ZAZOON AG

Effective risk management has become essential not only for preserving value but also for capitalizing on opportunities. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) has developed a comprehensive framework that meets these needs.

What is COSO?

Founded in 1985, COSO is a voluntary private organization dedicated to improving enterprise performance through effective internal control, risk management, governance and fraud prevention. It is best known for its two main frameworks: the COSO Internal Control-Integrated Framework and the COSO Framework.

Evolution of the COSO Framework

Originally published in 2004 and updated in 2017, the COSO Framework has evolved to better align risk management with strategy and performance. The 2017 update, titled “Enterprise Risk Management – Integrating with Strategy and Performance,” emphasizes the importance of embedding risk management practices throughout the organization to improve decision-making and achieve strategic goals.

Key Components of the COSO Framework

The updated COSO Framework consists of five interrelated components:

Governance and Culture: Sets the organizational tone and outlines the structure for risk management. It emphasizes the importance of board oversight and a risk-aware culture.

Strategy and Objective Setting: Ensures that risk considerations are integrated into the strategic planning process. This component helps organizations align their risk appetite with their strategy and set objectives that support risk-informed decisions.

Performance: Includes identifying and assessing risks that could impact the achievement of objectives and implementing risk responses to manage those risks within the organization’s risk appetite.

Review and Revision: Focuses on monitoring the performance of the organization’s risk management and making necessary adjustments. This component ensures continuous improvement and adaptation to changing business environments.

Information, communication and reporting: Emphasizes the importance of effective communication and reporting mechanisms to support risk management activities and inform decision-making across the enterprise.

Integrating risk management into business strategy

A key benefit of the COSO framework is its ability to integrate risk management into business strategy. This integration enables organizations to:

Improve decision-making: By incorporating risk considerations into strategic planning and performance management, organizations can make more informed decisions that balance risks and opportunities.

Improve resilience: Understanding and managing risks that could impact strategic objectives helps organizations be more resilient and better prepared for potential disruptions.

Drive value creation: Effective risk management can identify opportunities for innovation and growth and turn potential threats into competitive advantages.

Practical implementation of the COSO Framework

Implementing the COSO Framework involves several steps:

Create a risk-aware culture: Promote a culture where risk management is integrated at all levels of the organization.

Align risk management with strategy: Ensure that risk management processes are aligned with strategic planning and performance management.

Embed risk management practices: Integrate risk management into business processes, from strategy setting to daily operations.

Improve communication and reporting: Develop robust communication and reporting mechanisms to keep stakeholders informed of risk management activities and results.

Continuous improvement: Regularly review and revise risk management practices to adapt to new challenges and opportunities.
By adopting these practices, organizations can use the COSO Framework to not only protect their value, but also increase it.

Conclusion

The COSO Framework provides a robust risk management structure that can be integrated into the corporate strategy and performance. By adopting this framework, organizations can improve decision-making, increase resilience and drive value creation. As the business environment evolves, effective risk management will continue to be a critical component of organizational success.

On December 7, 2022, the Swiss Financial Market Supervisory Authority (FINMA) published the completely revised Circular 2023/01 “Operational risks and resilience”. These new regulations came into force on January 1, 2024 and brought comprehensive changes and adjustments to the previous standards. The most important points of the new requirements are explained below.

Background and objectives of the revision

The revision of the circular is a response to the increasing complexity of IT systems, technological progress and the increase in cyber attacks. The aim is to strengthen resilience to operational risks and to ensure that critical functions can be maintained even in crisis situations.

Key points of the new FINMA guidelines

Cyber ​​risk management:

• Integration of ICT and cyber risks: Cyber ​​risks must be considered in the context of information and communication technology risks (ICT risks).
• Reporting obligation: companies are obliged to report cyber attacks in accordance with FINMA Directive 05/2020.

Management of critical data:

• Data strategy: A comprehensive data strategy must be developed and implemented to ensure the confidentiality, integrity and availability of critical data.
• Increased security measures: Companies must take increased security precautions when handling critical data and regularly review and update them.

