IT Week: IT is often seen as a benefit for businesses, but to what extent does it also pose a danger?

Chris Potter: We live in a time of unprecedented technological change and complexity and whenever you get change and complexity together you get risk. A simple example is television. The transition from analogue to digital is great in terms of access to new services, but it also brings new costs in the expense of the switch-over and the increased difficulty of finding what you want because the choice is so much bigger.

How does this relate to the business environment?

In business you find similar challenges. The first is the challenge from emerging technologies. For example, voice over IP [VoIP] will mean all telephones will change over the next 10 years, leading to new services and lower costs, but there are new risks associated with this that firms need to be aware of. Security is also a massive new risk. A recent DTI survey found the cost of security breaches to small and medium-sized businesses [SMBs] had risen by 50 percent in two years and accounted for half a percent of their turnover.

What impact can these dangers have on business?

The issue is that business dependence on technology is always increasing. According to the DTI report, 63 percent of small businesses handle confidential information [using technology]; 66 percent would suffer disruption if that data got corrupted; and 56 percent would suffer disruption if data was not available. All these metrics are up on two years ago.

What can businesses do to reduce the risk of disruption?

The most important thing businesses can do is assess the risks they face. They need to think through the issues they face arising from technology and the controls they have in place. But to do that you need sufficient expertise in measuring risk. For example, when it comes to IT security, many smaller companies won’t have in-house expertise and often need to seek out external advice to assess their risks.

What type of advice do you offer?

You must make decisions about risk in a commercial way. There is no point spending £10,000 to save you £1,000. You need to work out which risks you’ll live with, which you need to mitigate, and which you need to insure. Risk assessment is less mature for small businesses than larger firms, and they are suffering as a result. If you take security as an example, according to the DTI the cost of security breaches for large firms has fallen 50 percent as it has risen by 50 percent for smaller firms. That is because large firms have assessed the risk and acted.

Can firms get advice from other sources, besides consultancies?

The DTI gives a lot of guidance on how to assess risk and there are other sources of free information. You don’t necessary need someone external to do it for you and many firms are doing it themselves and doing it well. But you also need to keep running your business, so it can be better to bring in a specialist.

Chris Potter will speak on Managing Technology Risks in SMBs at the Softworld Total Business Solutions Conference at Birmingham’s NEC, 18-19 October.