What is the task or mission?

This may seem obvious, but knowing the mission makes a big difference in the risks you will ultimately evaluate. Focusing on the wrong goals will waste time and could lead to mitigating the wrong risks. In addition, the task will help to identify the your stakeholders.

Stakeholder is a big word for who cares about task. This could be as minor as an individual or a large group numbering in the hundreds. Stakeholders will be useful in identifying risks as they will be impacted by failure of the task.

In our running example, the obvious stakeholders are you and your boss. Beyond those you might want to expand the circle a bit. Maybe include your family, coworkers, clients. If you expand the circle extremely wide you could include your fellow commuters. At some point you do need to decide which of the infinite number of possible stake holders actually have enough of a reason to care as you won’t be able to track them all.

By this point, you’re probably wondering what all this has to do with Identifying risks. These first two pieces are important in bringing the right people together to help out. Identifying risks works better when you have multiple minds involved. Everyone has their own biases as to what counts as a risk and how severe it is. The intent with involving multiple participants is to average out these biases and help develop a consensus view.

Next time we’ll look at some of the techniques you might use in these groups to facilitate risk identification.

Everything we do, every day, has some measure of risk in it. How we respond to every risk is different. What we want to try to do is gather the information related to each risk and come to some agreement as to the response. This is usually a simple exercise for yourself. Even on a family level the decisions are not usually that fraught with difficulty. Expand this with an organization, involving thousands of stakeholders, it becomes more like herding cats.

Let’s start with a scenario that commuters are familiar with. Your boss wants you at work by 9am. You live about 30 minutes away. When do you leave the house? I’m sure we all make these decisions quite readily and without putting a lot of thought into it. But for this exercise let’s break it down by asking a few questions.

1. What is the impact of being late?
2. What is the likelihood that you’ll be late?
3. What can I do to avoid being late?
4. How much does it cost be to not be late?

What is the impact if you’re late? Basically, what’s the penalty? The answer probably depends on your boss, your schedule, and how late. If you had a meeting scheduled first thing that would probably be a bigger problem than if you had a one hour buffer.

In a given month (20 working days) how many times are you late? Is there generally a lot of traffic so the commute takes longer? Maybe you take the train and it is almost always on time. Even when the train is late you never end up more than 10 minutes late.

Next we are asking about what you can do to not be late. We call this a mitigation strategy. The obvious one is to leave earlier. But let’s think broader. Maybe you could move closer, or change the mode of transportation you use (helicopter?). Could you adjust your expected arrival time?

The last question is extremely important. For the options you come up with above what is the cost of doing it? Leaving earlier probably doesn’t cost much, but think about the value you place on time, or maybe taking an earlier train costs more because of peak pricing. Renting a helicopter could be really expensive, but maybe moving closer is ultimately cheaper (less gas, lower taxes …). I would also consider the opportunity cost of leaving earlier or buying a helicopter. Leaving sufficiently early may mean you can’t eat breakfast, or take your kids to school.

After you go through and look at each of these questions you can now compare the cost of being late to the cost of being on time. This is a very important point about why we do this. There is a cost associated with any option you choose. Ideally you are now able to balance the cost of being late and the costs of being on time and decide on the best time to leave the house or potentially completely change the options you have. You could choose a short-term plan and a long-term solution as well.

This example probably took a lot longer to come up with an answer than you use every single day. But effectively this is what we do when evaluating risk and trying to manage it. Most of what I do is managing risk related to IT infrastructure, but again, the concepts here can extend to just about any other field.

Something I do want to clarify before finishing out today, is that risk management is not the same as compliance auditing. In my opinion compliance auditing is a mindset and a process born from our desire to make checklists to reduce deviation. This is a well-intentioned process, and is very effective in some situations. When we overuse checklists we often stop thinking about the reason for the rules. When something goes wrong we blame the checklist. Taking away flexibility, the ability to think keeps us from creating effective, efficient solutions; sub-optimal results. This is why I focus on risk management and not just pure compliance. Risk management allows adults to make decisions based on a variety of factors.

Another goal is to get better at explaining things in common language. People in my industry and every other industry have a habit of communicating with everyone the same way. We expect everyone to understand our jargon, use the same language, or think the same way. Obviously that doesn’t work. Even some people in the same field can have differing terms for the same thing. I cannot even count the number of disagreements I have had with team members that resulted from differing definitions of the same terminology.

Finally this is also a learning tool for me. I have always found it easier to learn something when I am ultimately required to teach it. If I have to teach about these topics in this forum, there is a hope that I will better understand what I need to know to begin with and get better at my job. So since my primary job is currently focused on managing a team of security analysts, I am going to focus these posts on Security and Risk Management. Most of my examples will come from the information technology or information assurance field, but apply to other areas  such as physical security, finance, and personal decision-making.

Today’s post is just an introduction for my plans. I am hoping to keep to a plan of posting something new every week. If no one ever reads this stuff and recommends topics I’ll just use whatever random topic comes up that week. Who knows how long I will keep this up, but if I can get 25 solid posts in the next year I’ll be pretty happy. So the planned first topic for next week will be an Introduction to Risk Management, where we will go into some basic terms and concepts to set the groundwork. The intro may end up spanning two or three posts. After that I definitely want to talk a little about the book on security convergence that I’m reading now.

