Category: Resources & Articles

Categories
Resources & Articles

Dr. Jenny Tan: Leading with Purpose, Transforming Risk, and Putting Humanity at the Center of Technology

Dr. Jenny Tan

Dr. Jenny Tan

Immediate Past President | SheLeadsTech SG Founder
ISACA SG Chapter

2025 Outstanding Chapter Award

A Leadership Philosophy Rooted in Action

In a world increasingly shaped by technology, risk, and rapid digital transformation, leadership is often defined by technical expertise and strategic thinking. Yet, for Dr. Jenny Tan, true leadership goes far beyond systems and frameworks—it is deeply human, purpose-driven, and grounded in action. Her philosophy is simple, yet powerful: walk the talk.

It is a principle that has guided her career across industries, leadership roles, and global initiatives. Whether driving strategic transformation, mentoring professionals, or building inclusive communities, Dr. Tan has consistently demonstrated one defining trait—the ability to turn vision into reality. Because for her, leadership is not about ideas alone. It is about execution.

A Journey Defined by Purpose and Contribution

Dr. Jenny Tan’s professional journey is a reflection of both excellence and intention. With a strong foundation in strategic thinking, relationship management, and execution, she has built a reputation as a leader who not only understands complexity—but simplifies it into actionable outcomes.

Her strengths, identified through Gallup—Strategic, Relator, Individualisation, Achiever, and Maximiser—are not just theoretical attributes. They are visible in the way she leads, builds, and influences.

From her role as a senior leader in risk and audit to her contributions within professional communities, her journey has been shaped by a consistent desire to give back.

Her involvement with the ISACA Singapore Chapter began over a decade ago—not as a career move, but as a commitment to contribute to the technology risk community. What started as a professional engagement quickly evolved into a leadership journey that would redefine both her role and her impact.

Breaking Barriers and Building Representation

In 2023, Dr. Jenny Tan made history. She became the first woman President of the ISACA Singapore Chapter—a milestone achieved after more than 40 years since the chapter’s establishment. This achievement was not just personal. It was symbolic. It represented progress, inclusion, and the evolving role of women in technology, cybersecurity, and risk leadership.

During her tenure, the chapter experienced significant growth and transformation. Membership increased consistently, professional education initiatives expanded, and the organization strengthened its presence both nationally and regionally.But beyond numbers, her leadership brought something deeper—a sense of direction, purpose, and identity.She didn’t just lead the chapter. She elevated it.

SheLeadsTech: From Global Initiative to Local Impact

While her presidency marked a historic milestone, one of Dr. Tan’s most impactful contributions began even earlier—with the founding of SheLeadsTech Singapore in 2019.

Originally a global initiative, the program was designed to promote diversity and inclusion in technology. However, Dr. Tan quickly recognized a gap.

The global framework, while valuable, did not fully address the unique challenges and realities within Singapore.So she did what true leaders do. She adapted.On International Women’s Day, March 8, 2019, she officially launched and localized SheLeadsTech Singapore—transforming it into a program tailored to the region’s needs.

The impact was immediate and far-reaching.

  • Over 10,000 female students reached through cybersecurity awareness and education
  • Nearly 50 mid-career individuals successfully transitioned into technology roles
  • More than 100 ambassadors inspired within just one year

This was not just a program.It was a movement.A movement that created opportunities, changed perceptions, and built pathways for women in technology and cybersecurity.

Redefining Risk: A Human-Centric Approach

One of the most distinctive aspects of Dr. Jenny Tan’s work is her perspective on risk.In traditional frameworks, risk is often viewed through systems, controls, and processes.But Dr. Tan challenges this approach.She believes that risk is not just technical—it is human.

Her work emphasizes human risk management, focusing on behavior, decision-making, and awareness as critical components of risk mitigation.Because no matter how advanced technology becomes, human behavior remains at the core of both risk and resilience.This perspective has positioned her as a forward-thinking leader in the field—one who is not only adapting to change, but redefining how industries approach it.

LeadershipWithout Authority: The Power ofInfluence

One of the most defining challenges in Dr. Tan’s journey did not stem from complexity, but from leading without formal authority. Unlike traditional corporate environments, where structured hierarchies guide execution, her work with ISACA required leading a diverse group of volunteers—seasoned professionals with varying priorities, perspectives, and commitments.

In such a setting, authority could not be enforced; it had to be earned. This demanded a fundamental shift in leadership approach. Rather than directing, she focused on alignment. Instead of instructing, she inspired. By consistently anchoring decisions to a shared vision— the growth and success of the chapter—she was able to unify individuals with different motivations. Over time, her clarity, consistency, and ability to execute not only strengthened collaboration but also built a deep sense of trust within the team. And that trust became the foundation of her leadership.

Recognition That Reflects Impact

Dr. Jenny Tan’s contributions have been widely recognized across global and regional platforms.

Her accolades include:

  • Outstanding Contribution Award – Women in Tech Asia (2021)
  • Most Outstanding Chapter Leader – ISACA Global (2021)
  • SG 100 Women in Tech – Singapore Computer Society & IMDA (2021)
  • Ally of the Year – Women in IT Asia (2022)
  • Top Cyber Woman & Top Woman in Security – WISECRA (2022)
  • Cybersecurity Leader Award – AiSP Singapore (2023)
  • International Education Excellence Award (2024)
  • Top Workplace Well-Being Creator in Singapore (2025)
  • Top 10 Cybersecurity Voices in Singapore (2026)

These recognitions are not just milestones. They are reflections of sustained impact, leadership, and commitment to community development.

A Mission Centered on Giving Back

At the heart of everything Dr. Tan does is a simple yet powerful mission: Doing good professionally. She believes that by giving time, knowledge, and care to others, individuals grow not just professionally—but personally.

Her alignment with the International Women’s Day theme “Give to Gain” reflects this philosophy. For her, success is not measured solely by achievements, but by contribution.

Beyond Titles: A Continuing Legacy

Even as she prepares to step down from her role as Immediate Past President in 2027, Dr. Tan’s journey is far from slowing down. She continues as the Founder of SheLeadsTech Singapore, ensuring the program’s growth and impact. Additionally, she has taken on a new milestone—becoming the first woman Chair of the Institute of Risk Management (IRM) Singapore.

Shaping the Future of Risk and Community

Looking ahead, Dr. Tan is focused on two key areas:

  1. Expanding SheLeadsTech into underserved communities, bringing cybersecurity awareness and training to groups often overlooked.
  2. Advancing the risk management profession, redefining how organizations and communities understand and approach risk.

Her vision is clear—to make knowledge accessible, leadership inclusive, and impact sustainable.

Advice That Reflects Experience

For aspiring professionals, her guidance is both practical and profound:

  • Stay humble—be willing to learn, unlearn, and relearn
  • Build resilience through self-leadership
  • Adapt continuously in a rapidly changing world
  • Remain confident, but never arrogant

Because in the long run, it is not just intelligence that defines success—but attitude, adaptability, and integrity.

A LeaderWho Makes Things Happen

Dr. Jenny Tan is often described by her peers as an “energizer”—someone who brings enthusiasm, clarity, and momentum to everything she does. But what truly sets her apart is not just her energy. It is her ability to make things happen.

In an era where leadership is often discussed but not always demonstrated, she stands as a powerful example of what it means to lead with purpose, act with consistency, and create impact that extends beyond individual success.

Her journey is not just about leadership in technology or risk.It is about redefining leadership itself. And in doing so, she continues to shape a future where people, purpose, and progress exist at the center of everything.

Connect with Dr. Jenny Tan: https://www.linkedin.com/in/jenny-tan-phd-064b3122/?skipRedirect=true

Categories
Resources & Articles

Impact of Artificial Intelligence on Diversity, Equity and Inclusivity

Impact of Artificial Intelligence on Diversity, Equity and Inclusivity

Artificial Intelligence (AI) is reshaping the modern world at an unprecedented pace. From automating routine tasks and enhancing productivity to enabling personalized services and advanced decision-making, AI is transforming industries, workplaces, and societies. As organizations increasingly adopt AI technologies, an important question emerges: How does AI impact Diversity, Equity, and Inclusivity (DEI)? While AI has the potential to advance fairness and create opportunities for underrepresented groups, it also poses significant risks if not designed and governed responsibly.

Hence, on 1 Jun 2026, Dr. Jenny Tan, the founder of ISACA SheLeadsTech Singapore Programme conducted a virtual round-table discussion with its SheLeadsTech Ambassadors to discuss about this topic. This article captures the key discussion points highlighted in the round-table discussion and included some research materials.

