| IT risk management is the ongoing work of identifying, assessing, treating and reviewing the technology risks that could affect your business, so that each one has an owner, a decision and a review date. It covers cyber security risks alongside wider dependencies such as ageing systems, failed changes, suppliers and specialist knowledge. |
This guide shows business owners and managers how to turn technology risks into owned decisions, actions and review dates. It covers a simple process, a consistent way to score risks, what a risk register should record, and a worked example you can adapt.
For help with the controls themselves, see our cyber security services, or our managed IT services for ongoing support.
What is IT risk management?
IT risk management is a cycle rather than a one-off project. You agree what matters, identify what could go wrong, decide how serious each risk is, choose what to do about it, and review it as the business and its technology change.
The aim is not to remove every risk, which is not possible, but to make deliberate decisions about which risks to reduce, share or accept, and to know who is responsible for each one.
How is IT risk management different from cyber security?
Cyber security manages risks to the confidentiality, integrity and availability of systems and information, including malicious attacks and accidental events. IT risk management brings those risks together with wider technology dependencies, such as unsupported systems, failed changes, supplier concentration and loss of specialist knowledge. The two overlap. Business leaders need one view of how these risks could affect operations and objectives.
Why does it matter for NZ businesses?
Controls reduce the likelihood and impact of incidents; they do not guarantee prevention. IT risk management is how a business decides which controls are worth funding. It also supports other obligations. The Privacy Act requires reasonable safeguards for personal information under IPP 5, and a risk register helps show the decisions behind them, although it is not the only way to demonstrate safeguards or a guarantee of compliance. Insurers and larger clients may ask about your controls, and what they require depends on the policy or contract.
Start by agreeing the scope
Before starting IT risk management, agree four things:
- Scope. Which parts of the business and which systems the exercise covers.
- Critical activities. What the business needs to keep doing, such as taking orders, paying staff or serving clients.
- Decision authority. Who can approve spending on a risk and who can accept one.
- Risk tolerance. How much disruption or exposure the business is prepared to live with, expressed in practical terms such as maximum downtime for an activity.
Start with what the business needs to keep doing, then map the systems, people and suppliers behind each activity. That keeps IT risk management tied to business outcomes rather than to a list of technology.
A simple IT risk management cycle
The four stages below are a practical model rather than the only framework. Larger organisations may use a formal standard, but the same questions apply.
- 1. Identify. List the scenarios that could disrupt a critical activity or expose information.
- 2. Assess. Rate each scenario for likelihood and impact, taking existing controls into account.
- 3. Treat. Decide whether to avoid, reduce, share or accept each risk, and assign the actions.
- 4. Review. Check progress, test whether controls work, and reassess when things change.
How do you identify IT risks?
Identification is the first stage of IT risk management. Look across three layers: the technology, the people who use it and the processes that connect them. For each critical activity, ask what would happen if a system stopped working, if its data were stolen or leaked, and who would notice and how.
Risks to look for include:
- Account and email compromise. Phishing, business email compromise and weak or reused passwords without multi-factor authentication.
- Unsupported or unpatched systems. Software and devices that no longer receive updates.
- Backups that have not been tested. Recovery that nobody has proved works.
- Mistakes and failed changes. Accidental deletion, misdirected information and updates that break something.
- Supplier dependencies. Cloud services, internet providers and software vendors the business relies on.
- Concentration. One person who knows how a system works, one internet connection, one backup destination.
Concentration is easy to miss. The dependency is already a risk; a failure only reveals or realises its consequences.
How are IT risks assessed and prioritised?
Score a defined scenario over an agreed period, using the same likelihood and impact definitions throughout. A phishing email arriving is not the same event as an account being compromised. Record the controls already operating, what is known about their effectiveness, and any uncertainty in the rating.
A 1 to 5 matrix is a prioritisation aid, not a precise calculation of financial risk. Two scenarios can have the same score and very different consequences. Escalate severe-impact risks, mandatory obligations and critical dependencies even when their score is lower. Record the remaining risk after treatment and who can accept it. Consistent scoring is what makes IT risk management comparable over time.
Our guide to a cybersecurity risk assessment covers the security assessment in more depth, and a business impact analysis helps put realistic figures on impact. Business.govt.nz also publishes a free risk management worksheet.
What goes into an IT risk register?
The register is the working tool of IT risk management. Each entry should record:
- Business activity and risk scenario. What could happen and what it would affect.
- Existing controls. What is in place and whether it has been shown to work.
- Current assessment. Likelihood, impact and any uncertainty.
- Treatment and actions. The decision, the action owner, the due date and the status.
- Business risk owner. The person accountable for the risk, who may not be the person carrying out the work.
- Remaining risk and acceptance. The exposure left after treatment and who has authority to accept it.
- Review date. When the entry will be looked at again.
A worked risk register example
Illustrative example only. It describes a fictional business, not Exodesk delivery or a client result. Agree your own scoring thresholds before using the ratings.
| Field | Example entry |
|---|---|
| Business activity | Dispatching customer orders from the main office. |
| Risk scenario | If the sole internet connection fails and no alternative is ready, staff may be unable to access the cloud dispatch system. |
| Existing controls | Router monitoring and mobile phones. Backup connectivity has not been configured or tested. |
| Current assessment | A material outage is plausible over the assessment period. Impact is high if dispatch stops. Duration and workaround capacity need checking. |
| Treatment and action owner | IT lead to configure and test a suitable backup connection with the dispatch team by an agreed due date. |
| Business risk owner | Operations manager, accountable for dispatch continuity and the treatment decision. |
| Remaining risk | Backup coverage, capacity, power and the dispatch platform remain dependencies. Reassess after testing; do not lower the rating merely because equipment was ordered. |
| Decision and review | Record approval, progress and next review date. Review after the test, a material supplier change or an outage. |
Our guide to business internet covers what happens when the connection drops and the backup options.
