Main groups of IT risks
- Project risks: missed deadlines and budget overruns, vague requirements, technical debt.
- Infrastructure risks: server and network failures, dependence on a single provider or data centre.
- Cybersecurity: attacks, leaks, ransomware (see “The IT department does not protect the business”).
- Dependence on contractors and vendors: a supplier leaving, software support ending.
- Data: loss, corruption, failure to meet data protection requirements.
Risk management in Agile/Scrum
In agile teams, risk management is part of the regular work rhythm. It is not a once-a-year exercise:
- Risks are discussed at sprint planning and retrospectives.
- The team keeps a light risk register with owners and status.
- The most dangerous assumptions are tested with early prototypes (this reduces uncertainty).
- For techniques of quick decision-making under uncertainty, see “the three-scenario method”.
IT risks and continuity
Even with good protection you need a plan for failure: recovery targets (RTO/RPO), backups and a disaster recovery plan (DRP). This links IT risks to business continuity.
What industry risk profiles have in common
Industries stop in different ways, but the analysis has the same structure. First, find out what exactly generates revenue and what it physically depends on. Then look for bottlenecks where this chain rests on a single element. Next, calculate what an hour and a day of stoppage cost. Only then decide what to back up.
What differs is the content. In IT and service companies the critical resources are people and data: a stoppage starts instantly and ends just as instantly when the systems are restored. In continuous production a stoppage costs more than just a restart: in metals production, an unplanned shutdown of a unit brings process losses that go beyond downtime. In oil and gas, sanctions and environmental constraints are added, and the recovery horizon is measured in weeks. In construction, the risk shifts to contractors and supplies, and a stoppage at one point shifts the schedule of the whole project.
Where to start in your industry
The universal entry point is the same whatever the sector. Take three to five processes that bring in money, and answer four questions for each. What will stop first if a key supplier or site disappears? How much does an hour and a day of this stoppage cost? Is there an element that cannot be replaced within a reasonable time? Who decides on switching to the backup, and has that person been given the authority in advance?
The first two questions are answered by business impact analysis and a calculation of the cost of one day of downtime. The third is answered by a search for a single point of failure and a review of supplier loss. The fourth is settled before a crisis, in the company crisis plan.
Industry specifics come into play later, when you choose a way to provide backup and calculate its cost. At the start they get in the way: the conversation drifts into technology details and away from business priorities.
Frequently asked questions
How is IT risk management different in Agile?
It is continuous. Risks are reviewed every sprint, the team keeps a light risk register and tests dangerous assumptions with early prototypes. It does not happen just once at the start of the project.
Are IT risks only about cybersecurity?
No. They also include failed projects, infrastructure outages, dependence on contractors and data risks. Cybersecurity is an important part, but not the only one.
Business continuity for the needs of your industry
Start with the assessment: it takes into account critical processes and recovery times. Then we will choose a format, from a programme for your team to a turnkey system.
Industry practice
This is the core page of the section. Below are the other materials in the section. They cover specific parts of the topic.
- Oil and gas industry risksProduction, project, environmental and sanctions risks
- Risks in the metals industryTechnical, production and market risks in mining
- BCM for construction and SROsProject, contractor and supply risks; SRO requirements