At the beginning of the discussion, participants were asked about the adoption rate of AI at work. Not surprising to note that 100% of the participants indicated that they have started using AI at work and in their personal routines. However, everyone also indicated that they are currently using AI like using search engines and some have started using AI to help prepare documents.

One of the greatest opportunities AI presents for DEI is its ability to reduce human bias in decision-making processes. In recruitment, performance management, and talent development, AI-powered systems can analyze large volumes of data and identify patterns that may be overlooked by human evaluators. When designed appropriately, these systems can help organizations focus on skills, qualifications, and performance rather than demographic characteristics such as gender, race, age, or disability. AI-powered accessibility tools, including speech recognition, real-time translation, and assistive technologies, are also helping to create more inclusive environments for people with disabilities and individuals from diverse linguistic backgrounds. However, this benefit assumes that biasness has been removed during AI development stage.

In addition, research shows that AI is not inherently unbiased. AI systems learn from historical data, and if that data reflects existing social inequalities, the technology may reproduce or even amplify those biases. A 2024 UNESCO study examining large language Image created by ChatGPT Author: Dr. Jenny Tan | 7 Jun 2026 Page 2 of 4 models found clear evidence of gender bias, racial stereotyping, and discriminatory associations in AI-generated content. The study revealed that AI systems often portrayed women in traditional domestic roles while associating men with leadership and professional occupations. Such findings demonstrate that AI can unintentionally reinforce societal stereotypes rather than challenge them.

img content

Image created by ChatGPT

The issue extends beyond content generation. Academic research examining AI- related incidents found that nearly half of documented AI incidents involved diversity and inclusion concerns, with racial, gender, and age discrimination among the most common issues identified. These findings suggest that bias in AI is not merely a theoretical concern but a real-world challenge affecting individuals and communities. This was also echoed by the discussion participants.

Equity is another area where AI can have both positive and negative consequences. Organizations increasingly use AI analytics to identify disparities in hiring, compensation, promotion rates, and employee engagement. These insights can support evidence-based interventions that promote workplace fairness. Yet, if organizations rely on biased algorithms without proper oversight, AI can institutionalize inequity at scale. Unlike human Author: Dr. Jenny Tan | 7 Jun 2026 Page 3 of 4 bias, which may be limited to individual decisions, algorithmic bias can affect thousands of people simultaneously, making its consequences more widespread and difficult to detect.

The impact of AI on employment also raises important DEI considerations. Many workers fear that automation will eliminate jobs and widen economic inequality. According to the World Economic Forum’s Future of Jobs Report 2025, approximately 22% of current jobs are expected to experience disruption by 2030. While AI and related technologies may displace around 92 million jobs, they are also projected to create approximately 170 million new roles globally. This suggests that the challenge is not simply job loss, but workforce transition and adaptation.

The situation in town and the feedback from the participants begged to differ from the jobs displacement argument. The participants gave feedback that they were not that worried about losing jobs to AI. Perhaps the key reasons why the participants could comment as such are that their organizations provide safe space for employees to upgrade and they also took proactive measures to learn more about AI. The key attitude that all participants agreed- upon is that employees have to keep an open mind to start unlearning and relearning. Being stubborn about their own competencies does not help them in their careers.

While we noted the impact in town, the effects of this transition outside of town may not be evenly distributed. Historically underrepresented groups, lower-income workers, and individuals with limited access to digital education may face greater barriers in acquiring the skills required for AI-enabled jobs. Research from the World Economic Forum indicates that nearly 39% of key workforce skills are expected to change by 2030, highlighting the urgent need for continuous learning and reskilling initiatives. Without targeted support, AI-driven transformation could deepen existing social and economic inequalities.

Gender representation within the AI industry itself remains another challenge. UNESCO reports that women continue to be underrepresented in AI-related professions, accounting for only about 30% of AI professionals globally. This lack of diversity within AI development teams can influence the perspectives embedded in technology and limit the ability of organizations to identify potential biases during design and testing. Diverse teams are more likely to recognize ethical concerns, challenge assumptions, and develop solutions that serve a broader range of users.

Recent research among AI and machine learning practitioners reinforces this point. While most professionals recognize the importance of diversity and inclusion in creating trustworthy AI systems, many organizations struggle to translate these principles into practice. Common barriers include limited representation of marginalized groups, insufficient transparency, and a lack of awareness regarding DEI issues throughout the AI Author: Dr. Jenny Tan | 7 Jun 2026 Page 4 of 4 development lifecycle. Researchers concluded that diverse teams contribute significantly to ethical, innovative, and socially responsible AI outcomes.

To ensure AI becomes a force for inclusion rather than exclusion, organizations must adopt responsible AI governance practices. These include conducting regular bias audits, using representative datasets, maintaining transparency in algorithmic decision-making, and involving diverse stakeholders throughout the design, deployment, and evaluation process. Equally important is investing in digital literacy, reskilling, and lifelong learning programs that enable all individuals to participate meaningfully in an AI-driven economy.

Hence, the author suggested applying the inclusive risk management framework as it strengthens decision-making by incorporating diverse perspectives, helping organizations identify risks and vulnerabilities that might otherwise remain unseen while reducing blind spots in risk assessments. Research shows that inclusive approaches also build stakeholder trust, enhance organizational resilience, and ensure that vulnerable or underrepresented groups are considered in planning, protection, and recovery efforts.

Ultimately, AI is neither inherently equitable nor inherently discriminatory. It reflects the values, assumptions, and data of the people who create it. As AI becomes increasingly integrated into our work and lives, organizations have a responsibility to ensure that technological innovation aligns with the principles of diversity, equity, and inclusivity. By prioritizing fairness, accountability, and human-centered design, AI can become a powerful tool for expanding opportunities, reducing barriers, and creating a more inclusive future for all.

References

  1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk Management – Guidelines. Geneva: ISO.
  2. Malik, S., Bano, M., & Zowghi, D. (2025). Diversity and Inclusion in AI: Insights from a Survey of AI/ML Practitioners.
  3. Renn, O. (2021). Risk Governance: Resilience and Adaptive Capacity in Complex Systems. Routledge.
  4. Renn, O., & Schweizer, P.-J. (2009). Inclusive Risk Governance: Concepts and Application to Environmental Policy Making. Environmental Policy and Governance, 19(3), 174–185.
  5. Shams, R. A., Zowghi, D., & Bano, M. (2024). AI for All: Identifying AI Incidents Related to Diversity and Inclusion.
  6. UNESCO. Generative AI: UNESCO Study Reveals Alarming Evidence of Regressive Gender Stereotypes (2024).
  7. UNESCO. Tackling Gender Bias and Harms in Artificial Intelligence (2025).
  8. World Economic Forum. Future of Jobs Report 2025.
  9. World Economic Forum. Reskilling Revolution and Future Workforce Trends (2026).
Categories
Resources & Articles

Human Risk Management – The Missing Link in Cybersecurity and Organizational Resilience

Human Risk Management
Human Risk Management The Missing Link

As organizations accelerate their digital transformation journeys and embrace artificial intelligence (AI) at unprecedented speed, one uncomfortable truth remains unchanged: technology does not create most organizational risks -people do. This central premise underpins the growing importance of Human Risk Management (HRM), a discipline that focuses on understanding, measuring, and influencing human behavior as a critical driver of organizational risk. Examples such as Capital One Data Breach (20191) and Marks & Spencer Social Engineering Breach (20252) are real life case studies that affirmedthe situations.

Traditionally, risk management frameworks have concentrated on systems, processes, and controls. Human-related risks are often categorized under Human Capital Risk and assessed primarily through policy compliance and procedural reviews. However, human capital is increasingly recognized as a strategic resilience issue rather than solely a human resource (HR) concern. The Institute of Internal Auditors‘ Risk in Focus 20263report identified Human Capital Risk as one of the top organizational risks, yet many organizations continue to assess it at a process level rather than evaluating actual outcomes and behavioral performance.

One of the most compelling observations is the growing recognition of Human Risk Management (HRM) within cybersecurity. According to findings referenced in the State of Human Risk 2025 Report4, 96% of organizations report challenges in securing the human element, while only 16% have established HRM programs and only 29% report excellent visibility into human risk. These statistics suggest that while organizations acknowledge the importance of human risk, many still struggle to operationalize effective HRM practices.