Business continuity management (BCM):

• Identification of critical processes: Companies must identify their critical processes and the resources required for them.
• Emergency and recovery plans: Creation and regular updating of a business continuity plan (BCP) and a disaster recovery plan (DRP).
• Regular testing: Conduct regular tests, such as simulations, to check the effectiveness of contingency plans.

Operational resilience:

• Definition of disruption tolerances: For each critical function, disruption tolerances must be defined and approved by the Board of Directors.
• Measures to ensure resilience: Measures to ensure resilience must be taken, including regular testing and adjustments to “serious but plausible” scenarios.
• Inventory of critical functions: An inventory of critical functions must be maintained and updated.

Requirements for systemically important banks:

• Continuation of critical services: There are specific requirements for the continuation of critical services during the resolution and recovery of systemically important banks.

Conclusion

The new FINMA guidelines ensure that Switzerland is better prepared against operational risks and cyber threats. By integrating modern risk management practices and emphasizing operational resilience, critical functions can be maintained even in times of crisis, thus ensuring their stability.

If you still need help with the implementation, we are always there for you. Register for an appointment via our website and our experts will be happy to support you with the implementation.

Effective risk management has become essential not only for preserving value but also for capitalizing on opportunities. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) has developed a comprehensive framework that meets these needs.

What is COSO?

Founded in 1985, COSO is a voluntary private organization dedicated to improving enterprise performance through effective internal control, risk management, governance and fraud prevention. It is best known for its two main frameworks: the COSO Internal Control-Integrated Framework and the COSO Framework.

Evolution of the COSO Framework

Originally published in 2004 and updated in 2017, the COSO Framework has evolved to better align risk management with strategy and performance. The 2017 update, titled “Enterprise Risk Management – Integrating with Strategy and Performance,” emphasizes the importance of embedding risk management practices throughout the organization to improve decision-making and achieve strategic goals.

Key Components of the COSO Framework

The updated COSO Framework consists of five interrelated components:

Governance and Culture: Sets the organizational tone and outlines the structure for risk management. It emphasizes the importance of board oversight and a risk-aware culture.

Strategy and Objective Setting: Ensures that risk considerations are integrated into the strategic planning process. This component helps organizations align their risk appetite with their strategy and set objectives that support risk-informed decisions.

Performance: Includes identifying and assessing risks that could impact the achievement of objectives and implementing risk responses to manage those risks within the organization’s risk appetite.

Review and Revision: Focuses on monitoring the performance of the organization’s risk management and making necessary adjustments. This component ensures continuous improvement and adaptation to changing business environments.

Information, communication and reporting: Emphasizes the importance of effective communication and reporting mechanisms to support risk management activities and inform decision-making across the enterprise.

Integrating risk management into business strategy

A key benefit of the COSO framework is its ability to integrate risk management into business strategy. This integration enables organizations to:

Improve decision-making: By incorporating risk considerations into strategic planning and performance management, organizations can make more informed decisions that balance risks and opportunities.
Improve resilience: Understanding and managing risks that could impact strategic objectives helps organizations be more resilient and better prepared for potential disruptions.
Drive value creation: Effective risk management can identify opportunities for innovation and growth and turn potential threats into competitive advantages.

Practical implementation of the COSO Framework

Implementing the COSO Framework involves several steps:

Create a risk-aware culture: Promote a culture where risk management is integrated at all levels of the organization.

Align risk management with strategy: Ensure that risk management processes are aligned with strategic planning and performance management.

Embed risk management practices: Integrate risk management into business processes, from strategy setting to daily operations.

Improve communication and reporting: Develop robust communication and reporting mechanisms to keep stakeholders informed of risk management activities and results.

Continuous improvement: Regularly review and revise risk management practices to adapt to new challenges and opportunities.
By adopting these practices, organizations can use the COSO Framework to not only protect their value, but also increase it.

