Using Indications and Warnings (I&W) Analysis to Manage Organizational Risk

The Center for Protective Intelligence has partnered with Scott McHugh who works for the Institute for Homeland Security at Sam Houston State University to develop this piece.

One of the main reasons we created the Ontic Center for Protective Intelligence (CPI) was to share industry tools, best practices and lessons learned to help those who protect be more successful.

Since we created the CPI, we have spoken to many organizations working to expand their scope beyond tactical and operational security risks, creating a more mature risk analysis program that includes strategic risks. . One of the most interesting and useful strategic analysis tools we have seen is the use of the indications and warnings (I&W) analysis methodology applied to organizational risk management.

The I&W technique is not new – it has been used by the US intelligence and defense community for years as a means of quantifying risk and understanding threats posed by emerging geopolitical situations around the world. An I&W framework is not intended to predict whether a specific event will occur – rather it is intended to alert decision makers that the likelihood of a risky event is increasing or decreasing, creating a quantifiable and proactive way to determine when a organization should modify its risk posture to avoid surprises and prevent losses.

In the private sector, Scott McHugh is an enterprise security leader who pioneered the use of indications and warnings analysis for organizational risk analysis. While leading enterprise security teams for large multinationals in the retail and petrochemical industries, Scott implemented I&W frameworks to help decision-makers understand and contextualize geopolitical risks and supply chain that could disrupt business continuity. Its I&W deliverable gave business decision makers quantifiable early warning of potential risks that could interfere with the achievement of business goals. He is now at Sam Houston State University Institute for Homeland Security Train security professionals responsible for critical infrastructure protection on how to implement the I&W methodology as part of their security management program.

The methodology itself is an advanced analytical technique. Although I&W frameworks are created to be easy to understand and to transparently describe the reasons behind their conclusions, the methodology can be complex to implement.

Analysts first identify their most pressing intelligence issues (requirements) and identify components (indicators) within the intelligence issues. The analyst then determines how best to collect and assess information about the indicator and determines whether the indicator is an “active” or “dormant” component of the intelligence question.

Once the analyst has created a robust indicator framework, inputs can be presented to decision makers via a risk dashboard in a transparent and quantifiable way, helping decision makers understand when indicators activate (or deactivate) and thus provides a warning to be taken into account. implement measures to mitigate the risk.

Key Benefits of the Indications and Cautions Methodology

Contextualize analytical information

Many decision makers find it difficult to integrate and accept analytical results if they do not have a concrete understanding of the underlying data and the rationale behind the conclusions. An I&W analysis methodology helps analysts and decision-makers clarify the specific factors impacting a situation, the scope and magnitude of risk triggers that cause change, and the ultimate impact of how those triggers might have an impact on the risk environment. An I&W framework creates a clear account of the context of risk factors and the steps analysts followed to reach their conclusions, giving decision makers greater confidence in the process and its conclusions.

Quantify the probability of risk events

The subjective nature of many strategic and geopolitical risks makes it very difficult for many organizations to quantify the impact of these issues, especially when it comes to incomplete and ambiguous information that is commonly encountered. An I&W methodology allows the analyst to break down a problem into its component parts and create the means to measure how potential changes may impact the situation over time, potentially also identifying the financial impacts of the change on the organization. . Identifying and specifically measuring the potential impact of various trigger points helps a decision maker see the potential significance of each change before an escalation becomes a critical issue, thus avoiding surprises and enabling changes as soon as possible.

Reduce analytical bias

Overcoming human biases in analytical products is a traditional problem in intelligence analysis, due to creator and reader biases. I&W frameworks can help alleviate this problem by breaking down a requirement into its component parts and explaining

the specific reasoning behind each item. Analytical biases can be checked by carefully evaluating each of the criteria, then determining and using the most objective data and measures available to monitor risk. Similarly, understanding the components of each problem helps an analyst understand their analytical gaps, work to fill them, or incorporate an appropriate level of uncertainty into the analysis.

Establishing an I&W framework in your organization takes considerable effort, but the payoff can be transformational in terms of understanding and responding to the changing risk landscape and doing it in a way that decision makers understand.

For organizations looking to create a more mature analytical framework to proactively support decision makers, the I&W methodology can be an essential part of the risk management toolkit to promote analytical transparency and confidence while generating quantifiable conclusions. that reliably identify emerging risks which in turn lead to security risks. managerial decision making.

Looking for other ways to manage organizational risk? Discover our solution to anticipate and reduce corporate liability.

The post Using Indications and Warnings (I&W) Analysis to Manage Organizational Risk appeared first on Ontic.

*** This is a Security Bloggers Network syndicated blog from Blog Archive – Ontic written by Ontic. Read the original post at: https://ontic.co/blog/using-the-indications-and-warning-iw-analysis-to-manage-organizational-risk/

Aubrey L. Morgan