A significant component of HRM involves addressing insider threats. Insider threats arise from trusted employees, contractors, or partners who possess legitimate access to organizational systems and information. Unlike external attackers, insiders benefit from existing trust relationships, making their actions more difficult to detect. Research indicates that insider incidents often result in greater financial losses and longer detection periods because traditional perimeter-based security controls are less effective against trusted users.

Insider threats can take many forms, including malicious intent, negligence, accidental disclosures, or security control failures involving third-party vendors5 . Several real-world examples, including incidents involving Marriott, Tesla, Microsoft, and Yahoo, illustrating how trusted access, insufficient oversight, and human behavior contributed to security breaches5. Importantly, these examples reinforce that cyber incidents are not always technology failures; often, they are people-related failures.

The author further identifies four common root causes of insider threats: financial pressure, workplace dissatisfaction, lack of awareness or training, and excessive access privileges. These findings underscore the importance of collaboration between HR, risk management, cybersecurity, and internal audit functions to identify behavioral warning signs before incidents occur.

Beyond malicious behavior, fatigue has emerged as a major source of organizational risk. Fatigue and cognitive overload contribute to slower reaction times, poor judgment, increased operational errors, and safety incidents. In cybersecurity environments, fatigue is particularly concerning because it increases the likelihood of employees falling victim to phishing attacks, which remain one of the most common attack vectors6.

The author highlights that many organizations continue to underestimate the impact of workload pressures and workplace stress on security outcomes. As AI adoption accelerates and workforce restructuring becomes more common, employees are often expected to manage increased responsibilities while simultaneously adapting to new technologies. These conditions create environments where mistakes become more likely.

Importantly, the author challenges leaders to reconsider how human errors are interpreted. Rather than viewing mistakes solely as individual failures, organizations should recognize that systemic issues such as excessive workloads, poorly designed processes, and inadequate support structures often contribute significantly to errors7. This perspective aligns with modern risk management thinking, which recognizes that human performance is influenced by organizational design.

Another critical aspect of HRM involves understanding decision biases. Humans do not always make rational decisions, particularly when operating under pressure, uncertainty, or information overload7. Cognitive biases such as authority bias, confirmation bias, overconfidence bias, and normalization of deviance can significantly influence workplace behavior and cybersecurity decision-making.

Cybercriminals increasingly exploit these behavioral tendencies through social engineering attacks. The author referenced incidents involving organizations such as Marks & Spencer and Capital One to demonstrate how flawed assumptions, trust, and poor judgment can contribute to major security breaches. These examples reinforce the reality that cybersecurity is not solely a technological challenge but also a behavioral one.

This is precisely where Human Risk Management provides value. HRM shifts the conversation away from viewing employees as the “weakest link” and instead positions them as observable, predictable, and influenceable contributors to organizational resilience. The objective is not to punish mistakes but to better understand human behavior and create conditions that encourage safer decision-making.

Compared with traditional security awareness approaches, HRM emphasizes continuous adaptation, personalized interventions, behavior-focused risk reduction, and supportive learning environments. Research suggests that one-size-fits-all training programs are often ineffective because individuals retain only a small portion of information after completing training sessions4. Consequently, organizations must increasingly focus on sustained behavioral change rather than periodic compliance activities.

The importance of HRM becomes even more pronounced in the AI era. AI has the potential to amplify both human strengths and human weaknesses. A minor judgment error can now have far-reaching consequences when AI systems accelerate decision-making or scale outputs rapidly. Furthermore, governance frameworks continue to lag behind technological advancements, creating additional challenges for organizations seeking to manage emerging risks effectively.

Looking ahead, the author advocates for a transition from traditional combined assurance models toward continuous assurance, where business functions, risk teams, cybersecurity professionals, HR practitioners, and auditors collaborate to monitor and manage risks in real time. Such an approach enables organizations to proactively identify behavioral risk indicators before incidents escalate into significant operational or security events.

Ultimately, Human Risk Management is not about monitoring employees excessively or assigning punitive risk scores. Rather, it is about fostering a risk-aware culture built on trust, transparency, ethical monitoring practices, and respect for employee privacy. As organizations continue navigating an increasingly complex digital landscape, resilience will depend not only on the effectiveness of their technology but also on their ability to understand and positively influence human behavior.

In conclusion, a reminder that human factors remain central to organizational risk, with approximately 82% of breaches involving a human element. Whether through insider threats, fatigue-induced errors, or flawed decision-making, people continue to influence risk outcomes. Therefore, organizations that invest in understanding employee behavior, engagement, and risk-taking tendencies will be better positioned to strengthen resilience and navigate future challenges successfully.

References

¹ Reference: https://www.capitalone.com/digital/facts2019/

² Reference: https://www.syteca.com/en/blog/top-10-best-known-cybersecurity-incidents-and-what-to-learn-from-them

³ Reference: https://www.theiia.org/en/internal-audit-foundation/latest-research-and-products/risk-in-focus/

⁴ Reference: https://www.knowbe4.com/hubfs/0475_Human-Risk-Report_Dec-2025.pdf

⁵ Reference: https://www.mimecast.com/blog/insider-threat-examples/

⁶ Reference: https://www.scmagazine.com/news/95-of-data-breaches-involve-human-error-report-reveals

⁷ Reference: Reason, J. (1990). Human Error. Cambridge University Press. Human Error.

Categories
Resources & Articles

Does Employee Engagement Play a Role in Predicting Risk Management Outcome?

Risk Management banner

What would immediately pop up in your mind when asked about “employee engagement” and “employee engagement score”? This was a question posed to a group of senior audit leaders in a room. Most people would naturally relate it to job retention, job satisfaction, etc. and very few people would link it to risk management. This was also observed at the round-table discussion hosted by The Institute of Internal Auditors, Singapore on 17 March 2026.

Does Employee Engagement Play a Role in Predicting Risk Management Outcome?

I believe like many of the attendees, they were curious to find out what is the relationship between employee engagement and risk management.

Risk performance is a key business performance indicator as it measures how well an organization manages its uncertainties. Wellbalanced risk performance instills confidence in stakeholders (including investors) and improves organizational performance broadly speaking.Despite technology advancement, businesses are still run by human-beings.

Hence, employee engagement has emerged as a critical intangible driver of organizational performance, and its relevance to risk management outcome is increasingly recognized in both academic research and professional practice. Under the purview of Social Exchange Theory (Blau, 1964), it explains social relationships as a series of exchanges where individuals seek to maximize benefits and minimize costs. In simple terms, people engage in relationships – whether personal or professional – because they expect something valuable in return.

At the heart of the theory is the idea of reciprocity. When one party provides a benefit (such as support, recognition, or resources), the other party feels an obligation to return that benefit in some form. Over time, this ongoing exchange builds trust, commitment, and mutual dependence. Unlike purely economic transactions, these exchanges are often intangible – such as respect, loyalty, or goodwill – and are not always immediately repaid. This is often witnessed at workplace settings where employee engagement is heavily associated by it.

A key extension of Blau’s work is the concept of perceived organizational support(“POS”), which reflects how much employees believe their organization cares about their well-being. Research has observed that high POS strengthens the social exchange relationship, including employee engagement (Alvi, Abbasi, & Haider, 2014; Caesens and Stinglhamber, 2014; Tan, 2025). From a risk professional’s perspective, engagement can be viewed as a leading indicator – one that signals how effectively risk frameworks will translate into actual behaviors on the ground. This is particularly important because risk management systems, no matter how well designed, ultimately depend on human execution.

A long-term workplace studies by Gallup1 show that engaged employees consistently outperform their disengaged counterparts across a range of business metrics. When applied to risk management, these findings suggest that engagement enhances vigilance, accountability, and proactive risk identification. In contrast, disengaged employees are more likely to overlook controls, bypass procedures, or fail to escalate emerging risks -behaviors that directly undermine risk management effectiveness.

More recent research has begun to explicitly link employee engagement with riskrelated constructs such as risk appetite and risk culture. A 2025 dissertation study highlights that employee engagement mediates the relationship between perceived organizational support and risk appetite, which in turn influences overall risk performance (Tan, 2025). This insight is significant because it positions engagement as a mechanism through which organizational values and leadership intent are translated into individual risk-taking behavior. In other words, even if an organization defines a clear risk appetite, it is the engagement level of employees that determines whether this appetite is understood, internalized, and acted upon appropriately. Engaged employees are more likely to align their decisions with organizational risk thresholds, whereas disengaged employees may either take excessive risks or become overly risk-averse.

