James Taylor's Decision Management

I saw this nice piece by David Kelly on Managing IT Risk and it prompted me to think about decision management in a risk context.

For instance, David says:

Compliance is a risk that has received a huge amount of attention over the past few years, as organizations strive to meet new regulatory requirements and enable faster, more efficient audits of all types of business processes.

And he's absolutely correct. But compliance can also come with a requirement to show that systems behave in a compliant way - approving loans correctly or treating customers similarly regardless of race. Using business rules to automate decision logic can be a very effective way to show that systems are compliant with regulations. I have blogged before about the case for rules in compliance and about the relationship between COBIT, SOX and rules.

An important part of building a risk mitigation plan is to understand the impact of the different types of events or risks that an organization can encounter.

Business risks should not be forgotten either. The use of risk models, a kind of predictive analytic model, is becoming increasingly common in systems that manage the business to ensure that risk, credit or fraud risk for instance, is properly managed. This is not the same as business analytics or reporting but is about embedding insight gained from data into operational systems.

IT risk management plans that provide disaster recovery, business continuity, as well as assurance that an organization is equipped to successful handle a wide range of potential problems.

All true. But what about the need to respond quickly to crises? What if I have to change the logic in my systems quickly and accurately and be able to show what I did and why after the fact? Decision technologies like business rules can make this much more likely, allowing business agility even in regulated industries and in a litiginous society. Rules also allow for what-if scenarios to be planned and rules developed ready to go into production when they are needed. Really agile risk management. Enjoy.