What models are in place for risk partners based in Line 2? What are the jobs to be done? How do they operate? What does the structure/operating rythms look like?
Sort by:
VP of Information Security4 months ago
Risk partner line 2 means, defense in depth at 2nd level?
It would be great, if you can simplify question OR add some more details like purpose/situation.
Chief Product Officer in Software4 months ago
What is the context of your question? It sounds like you are referring to a piece of research or chart--"Line 2". Could you clarify?
The answer to your question has some generic factors and some industry specific factors. I will reply from a US Healthcare perspective. A good way of thinking about Line 2 functions is to consider their "primary objectives". Are their primary objectives to produce the goods or services the entity offers or are their primary objectives to protect the organization that exists from uncertainty, bad internal choices/acts or external threats. This helps to see value producers and value protectors. Value protectors make up Line 2 risk functions. Some departments play both sides like HR and Legal, sort of landing on the middle of the spectrum.
In US Healthcare clear value protecting functions (on Line 2) include Compliance, Privacy, Information Security, Physical Safety, Clinical Risk, and Insurance (Hazard Risks). Those departments with some Line 2 responsibilities include Human Resources, Legal, Quality and Clinical Safety.
So, looking at Line 2 Risk Functions for US Healthcare, some have Legal and Professional expectations, Compliance and Privacy for example. These expectations define more than 75% of the framework within which they operate. Information Security or Cyber Risk, has traditionally been defined by general Federal standards like NIST leaving all of the more specific practices to related professional bodies, ISACA, etc. However, that is shifting towards more government standards. Insurable hazards, business continuity, etc is usually considered an operational program with heavy financial tones and leading practices. Some government direction. For US Healthcare Clinical Risk is derived from clinical professional associations, quasi government standards and survey organizations. In short each of these functions draws from professional, quasi government, and industry leading practices to define their roles and deliverables.
Enterprise Risk Management, envisions shared risk standards across these bodies which can enable a database of risk from which to set priorities for these functions, executive management and the Board. Some theorize that it ERM when done well can create a set of statements from these entities of equal value to the organization as financial statements.