Empirical evidence from industry-focused studies further reinforces the predictive value of engagement in risk management outcomes. For example, a 2024 study on construction firms found that employee engagement has a statistically significant positive effect on competitive advantage and acts as a mediator between risk management culture, processes, and organizational performance (khadidiatou and Luo, 2024). The study reported measurable path coefficients indicating that higher engagement strengthens the effectiveness of both risk culture and risk processes. This suggests that engagement is not merely a “soft” human resource metric but a structural component of risk capability. Engaged employees are more likely to participate in risk reporting, contribute innovative solutions, and adhere to established controls, thereby enhancing organizational resilience and adaptability in uncertain environments.

Returning the discussion focus to the classroom, attendees were asked for their opinion about the difference in risk behavior between an engaged general employee and engaged internal auditor. Majority guessed that there would be risk behavior differences. One may think that given internal auditors play a “protector role” in organisations, the expectation is that internal auditors should have lower risk appetite than any general employees, leading to overall lower risk management outcome. In this study, Tan (2025) applied audit reporting risk rating as the measurement of the risk management outcome and noted that this hypothesis was not supported i.e. highly engaged internal auditors predict higher risk appetite but has little influence on the risk management outcome. Some attendees gave feedback that this result may be due to engaged employees knew that they can function within a safe environment and hence more willing to take risks to try at things. The probable reason why risk appetite of engaged internal auditor has little effect over organizational risk management outcome could be the measurement fitness. The attendees concurred that arriving at a final audit report risk rating comprises multi-factor considerations and not internal auditor’s risk appetite alone.

In conclusion, w while there are other exploratory considerations in this research topic, employee engagement plays a multifaceted and predictive role in shaping risk management outcomes. It influences how risk frameworks are interpreted, how controls are executed, and how risks are communicated within the organization. The evidence suggests that engagement operates both as a direct driver of performance and as a mediator that amplifies the effectiveness of risk culture and processes. For risk professionals, this underscores the need to integrate engagement metrics into risk assessments and governance frameworks. Rather than treating engagement as a purely human resources concern, organizations should recognize it as a strategic risk indicator – one that can provide early insights into potential vulnerabilities and enhance the overall effectiveness of risk management systems.

References

  • 1 https://www.gallup.com/workplace/285674/improve-employee-engagement-workplace.aspx
  • Alvi, A. K., Abbasi, A. S., & Haider, R. (2014). Relationship of perceived organizational support and employee engagement. Science International, 26(2), 949-952.
  • Caesens, G., & Stinglhamber, F. (2014). The relationship between perceived organizational support and work engagement: The role of self-efficacy and its outcomes. European Review of Applied Psychology, 64(5), 259-267.
  • KHADIDIATOU, .L. & Luo, .F. (2024). . International Journal of Management Science and Business Administration, 10(4), 49-69.
    Peter Blau (1964). Exchange and power in social life. New York, NY: Wiley.
  • TAN, Jenny. The role of employee engagement in predicting risk management outcome. (2025). 1-59.
Categories
Resources & Articles

Artificial Intelligence (AI) Transformation (&/Or Disruption) And Implementation Experiences: Views From Management, Board And Grc¹ Professionals

Artificial Intelligence
ISACA SG Chapter (ISACA SG) and Chartered A Accountants

On 7 November 2025, ISACA SG Chapter (ISACA SG) and Chartered A Accountants Australia and New Zealand (CA ANZ) Singapore organised our second roundtable discussion addressing the key concerns about artificial intelligence transformation.The roundtable was well represented by ISACA SG and CA ANZ invitees comprising senior leaders representing finance, technology audit, risk management, internal audit andcybersecurity to provide a holistic view ofthis discussion topic. Amongst the participants, there was a good mix of both financial institution (FI) and non-FI industry representation. The conclusion is that “AI projects can be seen as a strategic move if deployed right. The challenge lies in what’s “right” for your organisation and that requires huge effort to align properly”.

In today’s fast-evolving and fast-adoptiondigital landscape, organisations are expected to ride the AI wave to either boost its business performance or minimally boosting its productivity or both. AI is widely recognised for its potential to transform organisations. This is evident when private-sector investment in AI increased 18-fold from 2013 to 2022 and one survey discovered 58% of midsize organisations had deployed at least one AI model to production as cited by Ryseff, f, De Bruhl & Newberry, 20242.

Every transformation project experiences both positive and negative outcome and feedback. It is because any transformation project involves human p participationheavily and this brought on many sensitive challenges when dealing with the subject of human. Perhaps that is why when the statistics show that most transformation project failed is not a surprisingnews to some of us. On the other hand, some newer data suggests that organisations that treat AI as a strategic transformation (rather than just a technology experiment) report much higher success rates.

Do you think AI Transformation Projects have reached maturity or have met its purpose?

At the start of the discussion, the author (who is also the discussion moderator) asked the participants whether they think their respective organisations’ AI projects have been implemented successfully. More than half of the participants gave feedback that their projects are not quite successful (i.e. < 50% objectives met).

Given that majority of the participants concurred that their AI project implementations are not quite successful, the reasons and challenges of such low success rates were explored in the discussion. The following are a summary of the discussion points:

  • Define success – the term “success” is subjective and hence, the need to have clear metrics to make it an objective subject. And precisely that most projects do not have metrics outlined prior project implementation, or for those that have metrics outlined in their approval papers but were not measured against the metrics accordingly.
  • Start small or ready to fail – – some projects are prepared to fail at the beginning to enable better sensing of what success looks like. These may be included in the survey statistics and hence making the statistics a little skewed.
  • Follow the AI adoption trend – many may have started their AI projects without the end in mind, they just follow the wave and trying to have some head start to hopefully gain some competitive advantage.
  • Business returns of priority – there are some where purpose not met is fine as long as their customers accept the fact that AI projects have been deployed and perceived that the businesses must be of higher quality. To business owners (especially start-ups), hitting return on investments (ROI) is key and to demonstrate that there are room for improvements with assistance from AI projects to attract more sponsors/investors.

Do you think AI talents are readily available and what are the challenges in developing and retaining AI talents?

“World Economic Forum (Oct 2025)3 observed that today, 94% of leaders face shortages, with around one-third reporting gaps of 40-60% in AI-I-critical roles.”

meta

Not every organisation can afford an AI talent like Meta did. So, for the many “normal” organisations out there, how and where do they hire their AI talents? A At this juncture, not many have seen Boards as AI projects sponsors as the projects’ business values have not been clear. Management as sponsors observed that the organisations embarking on AI training for their employees early. While not all employees are expected to step into AI developer role, they need to understand how to leverage on AI to do their jobs better. Hence, employees who cannot work with AI well may risk losing their roles. All participants agreed that competencies need to be developed over time. The reality is that the whole world is suffering from AI talent shortages. All the more this t temporary talent shortage provides many employees the opportunity and time to pick up such skills and transform their roles accordingly.

An ironic situation happened now that many professionals went ahead to obtain AI related certifications and called themselves AI trainers &/or AI talents. Many of them do not have handson experiences to claim the status. I It was unanimous from the participants that o one has to handson with AI projects to understand and gain the how-to to implement AI projects. Especially with GenAI projects, you will not know what to expect from the GenAI after you have developed its model with your data for learning. Many mistake AI projects as just another automation project. So, the way to do this, although primitive but it works, is to openly recruit people and expect to train them accordingly. Without the initial investments to train, the talent gap will forever be there.

Do you think culture play an important role in AI transformation projects? Will it make a difference in mitigating AI risks?

In the Workforce Ecosystems: A New Strategic Approach to the Future of Work research from MIT Sloan 4 noted that “strong internally focused cultures, resistance to change, and organizational silo behaviours can stymie workforce ecosystems”. Culture does impact risk taking (Rehbein, 2014).

This view of “resistance to change” was concurred by all participants. This is especially true when employees “gang up” to prevent their job loss probability and exhibited resistance to change made AI transformation projects difficult and costly. On the other hand, there have been the other extreme of “loving AI culture” demonstrated by some organisations as observed and experienced by some of the participants. They observed interesting behaviour from the organisations that placed too much importance and reliance on AI produced output such that these organisations seem to be in their own “hallucinations” state.

There is a saying that “culture eats strategy for breakfast”. Since culture can influence risk taking behaviour, organisations should always ensure that their work culture is healthy and always put human as priority over AI projects. Another observation made by the participants that in addition to culture itself, not many organisations can handle change management well.This is evident when Management decides on embarking transformation project did not factor in work re-designing as one of their change management strategies. Hence, most transformation projects generate fear in employees leading to the above-mentioned challenges and outcome.

