COMMENTARY: How to manage risk effectively has become a daily topic of conversation for security pros, but few talk about the shifts that we can take right now to approach risk holistically.Forget the piecemeal solutions and ad-hoc barriers: it requires a huge – but very doable – adjustment that improves risk management and creates a unified approach for the entire organization.Risk management isn't just about defense. I learned this lesson early in my career when I watched promising business initiatives stall because the legal, HR, and security teams operated in isolation, each applying their specialized lens without understanding the full picture. These disconnects created unnecessary friction that hampered our ability to move quickly.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]I've seen firsthand how a unified approach where risk gets approached as an organizationwide initiative transforms effectiveness. Ensuring the close alignment of these traditionally siloed departments creates a powerful risk management engine that can accelerate business objectives rather than constrain them.All of these departments aim to reduce and manage risk—legal, people and security risk to be exact. And each of these departments that manage risks has a real impact on the others. Rigid separation between legal, HR, and security made sense in a different era, but the complex risk landscape of the current moment justifies a more integrated approach.When these teams operate in isolation, it results in disjointed or contradictory decision-making, compliance gaps, and frustrated employees navigating conflicting priorities.How to make it happenEstablishing a cross-functional team requires careful planning and executive sponsorship. First, begin with shared objectives that span departmental boundaries and then identify individuals for cross-functional collaboration focused on specific business outcomes. When doing so, look for leaders with broad perspectives who resist territorial or empire building thinking. This is important—it’s a mindset shift for even the most seasoned leaders.Developing integrated metrics that measure collective impact rather than departmental activity encourages collaboration. Select leaders with a business orientation—professionals who see legal, HR, and security not as ends in themselves but as enabling functions that support broader organizational goals.A unified structure transforms risk management departments from a necessary cost center into a strategic accelerator that enables business innovation while maintaining appropriate safeguards.We need to fundamentally rethink how to approach organizational risk. Successful implementations focus on building multidisciplinary expertise among team members. This lets organizations create shared processes that span traditional boundaries, develop integrated technologies that support unified workflows, and measure outcomes through business impact rather than departmental metrics.As business environments grow increasingly complex, traditional departmental silos will continue to create friction that impedes agility. Forward-thinking executives have already reimagined these boundaries, not just between legal, HR, and security, but across other traditionally siloed functions.Organizations that continue to operate in the traditional risk management model often sacrifice strategic advantage for the comfort of familiar roles. Consider how a more integrated approach to risk management could transform the organization’s ability to execute with both speed and confidence.Brooke Johnson, chief legal counsel, senior vice president, HR and security, IvantiSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
The connected nature of modern risk
Take a routine security incident as an example. What begins as a technical event quickly cascades into legal concerns about data protection and HR questions about employee training and accountability. When these functions work separately, the response becomes fragmented and inefficient.Most significant business risks don't fit neatly into one departmental boundary. They exist at the intersection of legal compliance, human behavior and security controls.Here's how organizations can remove barriers that prevent legal, HR, and security from working collaboratively and create strategic advantage:- Practice holistic risk assessment: A cross-functional team assesses risk from multiple perspectives simultaneously––reducing red tape and review cycles. For example, serial review processes where initiatives bounce between departments for approval do so with delays, and often without context. Instead, evaluate business proposals through a comprehensive risk lens that weighs legal, personnel and security factors in concert.
- Streamline compliance management: Regulatory compliance spans legal interpretation, workforce training, and technical controls. When a cross-functional team oversees this spectrum, organizations eliminate redundant processes and contradictory guidance.
- Enhance personnel security: The human element remains critical in security and compliance. An integrated approach recognizes that effective security depends equally on technical controls, clear policies and employee behavior. A unified team addresses all three dimensions simultaneously, resulting in significantly improved security outcomes without sacrificing employee experience.
- Allocate resources more strategically: With visibility across legal, HR, and security functions, leaders can allocate resources based on holistic risk profiles rather than departmental priorities. This perspective prevents overinvestment in one risk dimension while neglecting others.