Conclusion
The COSO Framework provides a robust risk management structure that can be integrated into the corporate strategy and performance. By adopting this framework, organizations can improve decision-making, increase resilience and drive value creation. As the business environment evolves, effective risk management will continue to be a critical component of organizational success.

ISO 37301 is an international standard that specifies requirements and guidelines for establishing, developing, implementing, evaluating, maintaining and improving an effective compliance management system (CMS) in an organization. The standard applies to all types of organizations, regardless of their size and type of activity.

What does ISO 37301 define?

ISO 37301 specifies the requirements for a compliance management system (CMS) that ensures that organizations meet their legal and regulatory obligations and promote ethical behavior. The standard covers:

Risk assessment and management: Identifying, assessing and managing compliance risks.

Roles and responsibilities: Establishing responsibilities for compliance management within the organization.

Training and awareness: Promoting awareness of compliance issues and providing the necessary training.

Documentation and communication: Ensuring that relevant information is appropriately documented and communicated.

Monitoring and improvement: Implementing processes to monitor compliance and continuously improve the CMS.

Why is a Compliance Management System (CMS) important?

Ensuring regulatory compliance: Organizations must ensure they comply with all relevant laws and regulations to avoid legal penalties.

Minimizing reputational risks: A robust CMS helps build trust with customers, partners and the public by demonstrating that the organization acts ethically and legally.

Improving operational efficiency: Implementing a CMS can optimize processes and reduce risks, leading to more efficient operations.

Gaining competitive advantage: Organizations that are ISO 37301 certified can use this as a differentiator to gain stakeholder trust and capture new business opportunities.

Why is software helpful?

Automation and efficiency: Software solutions automate many compliance tasks, which reduces manual effort and increases efficiency.

Centralized data management: CMS software enables all compliance-relevant data to be stored and managed centrally, improving transparency and accessibility.

Real-time monitoring and reporting: Using dashboards and reporting capabilities, organizations can respond to compliance issues and demonstrate compliance in real time.

Scalability: Software solutions can easily adapt to the needs of growing organizations, making it easier to implement and manage a CMS in large and complex enterprises.

Continuous improvement: CMS software supports continuous monitoring and analysis of compliance data, enabling organizations to continuously improve their processes and respond to new regulatory requirements.

Conclusion:

In summary, ISO 37301 provides a comprehensive foundation for building an effective compliance management system that helps organizations meet regulatory requirements, minimize risks, and improve operational efficiency. Using software to support the CMS can greatly simplify implementation and management and ensure that compliance processes run consistently and efficiently.

While the debate over the productivity of employees working from home continues in 2024, another factor that requires special attention for hybrid or fully remote business is workplace cybersecurity outisde the office.

Companies are expected to build and maintain a robust cybersecurity posture to protect their customers’ information from cyberattacks and data breaches. This includes implementing security measures, practicing safe online behavior, ensuring data privacy, and responding to security incidents and breaches. A company can be found negligent if it cannot demonstrate that it has followed the minimum required cybersecurity measures.

What cybersecurity risks do remote employees face?

The shift to remote work has brought with it a number of cybersecurity risks that companies must manage. More and more people have started a job and left it without even meeting their colleagues in person. This lack of face-to-face interaction can increase vulnerability to social engineering and phishing, as remote workers may not exercise the same level of vigilance outside of the traditional office environment. Weak passwords pose a significant threat, undermining even robust cybersecurity defenses like firewalls and VPNs. Cybercriminals exploit these vulnerabilities in a variety of ways, including ransomware attacks that hold data hostage and phishing schemes that trick employees into revealing sensitive information.