Is security-by-design essential in AI implementation?

“Yes!” Not surprising that the GRC participants responded positively. However, our business participants said that such methodology and practice are transparent to them. By the time the projects are passed on to them for testing, this concept is too late to be considered. As the training and understanding of a project team about security-by-design differs, it is suggested to include security risk as a criteria when evaluating and developing any AI projects.

“A“According to the F5 Networks “2025 State of AI Application Strategy Report”, although 96% of organisations deploy AI models, only 2% qualify as “highly ready” to secure and scale these systems.”

Conclusion

Embarking on the AI transformation project journey is a continuous one. However, many still fail to learn from the mistakes that others have gone through. Regulations and standards are always lagging behind, hence, project sponsors and teams have to be mindful of not neglecting security and risk strategies as part of your project considerations. Regardless which technology evolution phases we are in, research has shown that every technology evolution project implementation encountered two-third failures. The statistics for AI project implementation is also telling us likewise. The word “transformation” will always include human-in-the-loop. However, how to manage the change process well depends heavily on the maturity of the organisations people and culture.

Author: D Dr. J Jenny Tan (ISACA SG)

Organisers

  • CA ANZ – Samantha Chan, Acting International Leader and Daniel Ngo, CA ANZ Singapore Overseas Regional Councillor About CA ANZ (https://www.charteredaccountantsanz.com/)A professional accounting body | Chartered Accountants are known as Difference Makers
  • ISACA SG – Dr. J Jenny Tan, I Immediate Past P President and Yap Lip Keong, President About ISACA (https://www.isaca.org/about-us)A community of IS/IT professionals in pursuit of digital trust | We are working to build a better digital world.

CA ANZ and ISACA SG would like to thank the following persons for contributing their views at the round table leading to this article formulation:

  • Alvin Neo
  • Christopher Lek
  • Chin Shi Mei
  • Lim Ee Lin
  • Rajesh Laskary
  • Richie Tan
  • Sourabh Haldar
  • Sujeewa Padmasiri
  • Winnie Ang

References

1 GRC: Governance, Risk & Compliance

2 James Ryseff, Brandon De Bruhl, Sydne J. Newberry. The root causes of failure for artificial intelligence projects and how they can succeed. 2024. RAND Corporation

3 https://www.weforum.org/stories/2025/10/ai-s-new-dual-workforce-challenge-balancing-overcapacity-anddtalentshortages/#:~:text=Acute%20shortages%20in%20AI%2Dcritical%20talent,anticipate%2020%2D40%25%20gaps.

4 https://sloanreview.mit.edu/projects/workforce-ecosystems-a-new-strategic-approach-to-the-future-of-f-work/5 KPIs: Key Performance Indicators

Categories
Resources & Articles

A Human Risk Management Discussion- Skill Sets & Tools To Achieve Cyber Fitness

A Human Risk Management Discussion- Skill Sets & Tools To Achieve Cyber Fitness

On 6 November 2025, ISACA SG Chapter’s SheLeadsTech Programme (ISACASG SLT) and KnowBe4 organised an inaugural women-in-tech round table discussion addressingtwo rarely discussed components in building Security Culture – the People and Process components that often befuddles practitioners who would rather focus on the technology aspect. This discussion aimed to cover the tools supporting these two pillars, and the soft skills required to leverage them. The round table comprised women GRC1 leaders representing various industries from financial institutions, professional firms, transportation, real estate and business owners. The conclusion is that “Human risk management is not an optional item but an essential overarching component of enterprise risk management”.

Does culture influence corporate risk taking?

Have you ever wondered about this question? That is, does culture directly or indirectly influence corporate risk taking? There are various dimensions of looking at this question. The baseline finding is that culture does impact risk taking (Rehbein, 2014).

We now know that somehow culture i influence risk taking. But, w what is security culture and what about it?

According to Laycock

According to Laycock, Petric & Roer, 2015, “security culture depicts the human-related security elements in organizational settings, and is defined by the Security Culture Framework (Roer et. al., 2013) as “the ideas, customs, and social behaviour of a particular people or society (i.e. employees in an organization) that allow them to be free from danger or threats.

Truth is, the ideas, customs and social behaviours of any tribe (company, family, friends, etc.) is highly influenced by what individuals see, hear, say, do, know, feel within the tribe, which are based on underlying cognitive biases. And these biases are often times counterintuitive to the desired cyber safe behaviours that we want.

To change and overcome those cognitive biases would not be easy for after all;

“Comfort is the most dangerous addiction” a quote not directly from a specific text but reflects Aldous Huxley2‘s ideas about how prioritizing comfort can lead to a passive and controlled society,where people would be controlled not by force, but by an abundance of pleasure and convenience that would make them apathetic to their own subjugation.

Do you agree to get uncomfortable? And why?

With the context setting of the discussion as outlined above, the attendees were asked of this question “Do you agree to get uncomfortable, and why?”. Everyone agreed that we have to get uncomfortable and get out of our complacency. A one-size fits all kind of security awareness training is never adequate to address the issues that people face from all levels.

To get uncomfortable, firstly, the provider has to recognise this challenge and willing to take on a different approach to deliver security awareness to employees from all levels. For instance, if your organisation comprises 60% blue-collar workers, blasting of emails and requesting them to complete their online training will not be effective. Many may not even have email accounts since their jobs do not require them to do so. Hence, there should be security trainers to personally conduct face-to-face training to this group of employees, demonstrating to them what does phishing mean and how doessuch threats come about i.e. lots of show-and-tell and physical interactions. On the other hand, whitecollar workers such as developers do not read emails much too. Hence, phishing emails tests do not work effectively on developers. The so-called “good results” simply is a false positive!

Another consideration is to implement a culture metric in the organisation and report it to the Board periodically. However, w when culture becomes a measurable item, it may land itself as another tick box that Board will rely on the Management to report. And stakeholders’ management strategy may sneak in to manage Board’s expectations and again painting another false positive situation.

A real-life example of a Japanese bank going through digitalisation transformation process reinforced that getting uncomfortable is really very challenging. This is especially so when its culture is so strong and unique that changing mindsets is near impossible. At that time when this encounter was experienced, its culture d did not support remote working arrangements, hiring of talents excluded digital savvy considerations and age group matters. All these led to the transformation effort almost a failure.

So, getting uncomfortable needs a purpose-fit method to breakthrough existing work culture and a courageous, patient and competent talent to champion the change. This is essential as this is the first step towards building a resilient workplace.

Not sure where to start? Try embracing CLARITY. Ask what is the outcome desired, d, what kind of efeffort required, and what timeframe is affordable.

Caroline Soo, VP Customer Success at KnowBe4 explained that CLARITY can be achieved w when you know your boundaries i.e.

  • Outcome: What is your risk tolerance? (Business Impact)
  • Efforts: Cultural Maturity Shifts & Maintenance (In Phases)
  • Timeframe: Realistic timeline for expectations management (Tie back to business needs)

And clarity can be obtained from deploying a Program Maturity Assessment 3(PMA) tool to understand your organisation’s security culture maturity level. KnowBe4 believes that when you understand where your baseline is, you can set targets t to meet your goals. The assessment is best taken by senior leadership or business leaders who has a birds eye view across the 10 categories covered.

The attendees were requested to complete the assessment for their own organisations and gave their opinions about the assessment outcome. Most of them commented that the assessment outcome was expected with the caveat that they might not be best placed to answer the leadership and psychological safety areas where they may be out of bound for security professionals.

Having said the above, organisations management’s priorities are on business performance and often in a dilemma as the ROI from the efforts and costs required to build a good security culture is often not conveyed appropriately. Hence, the PMA itself is not a magic pill if a more personalisedorganisational business impact is iterated.

How do you define security culture? What does it cover?

The attendees were asked to define what is security culture as understood by them. Nothing surprising to note that everyone understands security culture differently. The challenge now is that when everyone has different definitions of security culture, the measures treating it will be different across organisations.

Roer et. al. (2013)4 defines security culture of having seven dimensions i.e

  • Attitudes: The feelings and beliefs that employees have toward the security protocols and issues
  • Behaviours: The actions and activities of employees that have direct or indirect impact on the security of the organization.
  • Cognition: The employees’ understanding, knowledge and awareness of security issues and activities.
  • Communication: The quality of communication channels to discuss security-related events, promote sense of belonging, and provide support for security issues and incident reporting.
  • Compliance: The knowledge of written security policies and the extent that employees follow them.
  • Norms: The knowledge of and adherence to unwritten rules of conduct in the organization, i.e. how security related b behaviours are perceived by employees as normal and accepted or unusual and unaccepted.
  • Responsibilities: How employees perceive their role as a critical factor in sustaining or endangering the security of the organization.

