Information Technology (IT) Risk Analyst is a risk assurance function and is primarily responsible for risk identification, assessment, mitigation and continuous improvement (also know as risk optimization) across all IT infrastructure, information system/assets of the organization. He/she also factors in regulatory, contractual and legal requirements in its risk management processes/activities to ensure compliance. In performing risk assessment, it is important that all information systems and IT assets are identified and documented in an IT asset inventory/register to enable proper scoping of assets for risk assessment. IT risk analyst performs assessment to identify risk and vulnerabilities inherent in all IT assets or infrastructure that is in scope of its assessment, the current state of controls implemented by management to mitigate those risk or vulnerability, the effectiveness of the implemented controls and the residual risk in place given the implemented controls. The outcome of the assessment is reported to management in a risk assessment report, which also include recommended controls to mitigate newly identified risk, additional controls to further mitigate residual risk if existing controls are inadequate, risk acceptance due to inability of management to implemented controls (where risk to cost ratio is high) based on its risk appetite or mere business decision, or risk transfer/sharing with third parties based on business needs.
An IT risk analyst maintains a risk control register/library of all identified risk, which is continually updated to track new risk introduced by changes in the business environment, acquisition of new IT assets, changes to existing IT assets and processes, changes in regulation and laws, etc. Outcomes of internal audit assessment, security incidents and threat intelligence reports also feeds into the risk control register/library and are updated as such for continuous improvement purposes. The IT risk analyst also determines the likelihood of occurrence of the risk as well as consequence or impact of the identified risk to enable management understand its risk liabilities and extent of controls to be implemented to mitigate them. With the risk already in perspective, an IT risk analyst would be able to perform an assessment to determine the adequacy of the organization's information security or cyber security strategy, business continuity strategy and disaster recovery plans, information security policies and related procedures to ensure it effectively supports the business.
An IT Risk Analyst could report to the IT Risk Manager or Operational Risk Manager both of who reports to the Chief Risk Officer (CRO) of an organization. Depending on the maturity of the organization's enterprise risk management practice, the IT risk function could reside within operational risk management function, which is a subset of the enterprise risk management headed by the CRO according to BASEL II framework. For maturity, the IT risk function could stand on its own and not be associated with operational risk management function as such the IT Risk Analyst and in turn the IT Risk Manager reports directly to the CRO to enable the CRO have adequate visibility on information and technology risk issues so as not to be muddled up as part operational risk.
To be endorsed as an IT risk analyst, practitioners must acquire certification such as Certified in Risk and Information Systems Control (CRISC) by ISACA, Certified Information Systems Auditor (CISA) by ISACA, Certified Information Systems Security Professional (CISSP) by ISC2, Chartered Enterprise Risk Actuary (CERA) by Institute and Faculty of Actuaries credential, Chartered Enterprise Risk Analyst (CERA) by Society of Actuaries credential, among others.