Understand the risk. IT creates business risk, notes Scott Crawford, a security expert and research director with Enterprise Management Associates. Knowing what those risks are is the first step in managing them. The increasingly prevalent insider threat should be addressed through access control and identity management systems.

Treat IT risk management as a business investment. Aligning IT risks with business requirements will help you allocate the resources you need to manage those risks, Crawford says.

Reevaluate risks regularly. Periodic reevaluation of risks and controls should be part of any business's IT control strategy, not just when a problem occurs. Nevertheless, you should reevaluate your risk management strategies if your controls fail, as they apparently did at Société Générale.

Use the right controls, and make them secure. You can have all the controls in the world, but if they can be easily compromised they won't do you much good. Likewise, if you have the wrong controls, or not enough of them, you're equally ill-equipped to manage risk. Implement the proper controls and grant access to your systems to only the right people, Crawford advises. Then monitor and constantly reevaluate the controls.

Compliance isn't the same as security. Securing your systems and data may make you compliant, but being compliant doesn't necessarily make you secure. If your controls satisfy your regulatory requirements, but don't mitigate risk, then they are not adequate.