They should work hand in hand with other departments to protect the organisation and contribute to long-term success.
Together, let’s unleash the power of security professionals and create a safer and more resilient future for our organisations.
Get the full report at https://store.asisonline.org/the-influence-of-security-risk-management-understanding-security-s-corporate-sphere-of-risk-influence.html