Some attendees provided feedback that some people, regardless the number of times they have undergone training, will not learn and keep making the same mistakes. Research has shown that p people under stress and/or having undesirable KPI5s will repeat mistakes. KPIs drive behaviour. Unfit KPIs drive wrong behaviour, leading to potential weak security culture.

Conclusion

  • Moves beyond simple awareness,
  • To systematically identify, measure,
  • And mitigate humanderived risk
  • Through a continuous, data-driven process.

Human risk management is a journey and is essential when the workforce is getting mobile and globally interconnected. It is essential when technologicalevolution is fast-paced and m moving towards optimal digitalization is unavoidable. When technology is a business enabler, it also introduces digital risks into the organization. Human risk management is the ultimate answer to ensure enterprise risk management holistically.

Author’s notes: In addition to digital track human behaviour, another aspect of human risk management is through the organizational behaviour focus. For instance, employee engagement, job satisfaction and others contribute to human risk management too. This focus was not discussed at this forum.

Author: D Dr. J Jenny Tan (ISACASG SLT)T)

This discussion was led by Ms Caroline Soo, VP Customer Success, APJ, J, KnowBe4 and facilitated by Dr. Jenny Tan, Immediate Past President & SheLeadsTech SG Founder, ISACA SG.

Round-d-table Sponsor: KnowBe4 (h(https://www.knowbe4.com/about-us)

  • Cathy Huang
  • Cynthia Cheong
  • Janice Teo
  • Jemma Renshaw
  • Karen Tiong
  • Kusum Pinto
  • Liew Shu Xian
  • Lee Tun Leng
  • Margie Pagdanganan
  • Rachel Holden
  • Sabrina Loi
  • Wendy Lim

References

1 GRC: Governance, Risk & Compliance

2 Aldous Huxley (1894–1963) was born into a prominent English intellectual family and educated at Eton and Oxford. He is a writer and a philosopher. He is most famous for his dystopian novel, Brave New World (1932), which serves as a warning about technology and social control.

3 Free assessment tool from KnowBe4 (https://www.knowbe4.com/free-cybersecurity-tools/program-maturity-assessment)

4 Aimee Laycock, Gregor Petric and Kai Roer. The seven dimensions of security culture. 2015.

5 KPIs: Key Performance Indicators

Categories
Resources & Articles

Balancing Between Senior Management & Board’s Expectations And CISOs’ Burnout

On 2 July 2024, ISACA SG Chapter (ISACA SG) and Chartered Management Institute (CMI) Singapore organised an inaugural round table discussion addressing the key concerns about balancing Chief Information Security Officers (CISOs) state of wellness and discharging Senior Management & Board’s expectations. The round table was well represented by ISACA SG and CMI invitees comprising CISOs, Technology Auditors, CEOs, Board members, Government Agencies, Risk Professionals and Associations’ Key Representatives to provide a holistic view of this discussion topic. The conclusion is that “Building a Resilient Cybersecurity Culture is A Whole of Company Approach”.

In today’s fast-evolving digital landscape, cybersecurity is not merely the responsibility of the CISO or the technology team; it is a collective responsibility that must be driven from the top by the board. The Tone-at-the-Top principle is crucial to drive the right behaviour of any organisation building a resilient cybersecurity culture.

The role of the CISO is critical, but it is part of a broader strategy that requires the entire organisation to be involved. This article explores the dynamics between boards and technology risk professionals, emphasising the need for a cohesive approach to managing technology risks, fostering resilience, and achieving business objectives.

“A recent survey report¹ released by ThreatReady from HackTheBox indicated that 90% of the CISOs surveyed are concerned about stress, fatigue, or burnout affecting their team’s well-being. Yet only 8% of them are considering quitting their jobs due to overtime, stress, burnout, or mental health challenges within their role in cybersecurity.”

Unrealistic Expectations and Misplaced Blame and Hidden Risks

One common issue is the expectation that technology professionals can solve all cyber security problems leading to misplaced blame when cyber-attacks arise. Boards must understand that technology belongs to everyone in the organisation, not just the technology (and risk) team. Accepting that there will be lapses in people, processes, and technology is essential, especially in a constantly changing environment. A recent findings of the World Economic Forum indicate that human error accounts for 95% of cybersecurity incidents. Therefore, Board has to take the whole of company approach to build cyber resilience and mitigate the business disruptions caused by cyber-attacks and threats.

If the attitude of the Board is not changed, it can result in the hidden risk of burnout of CISO and technology professionals.

Cybersecurity and Business Alignment

The Board and the C Suites face an uncertain and challenging operating environment caused by geopolitical tension, wars, intense competition, supply chain disruptions, capacity and talent constraints; and new and changing laws and regulations. These issues occupy the priority list of most Board Agendas. It is telling that cyber security risks are relegated to the Chief Technology Officer (CTO) and CISO and most Board do not have members who are familiar with managing cyber security risks.

The rise in cyberattacks, has disrupted business services, breached confidential and privacy data, caused harm to critical systems, and resulted in reputational damages and monetary losses. The Board and C Suites need to reprioritise resources to manage cyberattacks and build a culture of cyber resilience. Cybersecurity is not just about technology; it involves people and processes. Attackers often target employees, making them soft targets. Therefore, it requires the Board and C Suites to change mindset and make it a personal responsibility of everybody to be vigilant on cyber threats.

The Board has to include cyber threats as a key risk in the organisation enterprise risk management system. In setting the risk appetite and risk tolerance, the Board has to recognise it is not realistic to put a zero risk tolerance for cyber threats. It is proven that no matter how robust is your cyber defence orientation, clever hackers can still breach the defence. Therefore, the Board must work with Management to put in place a business continuity framework that ensures the protection of critical information infrastructure and the recovery of these infrastructures from cyber-attacks.

Effective Communications and Building Trust

CISOs and technology professionals need to build trust with Management and Board Members through effective communications. A common observation is that they do not consider business objectives and budgetary constraints when requesting capital investment in cyber security infrastructure. Some inject fear and go into technical details that befuddle the decision-makers. These are not helpful in building trust and obtaining buy-in from Management and the Board.

Accountability and Ownership

When a breach occurs, determining liability can be complex, especially if it stems from user errors. Building resilience means not relying solely on external support or government funding. Instead, organisations should focus on identifying and protecting critical information assets and preparing for recovery. Balancing cyber protection with investment cost is vital, and Board must be aware of the trade-offs involved.

“A Harvard Business Review article² wrote that Boards focus on protection when they need to focus on resilience, and Boards believe cybersecurity is a technical topic. Hence, Boards are having wrong conversations in their board rooms!”

Building a Culture of Resilience

A resilient organisation is one where the senior management, board and CISO work together to address and learn from incidents. Instead of seeking quick fixes, the focus should be on continuous learning and improvement. Security should be integrated into the business culture, with investments justified by their contribution to business benefits. Sudden budget increases are not the solution; a consistent and strategic approach is needed to make security an integral part of the business.

Building a culture of resilience starts with the board, which must shift from a compliance mindset to a growth and performance mindset. The board needs to provide:

  • Purpose and Direction: Clearly defining the organisation’s cybersecurity goals and objectives, including clear risk appetite of cyber risks. It is not realistic to take a zero
    tolerance approach to cyber threats.
  • Developing People and Capability: Investing in training and development to so that every staff is vigilant on cyber threats.
  • Building Relationships and Networks: Fostering collaboration across departments and with external partners through effective communication.
  • Leading Change and Innovation: Encouraging innovation in cyber resilience and stay ahead of evolving cyber threats.
  • Managing Resources and Risks: Allocating resources effectively to manage and mitigate cyber risks. Promote proactive risk management where risk professionals are consulted early to mitigate any cyber risks that lead to reputational damages and financial loss.
  • Achieving Results with Defined Outcomes: Setting and measuring clear outcomes to ensure the effectiveness of cybersecurity initiatives. Cybersecurity key performance indicators (KPIs) should avoid external factors that are not within the control of the CISO team e.g. number of breaches attempted from attackers, etc.

