What a technology risk review actually covers

Most organisations that commission a technology risk review do so because something has prompted them to. A near-miss, a regulatory enquiry, a board member who read something uncomfortable in the news. The useful thing about a structured review is that it surfaces the risks you were not looking for, not just the ones that prompted the exercise.

What the review covers ¶

A risk and resilience review at TechVault Pulse Lab covers four areas. The first is infrastructure dependencies: which systems are load-bearing, what happens if they fail, and whether the organisation's understanding of those dependencies matches reality. The second is data handling: where sensitive data lives, who has access to it, and whether the controls in place are proportionate to the risk.

The third area is business continuity: whether the organisation has a tested plan for continuing to operate if a critical system is unavailable for twenty-four hours, seventy-two hours, or longer. The fourth is incident response: whether there is a clear process for identifying, containing, and communicating a technology incident, and whether the people responsible for that process know what it is.

What it typically finds ¶

The most common finding is a single point of failure that the organisation was aware of but had not formally assessed. A critical system running on hardware that is past its supported life. A key integration that has no monitoring and no alert if it stops working. A backup process that has not been tested since it was set up.

The second most common finding is a gap between the documented business continuity plan and the organisation's actual capability. The plan says the system can be restored within four hours. Nobody has tested that assumption. The recovery time objective was set by the vendor at the time of procurement and has never been validated against the organisation's actual infrastructure.

What happens after the review ¶

The output is a scored risk register with a prioritised remediation plan. The scoring uses a standard likelihood-impact matrix, and the priorities are agreed with the client before the report is finalised. We do not produce a list of everything that could theoretically go wrong. We produce a list of the things most likely to cause material disruption, ranked by urgency.

The remediation plan distinguishes between things that can be addressed immediately at low cost, things that require budget and planning, and things that require a strategic decision. Most organisations find that a significant proportion of the high-priority items fall into the first category.

The review takes approximately three weeks from kick-off to final report. If you would like to understand what it would cover for your specific organisation, a thirty-minute call is the right starting point.