CIOs are the executives best positioned to champion enterprise risk management. Use this five-step leadership strategy to get the ball rolling.

Reader ROI

• Why CIOs are taking a leadership role in enterprise risk management
• The leadership skills essential for the ERM effort
• Ways that CIOs demonstrate ERM leadership

Many CIOs are now faced with the challenge of managing enterprise risks, for the simple reason that businesses depend more than ever on IT to be able to function (see "CIO, It's You", page 53). Yet enterprise risk management (ERM) is complex; it's esoteric; and it requires a culture change that is frequently resisted by organizations, because people view identifying risks as a form of criticism.

To get the ERM ball rolling, CIOs need a leadership strategy. So we synthesized one based on interviews with nearly two dozen consultants, academics and CIOs who are practising ERM. You'll notice that the five steps in this strategy apply to many other leadership challenges. Here's how to make them work for ERM.

STEP 1: FIND INSPIRATION

Some CIOs find the inspiration for ERM unavoidable: Without an enterprise-wide view of risk, people could die. For example, IT has become central to the way the US Navy fights. The CIO for the Department of the Navy, Dave Wintergreen, is in the midst of deploying an enterprise-wide Navy-Marine Corps intranet, which, when completed this year, will provide a standard way for land bases and ships at sea to exchange real-time battle information. If the system fails, sailors and fighter pilots won't get the information they need in combat, Wintergreen notes. The September 11 attack on the Pentagon, which took out the Navy command centre, exposed the risk to military operations from locating communications equipment in a single location and underscored for Wintergreen why ERM is critical.

But sometimes, especially if you've been handed a mandate from the CEO or the board of directors to deploy an ERM strategy, it takes a little more work to convince yourself of ERM's value. Up until the mid-1990s, executives at JP Morgan made decisions about investments in new business ventures based on the forcefulness of the executive making the argument. That strategy led to some unpleasant surprises for the bank when new investments didn't work out as well as they could have, says Bill Sharon, the bank's former chief risk officer for technology, who is now a consultant. JP Morgan executives, Sharon recalls, would decide to open offices in new countries without considering a range of operational risks, including the impact on IT and telecommunications.

The bank's chairman at the time asked executives for a better decision-making process for choosing investments. Sharon, working with the head of the bank's corporate real estate business, took the initiative to devise a process for scoping out the requirements - including the IT needs - for any new business initiatives. When he was finished, he realized that the process he had developed amounted to analyzing enterprise risks; he became sold on ERM.

Sharon asked people in every department how they were affected by a new business initiative. He then developed a list of conditions to address before someone could present a new product or location to the executive committee, including what IT investments or support were needed. For the project to be approved, the project sponsor had to gather information from each business line or department to demonstrate that they had addressed the necessary implementation issues. For example, if a new office was opened in Mexico City, project sponsors had to report on how many computers would be needed, the network connections required and the reliability of electric power. None of these questions were being asked routinely, yet they were often critical to a new venture's success.

"I learned that your responsibilities in IT or anywhere in the business aren't bounded," Sharon explains. "You can't just do your piece and go home. Second, in [IT], no one really knows what the business strategy is. That's when I realized ERM gets people on the same page."