Communication and Education

“CISOs will not have a seat at the Board table. They are just too technical. Their reporting officer such as Chief Information Officer or Chief Digital Officer may be considered. Board’s role is to provide strategic directions and risk oversight of an organisation.” – commented by several experienced Board members in & outside of the discussion

Effective communication is key to aligning board expectations with technology realities. Boards, often composed of individuals with backgrounds in accounting, law, or business, may lack technical cybersecurity expertise. In addition, Board members with decades of experiences may likely come from the non-digital era where certain habits, knowledge and skills require time to (re-) develop.

Educating them on the importance of technology risks and using a risk-based approach is crucial. Simplifying technical jargon and focusing on the business impact can help bridge the understanding gap.

The role of the CISO is multifaceted, requiring both technical expertise and business acumen. It involves not just managing technology risks but also influencing organisational culture to foster resilience. CISOs must communicate effectively with the board, using storytelling to convey complex issues and justify investments. They should work closely with risk, audit and compliance departments to align risk strategies. The story is not for CISO to tell alone. It is a combined effort to showcase the value that risk investments are worth it.

The Role of Management

Technological landscapes are continuously evolving, and organisations must adopt a risk-based approach to manage these changes effectively. No matter how many controls are in place, there is always a risk of attacks. At the board level, discussions often focus on frameworks without integrating the people, processes, and technology components. Managing tech risk involves creating a resilient system that can detect, respond to, and recover from incidents. Boards must recognise that cybersecurity is not just about managing technology risks but ensuring business resilience.

At the management level, the right support provided to drive the right direction is very important. Management is often the cushion in between the Board and the CISO team. If the Management team leaves the technology risk effort to the CISO team alone, then everyone will get disappointed. Management can help to create adequate opportunities for the CISO team to engage with both Senior Management and Board to share technology risk insights. It should preferably not be the last agenda item on the Board agenda where 5-minute session was allocated to discuss cyber security risk. And it should not be a box ticking agenda either.

Currently, the position of CISO is not yet a core team member of the C Suites. Most CISO reports to a Chief Information Officer (CIO) or the Head of Technology, or the CFO. Therefore, cyber security issues continue to be relegated as an operational issue, not a strategic issue. It is necessary for the Board to consider elevating CISO to be a regular invitee to the board room before considering making CISO a core member of the C Suites. Regular attendance of Board room activities help to develop CISOs’ strategic thinking skills and may be one of the talent development opportunities to prepare CISOs for higher role and responsibilities.

Conclusion

A CISO’s role includes developing a robust risk management framework and coordinating with risk owners to mitigate cyber risks. They need strong interpersonal communication skills to effectively engage with risk owners responsible for managing cyber risks. Cyber risks must be a mandatory checkpoint for every business process design, incorporating technologies from the start. Many organisations make the mistake of adding cybersecurity as an afterthought, making the CISO’s job arduous and the expectations of the board difficult to meet.

Cybersecurity is not just the responsibility of the CISO; it is a collective effort that requires the involvement and commitment of the entire organisation, driven from the top down by the board. Realistic KPIs and the cyber vigilance of the entire organisation is necessary to mitigate the risk of cyber-attack.

Building a strong, collaborative relationship between boards and technology teams is essential for navigating the complexities of today’s digital world. By fostering a culture of resilience, aligning cybersecurity efforts with business goals, and improving communication and education, organisations can better manage technology risks and achieve sustainable success. A simple test of commitment from the Management and Board for a cyber/ business crisis management simulation can indicate the maturity of the organisation resilience commitment.

Lastly, committing to organisational risk resiliency is a journey. Businesses need to appreciate that good risk performance leads to good business performance.

Co-authors: Jenny Tan (ISACA SG), Hoi Wai Khin (CMI) and Tay Woon Teck (CMI)

1 Reference: https://resources.hackthebox.com/building-a-firewall-against-cybersecurity-burnout?utm_source=linkedin_newsletter&utm_medium=social&utm_campaign=building_a_firewall_against_cybersecurity_burnout_report&trk=article-ssr-frontend-pulse_little-text-block

2 Reference: https://hbr.org/2023/05/boards-are-having-the-wrong-conversations-about-cybersecurity

Organisers:

  • CMI – Tay Woon Teck, Chairman and Hoi Wai Khin, Education Director, CMI
    About CMI (https://www.managers.org.uk/about-cmi/)
    Turning accidental managers into conscious leaders
  • ISACA SG – Jenny Tan, President and Yap Lip Keong, Vice-President
    About ISACA (https://www.isaca.org/about-us)
    A community of IS/IT professionals in pursuit of digital trust | We are working to build a better digital world

CMI and ISACA SG would like to thank the following persons for contributing their views at the round table leading to this article formulation:

  • Andreas Dannert, Principal Enterprise Security Architect, Standard Chartered Bank
  • Anthony Ong, Vice Chairman, CMI, Senior Advisor,Adera Global
  • Chan Meng Fai, Senior Manager IT IA, SingaporeAirlines
  • Chua Chay, Head MCISO, Mindef
  • Hardik Thaker, Executive Director, Tech & CyberRisk & Cybersecurity, GXS Bank
  • Murari Kalyanaramani, SID Digital ChapterCommittee Member, UOB CISO
  • Patrick Tay, COO & GM, Data ConnectTechnologies (Co Konica Minolta)
  • Phoram Mehta, Senior Director and CISO International Markets, PayPal Pte Ltd
  • Saw Ken Wye, Honorary Chairman, CMI, Director En-Vivo Pte Ltd
  • Siew Yim Cheng, Senior Vice President, Digital Value Chain Solutions, Yara Asia Pte Ltd, Council Member, CMIStephen Ching, President, IIA
  • Tan Boon Yen, Senior Director Risk Advisory, RSM Singapore
  • Veronica Tan, Director, Cybersecurity Agency of Singapore

Categories
Resources & Articles

2024 SheLeadsTech Conversion Programme (SLTCP) – Training Phase Completion Celebration

Training Phase Completion Celebration

31 May 2024 is a very special day indeed! It marks the completion of the FY2024 SLTCP Cohort’s training phase, and the beginning of their three-month internship. ISACA SheLeadsTech (SLT) invited the cohort, SLT ambassadors, SLT mentors and SLTCP key corporate partners to celebrate together at Palms Bistro @ 60 Anson Road.

The event started off with a sumptuous dinner buffet. Jenny Tan (ISACA Singapore Chapter President) gave her opening speech, taking the attendees through the history of SLTCP – a partnership programme between ISACA SG Chapter SLT, Tech Talent Assembly (TTAB) and Employment and Employability Institute (e2i) that began in FY2022. The vision of SLTCP was to demystify technology and ease the conversion, growing a healthy pool of technology risk / audit professionals. One unique feature about our current FY2024 cohort is that it is a mix of both male and female participants. Recognition was also given to

SLTCP mentors, trainers and partners. Personally, I was struck by the passion and determination demonstrated in Jenny’s opening. It’s been a privilege to take the mentor role and be a small part of this meaningful programme.

Jenny Tan (ISACA Singapore Chapter President)
SLTCP mentors

The next segment was a motivational talk, very aptly titled “Designing your life” by Lance Foo (Group Talent Acquisition Leader, NCS). Lance inspired us with her own career story – from a biotechnology graduate who found her calling in Human Resources and boldly asked for the role Managing Director, not but twice, and succeeded when she was in her early twenties. She also imparted three wise messages to the attendees: 

1. Do not change. Evolve. 

2. Find your true north. 

3. Patience is a virtue.

Next was the highlight of the event. Each FY2024 SLTCP participant was presented by Jenny Tan, their certificate of completion of the training phase, and a word cloud of encouragement from their fellow participants. There were lots of smiles and cheers all around!

And when everyone thought that the award ceremony was the finale, Jenny announced a surprise “MOST” award, e.g. Most serious, Most caring. Winners were voted by the cohort themselves.

Last, but not least, the top three scorers of FY2024 were announced, walking away with generous cash prizes.

Overall, it was an enjoyable and heart-warming evening spent with like-minded technology risk professionals. Wishing our FY2024 SLTCP Cohort all the best in their internship!

 

Author: Cheryl Gan (SLT Ambassador), 11 June 2024
Each FY2024 SLTCP participant (1)
Each FY2024 SLTCP participant (2)
Categories
Resources & Articles

Singapore’s SheLeadsTech conference celebrates 5 years

Photo-7-3-2024-9-08-58 am-scaled

The fifth annual ISACA Singapore Chapter SheLeadsTech Conference was held in Singapore yesterday, with more than 200 attendees in total for this hybrid event.

