4. What are the application risks?

4.1 Setting up a complex risk management system

Risk management is a highly developed and mature concept in certain fields and sectors, such as finance, IT security, safety and so on. In some organizations, it is advisable to set up a risk management system as recommended in ISO 31000, with working groups for risk identification, methods for risk analysis, and decision-making groups for risk assessment. In some other organizations, the risk-based approach does not require such a systematic and comprehensive procedure. In all cases, we must be wary of deploying a risk management system that is more complex than it needs to be. Instead, we must stick to a pragmatic, reactive risk-based approach, adapted to the needs and challenges of the organization concerned.