Information risk governance

Information risk governance gives you the assurance that risk based decisions are systematic and defensible and made in a timely manner. 

Information risk management enables organizations to  balance unacceptable business exposure to risk with the implementation of  restrictive controls which may inhibit the business.

Our consultants provide practical information risk management and governance experience. They consider a range of risk and governance options to ensure the most suitable approach is provided to suit your organization’s needs.

Why choose BSI as a preferred partner

  • You're guaranteed to be assigned a consultant with the experience and expertise to develop a strategic remediation plan that’s appropriate for your organization.
  • BSI Consulting Services develops and prioritize strategic remediation plans based on organizational capabilities and a realistic timetable that considers a variety of factors.
  • Our approach differentiates us from the competition – clients receive an executable custom-written strategic remediation plan tailored to their business, not a boilerplate plan based on unrealistic capabilities and delivery dates.
  • We're with you every step of the way - addressing all findings in the gap assessment, and optionally providing project management is required.

Information risk governance methodology

We have a three step methodology that helps us decide the most suitable approach:

Step 1: Review all relevant governance factors:

Internal context

  • Strategic goals and objectives
  • Organization structure
  • Roles and responsibilities of key risk management stakeholders
  • Existing risk management processes and procedures
  • Risk management policies and procedures

External context

  • Legal, regulatory and contractual compliance requirements
  • Competitive environment


Step 2: Using the identified internal and external governance details, we help you define and deliver a structure for information risk governance, including:

  • Defined criteria for risk analysis and escalation
  • Defined reporting lines and structures
  • Formal allocation of roles and responsibilities
  • Development of meaningful KPIs
  • Risk management policies and procedures
  • Risk assessment templates
  • Risk register
  • Advice on best in class GRC tools


Step 3: Our consultants provide ongoing support throughout the governance process, including creating, reviewing or improving the risk mandate committee and structures, reporting lines and communications required for effective information risk governance and ensuring that risk is being managed in line with the agreed criteria.

BSI's Approach

After performing a gap or IT risk assessment, BSI Consulting Services works with the client to prioritize a remediation roadmap.  This process includes:

  1. Identifying missing and incomplete requirements
  2. Identifying available resources and capabilities
  3. Developing a plan that is realistic and achievable
  4. Identifying and communicating opportunities for scope and cost reduction

Our proven framework can help your organization identify and manage:

  • Security and compliance gaps
  • Major tasks and associated subprojects required to meet compliance and security goals
  • Project risk and priority
  • Project owners
  • Remediation timelines
  • Estimated staffing and capital requirements
  • Project reach, complexity, and dependencies

What You Get

  1. An actionable, custom-written Strategic Remediation Plan, which describes all remediation projects, tasks, milestones and resource requirements. For each project, we provide timing estimates and resource recommendations that are tailored to your specific business and/or technical requirements.
  2. Expert consultation throughout the remediation phase.
  3. Remediation project management should your organization need assistance.