How do you treat IT risks?
Treatment is where IT risk management produces results. For each risk, choose one of four responses. The choice depends on the cost, the business impact and the tolerance you agreed at the start.
- Avoid. Stop the activity that creates the risk, such as retiring an application that can no longer be secured.
- Reduce. Add or improve controls that lower likelihood or impact, such as multi-factor authentication or tested backups.
- Share. Use insurance or contracts to share some of the financial exposure.
- Accept. Live with the remaining exposure as a recorded, authorised decision.
Sharing and accepting risk
Insurance and contracts can share some financial exposure, subject to their terms. Outsourcing can place agreed tasks with a specialist, but it does not make the business impact disappear. Record what remains with your business and who is responsible for it. Check disclosures, conditions and exclusions with your insurer or broker; our guide to cyber insurance covers the technical questions.
Accepting a risk means an authorised business owner agrees to live with the remaining exposure for a defined period. Record the reason, any conditions and when the decision will be reviewed. A low treatment budget does not override a legal or contractual duty.
How controls fit in
Controls fall into three groups. Preventive controls reduce the chance of an incident, such as access controls and patching. Detective controls help you notice one, such as monitoring and alerting. Corrective controls limit damage and restore operations, such as backups, incident response and a business continuity plan. Tie each treatment decision back to the controls it relies on, and check that they work.
What happens at a risk review?
The review is what keeps IT risk management current. Review the highest exposures, overdue actions, changes in dependencies and controls that have failed or remain unverified. Decide what to fund, change, escalate or accept. Track an agreed tolerance such as maximum dispatch downtime, rather than reporting only how many risks appear on a register.
Set the review frequency around the exposure and pace of change. A quarterly management review can be a useful starting point, with earlier reviews after incidents, major system changes, new suppliers or failed controls. Urgent risks and overdue actions need attention between meetings.
Tie approved actions into your IT strategy and budgeting, so risk-driven work is weighed against other priorities rather than handled as a side project.
Why IT risk management fails
It fails when the register becomes paperwork rather than a working tool, or when risk is treated as an IT problem alone. Risk decisions are business decisions, because they trade cost, productivity and exposure. Warning signs include:
- No named owners. Risks sit on the register with nobody accountable.
- No business input. Treatment decisions are made by IT without the people who carry the impact.
- No link to budget. Identified risks do not reach the spending conversation.
- Untested controls. Ratings are lowered on the assumption that controls work.
- No reassessment after change. New systems, suppliers or incidents do not trigger a review.
IT risk management with Exodesk
Through our managed IT services, Exodesk supports IT risk management for clients. We help identify and assess technology risks, keep the IT risk register current and run regular risk reviews, and implement and operate the agreed technical controls. Your business keeps ownership of the decisions: which risks to treat, which to accept and how much disruption is tolerable.
Frequently Asked Questions
What is IT risk management?
IT risk management is the ongoing work of identifying, assessing, treating and reviewing the technology risks that could affect a business. Each risk gets an owner, a decision and a review date. It covers cyber security risks along with wider dependencies such as ageing systems, suppliers and specialist knowledge.
What is the difference between IT risk management and cyber security?
Cyber security manages risks to the confidentiality, integrity and availability of systems and information, including malicious attacks and accidental events. IT risk management brings those risks together with wider technology dependencies, such as unsupported systems, failed changes and supplier concentration. The two overlap, and business leaders need one view of both.
What are the stages of IT risk management?
A simple practical model has four stages: identify, assess, treat and review. Before starting, agree the scope, the critical business activities, who can make decisions and how much disruption the business can tolerate. The cycle repeats as the business and its technology change.
What goes into an IT risk register?
Each entry records the business activity and risk scenario, existing controls and whether they work, the current assessment, the treatment decision and actions, the business risk owner and action owner, the remaining risk and who can accept it, and the next review date. It is a working tool rather than a document to file away.
Who owns IT risks in a small business?
A business owner or manager should be accountable for each risk and the decision to treat or accept it. An internal IT person or external provider can assess the technical exposure and carry out agreed actions. Assign the action owner separately so responsibility is clear.
How often should we review IT risks?
Set the review frequency around the exposure and pace of change. A quarterly management review can be a useful starting point, with earlier reviews after incidents, major system changes, new suppliers or failed controls. Urgent risks and overdue actions need attention between meetings.
What is residual IT risk?
Residual risk is the exposure that remains after controls are applied. Check whether the controls work before reducing the rating. The business owner then decides whether the remaining risk is within the agreed tolerance or needs further treatment.
What are the four ways to treat an IT risk?
Avoid the activity that creates the risk, reduce it with controls, share some of the financial exposure through insurance or contracts, or accept it as a recorded and authorised decision. Outsourcing can place tasks with a specialist, but the business impact and some responsibilities stay with the business.
How is IT risk management linked to the Privacy Act?
IPP 5 of the Privacy Act requires reasonable safeguards for personal information. A risk register helps show the decisions and accountability behind those safeguards. It is not the only way to demonstrate them and does not guarantee compliance on its own.
Can a small business do IT risk management without a dedicated team?
Yes. An IT provider can support IT risk management by identifying and assessing the risks, keeping the register current and carrying out the agreed technical work. The business keeps ownership of the decisions, including which risks to accept and how much disruption it can tolerate.
NEXT STEP
Need help turning your IT risks into a practical plan?
Talk to Exodesk about the systems your business depends on, the gaps that matter and the work needed to reduce them. We work with businesses across New Zealand.
Or see our managed IT services.
