Managing Risk and Information Security: Protect to Enable

CHAPTER 3

Governance and Internal Partnerships

How to Sense, Interpret, and Act on Risk

If we are together nothing is impossible. If we are divided all will fail.

—Winston Churchill

To reduce cost, the company’s human resources group wants to outsource payroll processing. At first glance, this might seem a low-risk decision. There’s a clear business case, and outsourcing payroll doesn’t create risks to corporate information assets such as intellectual property. Most businesses regard payroll as a commodity application, so they might tend to select the supplier who can process the payroll at the lowest cost.

But there’s more to consider. Employees’ ...