Guest-of-Honour, Puay Li Phua, and Jenny Tan, President of the ISACA Singapore Chapter shared the futuristic mission that SheLeadsTech hopes to achieve in the next 5 years.

In her opening keynote, Puay Li Phua affirmed, “The CSA is committed to promoting inclusivity within the tech industry. For example, the CSA SG cyber women’s initiative was established to attract a diverse local talent through partnering with professional associations and nonprofit organizations to encourage girls to pursue tertiary education in cybersecurity and inspire women to take on cybersecurity roles.

So over the past four years, we have supported outreach, engagement and training efforts reaching out to almost 3,000 girls and women. For example, in 2019, various industry associations and community partners jointly organized a series of events, ranging from a capture the flag competition for girls only career sharing relevance to technical workshops.

At the national level, the government has also implemented measures to provide more support to women at their workplace. For example, Minister Josephine Teo was the Minister in Charge of Cybersecurity, as well as, the Minister in Charge of Communications and Information recently announced that there will be new legislation to be introduced in the second half of 2024 to provide better protection against gender discrimination and ensure that job seekers have better access to job opportunities. The legislation will also provide better guidelines for employees when it comes to managing flexible work arrangements, given that women tend to still carry more of their caregiving load. This move will better support women by allowing them more flexibility in their schedules are mainly for work and family commitments.

So in light of these significant measures and programs being implemented at both the organization and national levels. Let us reaffirm our collective commitment and continue to support and uplift a more inclusive cybersecurity and technology industry.”

Photo-7-3-2024-8-49-19 am-scaled

Puay Li Phua, Senior Director (Policy and Corporate Development) of the Cyber Security Agency of Singapore (CSA)

The conference heard inspiring stories from our fireside chat speakers (Wynthia Goh, Beatriz Silveira ITIL Leader,CISSP,CISM,CRISC,CCISO, Shamane Tan) as well as student mentee (Candy Tam) and SLT Ambassador (Adeline Chan) benefitting from the SheLeadsTech Programme and how this platform has enabled them to pay forward too!

Fireside chat with L-R Beatriz Silveira, Wynthia Goh, Shamane Tan and Jenny Tan

The conference was not lost on technical content with presentations by Joyce, Lee Keng Chua, Lorraine Lee, CIPP/E, Claire Lim, Daiane Faller, Siu Wei Lee and Qiyun Woo (胡绮芸) addressing data privacy, to AI governance, to AI regulations to ESG.

Photo-7-3-2024-8-41-50 am-scaled
Categories
Resources & Articles

State of IT risk in Singapore

State ofIT risk in Singapore
by Allan Tan — December 6, 2023
The ISACA Singapore and Frost & Sullivan Cyber Security Survey 2023 warned that 86% of companies in Singapore are identified as being at risk of cybersecurity incidents. This finding underscores the pressing need for businesses to prioritise cybersecurity measures and protect their digital assets.

Frost & Sullivan director and head of the Asia Pacific Cyber Security Practice, Kenny Yeo, says Singapore faces two broad trends that are impacting the state of digital risk. Among respondents to the first, 83% are accelerating cloud adoption over the past 12 months. Further, 87% said they are pursuing a cloud-first strategy or have production projects in the cloud. “Organisations are also going multi-cloud to scale capacity and increase technical capabilities quickly.

But with this push towards cloud, many organisations are still not protecting their cloud adequately,” warned Yeo.

He added that organisations are also facing greater complexity, dealing with digital transformation projects, while maintaining business-as-usual (BAU) and legacy systems. He posits this means new and existing cyber security solutions must work together, with data residing in multiple siloes.

“This, unfortunately, leads to more organisations getting hit with cyber incidents. This is not just an enterprise issue, but also a personal individual challenge as well, as you can see from multiple scams hitting the vulnerable and unaware digital users."

— Kenny Yeo
Kenny Yeo
Kenny Yeo
Andrew Lim, managing director for ASEAN at Kyndryl, says Singapore’s strongregulatory environment, advanced infrastructure, and skilled workforce set a high standard.

That said, DPM Heng Swee Keat, speaking at the Singapore International Cyber Week 2023, said the key to fully harnessing technology as a force of good lies in forging partnerships across borders and sectors. This is particularly important as other ASEAN nations seek to enhance their tech utilisation.

The ASEAN Cybersecurity Cooperation Strategy holds the potential to unite the region, as it seeks to foster trust, enhance cyber readiness, and facilitate international cooperation for a safer and more prosperous digital environment.

Impact on enterprise security strategies

Asked how the trend is impacting enterprises’ IT and security strategies, Jenny Tan, president of ISACA Singapore Chapter, says with the high level of cloud adoption, data protection should be one of the key IT and Security Strategies.

She conceded a lack of visibility on this front as an issue going against organisations’ efforts to maintain high degrees of cybersecurity readiness.

“In our recent ISACA SG Survey, it was noted that one of the most challenging efforts is to have senior management buy-in as most still think that the security effort is only at the technical pursuit.”

— Jenny Tan
Jenny Tan
She added that the survey results also showed that most enterprises who adopted cloud solutions think that they have transferred their security risks to the cloud service providers.

“With this survey outcome in mind, we can assume that enterprises may not put in much effort to review their existing security strategies to deal with their shift in IT resource management,” she commented.

In a separate study, Lim described an intriguing paradox: 88% of respondents expressed confidence in their organisation’s preparedness for adverse events, while 92% reported experiencing such events in the last two years.

It is this disconnect, notes Lim, that underscores the importance of enterprises prioritising boardroom discussions on IT risk, enabling top-down organisational alignment and supporting necessary changes to ensure cyber-enabled systems can remain operational during adverse events.

“With this strategic shift, enterprises are seeking to minimise system disruptions and their potential impact on a brand’s productivity, reputation, and financial performance,” said Lim.

Persistent cyber vulnerability of SG enterprises

At the C-Engage Convention , CIOs and security professionals participating as guests’ panellists acknowledged the importance of cybersecurity across organisations, industries, and governments. But the journey towards this level of recognition has not been smooth sailing, nor is it still.

Market analyst firm Canalys forecasts global cybersecurity spending (including enterprise products and services) to reach US$223.8 billion in 2023, with growth in the delivery of cybersecurity services outpacing product shipments.
canalyse-2023
Source: Canalys 2023
Canalys says persistent heightened threat levels will keep cybersecurity high on the list of investment priorities for organisations.

“But not all planned projects will be signed off, as pressure mounts on budget holders to scrutinise spending and focus only on the most pressing cybersecurity needs to minimise the risk of breaches.”

— Canalys
Tan posits organisations’ vulnerability will continue to persist in the years ahead attributing the key reasons to lack of talents and continuity of talents in an organisation, lack of security prioritisation by the Board and senior management, and high compliance costs in implementing security strategies.

Where vulnerabilities lie

Source: ISACA Singapore and Frost & Sullivan Cyber Security Survey 2023
Reflecting on the 5th annual ISACA Singapore and Frost & Sullivan enterprise security survey, Yeo says unpatched systems, unrelenting phishing email attacks, and third-party supplier compromise as well as data leakages accounted for much of the sources of the attacks that enterprises, governments and consumers faced in 2023.

“Top hygiene factors like vulnerability management and a systematic patching regime are number one, with the most popular vector of attack being phishing emails,” he elaborated.

Kyndryl’s Lim says talks with IT decision-makers and risk and compliance professionals, suggested that the ongoing global IT skills shortage may be a concern, but it doesn’t not top the list. The most frequently cited challenge by respondents was the inability to recover systems and data from encrypted, clean backups when dealing with adverse events.

“We encourage them to consider investing in automating and orchestrating recovery processes, assessing and establishing how best to mitigate human error in restoring from backups, and to test incident response plans repeatedly and often.”

— Andrew Lim
Andrew Lim
Andrew Lim

Accountability and responsibility should cut both ways

At the national level, there is recognition in Singapore that cybersecurity is a collective responsibility. Yeo acknowledges that any IT solution or cyber security tool has vulnerabilities because imperfect humans are involved in its development.

“Too often technology is the primary focus for organisations in their cyber security protection, but training and enabling people is also crucial, along with coming up with policies and processes anticipating a breach as well.”

— Kenny Yeo
“Cyber security is something that everyone in the organisation needs to pay attention to, not simply the technical team, but the board of directors, senior management to line staff too,” said Yeo.