In its December 1997 issue, The Systems Thinker newsletter featured an article entitled "Putting Best Practices into Practice". Its authors, Charles Parry, Marilyn Darling and Stever Robbins discuss how sharing best practices can be an important driver for success within an organization. The article focuses on five principles for sharing and implementing best practices. Some 12 years later, these principles are still applicable so I thought it might be a good idea to share them again.

Now more than ever, business leaders are being asked not only to manage their technology investments, but to develop integrated and comprehensive solutions that address privacy, security and regulatory compliance. Similarly, IT managers are being asked to manage technology in a way that brings value to the enterprise by reducing risk, increasing customer confidence and increasing the efficiency of business processes.

In my last post, I discussed the importance of senior executive involvement in the risk management function. In this post, I'll take a look at some common risks. There is no universally accepted set of risk definitions; however industry experts agree that they fall into the following broad categories:

Project - the risk that an IT project will fail to meet objectives due to poorly defined requirements; inadequate project sponsorship; loss of project resources; project scope; insufficient project management processes or organizational maturity.

Understanding and proactively managing IT risks is a key component of IT Governance. Effective risk management provides senior executives with the visibility needed to make critical business decisions regarding IT investments and the information necessary to determine how IT impacts the business. Risk management does not involve only identifying the negative impacts that IT might have on the business.

In order to secure critical business information and protect against e-crimes, you need a game plan - an effective security governance program. Generally speaking, the goal of any governance program is to mitigate risks. Other goals include ensuring that your business is in compliance with regulations, setting an example for how business is to be conducted within your company, and protecting the business, its assets and customers against theft. In the case of a small business, establishing an effective governance program is a step towards positioning the business for future growth.