Cybersecurity Risk Management Methods

In the age of remote work, companies face unique cybersecurity challenges that require tailored risk management strategies. Here are some expert methods to protect your remote business:

1. To best protect yourself from criminals, you first need to know what to protect. Many organizations lack visibility into these critical assets, which is like leaving their digital doors unlocked. Knowing what to protect is the first step to protection.
2. Capture the full context of every connection on your network. Implement strict identity management, device status control, and granular application permissions. This approach helps detect anomalies and prevent unauthorized access.
3. Cybersecurity training for remote teams: Remote team members, who often work in isolation, may become lax about security practices. Regular training on cybersecurity best practices is essential to keep everyone alert and informed.

But even the best measures cannot eliminate every risk. The best way to reduce your risk and avoid negligence is to implement effective risk management. This involves several steps:

1. Risk identification: Document all potential threats and vulnerabilities. Use risk assessments, security audits, and historical data analysis to uncover risks.
2. Risk assessment: Evaluate the likelihood and impact of each risk. Consider the likelihood of threats exploiting vulnerabilities and the consequences of such events.
3. Risk prioritization: Assign risk levels to prioritize based on their potential impact and importance to the business.
4. Risk mitigation: Develop strategies to mitigate risk. This can include security measures such as firewalls, encryption, and access controls, as well as employee training and emergency response plans.
5. Monitoring and auditing: Continuously evaluate the effectiveness of your risk mitigation strategies. Stay up to date with the evolving threat landscape to ensure your risk management remains relevant.

Security risk management software helps organizations manage the additional cybersecurity risks that come with remote working. By centralizing information in a unified repository, it provides organizations with key insights and prioritizes risks. This centralization is key to avoiding the pitfalls of complacency, as it ensures that all compliance information and IT security measures are consistently applied and monitored. The software’s ability to create configurable reports and dashboards enables real-time insight into the organization’s security posture across silos, enabling quick action on urgent risks and ensuring nothing is missed. It protects against the costly consequences of complacency by keeping organizations informed, compliant and secure.

Tisax (Trusted Information Security Assessment Exchange) is a standardized assessment procedure that was developed specifically for the automotive industry to ensure uniform information security standards. This standard is crucial for ensuring data protection and information security throughout the supply chain. Tisax was developed by the ENX Association in collaboration with the Association of the Automotive Industry (VDA) and has been continuously evolving since its introduction.

What requirements does Tisax place on companies?

Tisax places high demands on companies, particularly in the areas of information security, data protection and process transparency. These include strict security requirements such as access controls and encryption as well as extensive documentation and auditing obligations. Companies must provide detailed evidence of their security measures and undergo regular audits to ensure compliance with Tisax standards and gain the trust of their business partners.

Why is Tisax important for an ISMS?

Tisax certification is crucial for an ISMS because it meets internationally recognized security standards. It shows partners and customers that your information security management systems are robust and reliable. A certified ISMS improves cybersecurity, minimizes risks and supports compliance with legal requirements. Tisax also offers clear guidelines and best practices for continuously improving security processes.

Which companies benefit from Tisax?

Tisax, originally developed for the automotive industry, is increasingly being used in other industries. Sectors such as IT services, consulting companies and logistics recognize the value of the Tisax standard for securing sensitive data and meeting high security requirements. These companies benefit from improved cybersecurity and achieve a high level of compliance, which strengthens the trust of their customers.

Future prospects for Tisax

Tisax will play an even greater role in the future as cybersecurity and data protection requirements continue to rise. Companies from various industries are increasingly recognizing the added value of Tisax certification to strengthen trust and competitiveness. Innovations in information security could further optimize Tisax processes and thus facilitate adaptation to new technologies and threats. This makes Tisax an indispensable standard.

Challenges and solutions when implementing Tisax?

The implementation of Tisax can bring with it numerous challenges, including complex security requirements and extensive documentation obligations. Software can not only simplify implementation, but also help to comply with the standard in the long term and to continuously improve it.

Conclusion

TISAX is an indispensable standard for information security. By implementing TISAX, companies can standardize their security measures, create trust and transparency, and minimize security risks. Specialized software solutions play a crucial role in the efficient and effective implementation of these standards.