No one has ever said my writing is elegant and graceful.

Your artical is simple however retains a little elegance and also grace. And using the options and also customization you’ve got enabled, I’m sure it will eventually appeal to a lot of bloggers. It’s rather commendable that you are interested in let individuals, the people, to employ a wide range of themes for the blogs. Keep these individuals coming!

This one is spot on. His site has nothing to do with what I said.

[...]I’m so impressed with how well this article was gathered and put together. It’s well formatted and written. Quality work like this is a rarity. I appreciate the information and I agree with the author. Although unrelated to my blog, worth linking …

This one actually tried to write something intelligable but his site doesn’t even use WordPress.

Your artical is simple however retains a little elegance and also grace. And using the options and also customization you’ve got enabled, I’m sure it will eventually appeal to a lot of bloggers. It’s rather commendable that you are interested in let individuals, the people, to employ a wide range of themes for the blogs. Keep these individuals coming!

Contact Information

I really don’t understand why you would not include basic contact information on your resume. You have no idea how that resume will get to someone and any other artifacts associated with that resume can easily be lost. I would say a phone number and email address is the perfect combination, and preferably a cell phone number. If you are applying outside of your company, or want to post a resume for people to scour, a personal email address is best.

If you are applying for an internal position though, I would highly recommend that you use your company email address. It doesn’t take that much effort to update that and apply. It helps to remind the reviewer that you are an internal candidate.

Dates

Please, please, please put month and year. When you only put the year down or nothing it makes it really hard to figure out how long you were really at a position. Were you there for a month or 12? The margin of error on a guess like that is just too high. My particular contract requires that I am able to confirm the years of experience down to the month, so without that information I can’t figure out how much I can bill you out for.

Degrees, Certifications, & License

I understand the desire to apply for positions for which you are slightly under qualified for as a stretch. There’s also a desire to push the boundaries a little and prove that you can do the job. I can definitely relate, as I wasn’t fully qualified on paper for my first job, but I knew I could do the work. If a position calls for a bachelor’s degree and you are going to graduate soon, sure put that on the resume and list the expected date.

In terms of certifications and licenses I don’t think you should list plans for these on your resume. If you don’t have them, you shouldn’t highlight that fact or try to confuse us by saying you took a boot camp or class for that certification. It might help you through the automated screening tools because the certification name shows up on the resume, but when I read that you took the class back in 2009 and still did not obtain the certification two years later, it just suggests to me that you did not learn enough from the course to pass the test. That’s probably not the impression you want to leave.

I might grant an exception if it’s the type of license or certification that requires multiple exams and you’ve passed most of them so far and have a schedule for completion. Just make sure it’s up to date. I’ve seen a lot of resumes where the planned certification was years ago.

Another note on education. I know that there are a lot of alternative school programs out there. Far be it from me to judge the quality of the education that these programs offer. There are a huge variety of learning styles, ability, desire to succeed, and life situations that make a bigger impact on your knowledge base than just the school you attend. That being said, if you are planning to attend a degree granting program, i.e. bachelors, masters, doctorate …, at least make sure the program is accredited. The US Department of Education maintains a database of these schools that is easily searchable, and your institution should also proudly display their accreditation on their website. The accreditation doesn’t guarantee you’ll learn something, but it does show that a group has reviewed the program and feels that the program and process of education is conducive to education. To me accreditation is a minimum bar for the institution.

You work for whom?

A final story that I want to share. We had an interview a little while back. We looked at his resume and thought, “This might be worthwhile to talk to Bob” (not his real name). He seems to have the right experience and it looks like he worked for us 10 years ago.

As we were going through the interview Bob kept mentioning tools and systems that we are using today at my company and we were shocked at how much he knew about our organization. It wasn’t until the last 10 minutes of the interview did we figure out he actually still works for our company. The way he had written his resume it looked like he left us 10 years ago and started working directly for government. Turns out he was just working on a contract for the government but still employed by us.

Obviously the format of his resume did not make that clear as we were all dumbfounded at the realization. It also did not help that he listed his government email address as his primary contact. This goes back to the issue of applying for an internal position. If he had at least listed his internal company address and not his client site address we may gotten the hint.

In other news, I’ve been reading a lot of random books lately and will do my best to post a summary of what I liked. So first on this list is two series by Joseph Robert Lewis. So in the interest of full disclosure Joe works for me, but he is writing a lot of stuff in his free time. Not sure how he does it. He is self publishing his material for Kindle and Nook. They aren’t expensive, but well worth the read. It’s mostly sci-fi/fantasy, but it’s probably best to go to his site and really get a good idea. Really interesting story lines and well worth the money and time. I’ve forced myself not to pick up his two most recent releases only so that I can get through some required reading and studying of my own and will allow myself the pleasure of reading his new stuff as reward. So drop by his page and tell him I sent you.

This first one, David is pinning flowers on Paul.  David pinned flowers on all the guys.  It was fun getting to know him and extremely helpful all day.

I’m sure you can figure out what’s going on here.

And this was probably one of the best shots of the day.