The approach that allows for the effective integration of the Risk Management process into the corporate management system is a framework typically based on the PDCA (Plan, Do, Check, Act) cycle.
Although ISO 31000:2018 does not explicitly refer to this approach, it is clear that using the PDCA approach is advantageous, with top management strongly leading Risk Management and fostering this security-oriented mindset by developing people and teams. This commitment at every level is therefore a central point that ensures the effectiveness and efficiency of the risk management process and should be demonstrated through rigorous strategic, tactical, and operational planning.

In this sense, corporate leadership should establish and approve the Risk Management policy and ensure that it is compatible with the organization’s strategic direction and aligned with its culture. In addition, it must assign roles, responsibilities, and authority at the most appropriate levels of the organization and ensure the integration of the Risk Management process with the organization’s strategic, tactical, and operational processes. Finally, and equally importantly, it must provide adequate resources to carry out this activity and establish indicators to measure performance, making sure these indicators are integrated with other organizational KPIs. It is also important that leadership be able to communicate the benefits achieved at the management level to all interested parties—both internal and external—and promote the continuous improvement of the risk management framework. Lastly, corporate leadership must define the criteria and levels of risk acceptance and conduct periodic audits to evaluate the adequacy, suitability, effectiveness, and efficiency of the risk management process, thereby demonstrating its commitment to continuous improvement.

As repeatedly mentioned in these newsletters, in order to ensure the complete integration and internalization of risk management with all corporate processes, one must have a thorough knowledge of the organization’s structure and context. In fact, risks exist everywhere in an organization, at every point in company processes, and each person should be sensitized and held responsible for identifying and reporting any risk factor as early as possible.

For the framework and the risk management process not to be just a set of procedures or a top-down manual disconnected from day-to-day operations and from the people involved at every stage, it is advisable to define suitable training for all resources, at every level.

In a sense, every employee of an organization is a “security guardian” and must be trained to recognize any risk signals and minimize them in real time.

The importance of training and raising awareness of Risk Management at all levels is perhaps best illustrated by passenger aviation safety, in which airlines and regulatory authorities invest time and resources to minimize risks and ensure that passengers are prepared to respond correctly in emergency situations. As you all know, before each takeoff, the crew—who can be seen as our Security Team—provides fundamental information through a safety demonstration or video, which typically includes the location of emergency exits, the use of oxygen masks, and information about emergency lighting that guides passengers to the exits. In reality, the crew is training us in risk mitigation by teaching clear procedures and protocols for dealing with an incident.

We are usually inattentive and distracted when these procedures are explained, and unfortunately, we are well aware that most people change their bad or negligent habits only after a security incident, because only then do they recognize a real threat and its consequences.

In recent years, gamification has been used as a simple and interactive strategy to learn best practices and improve competence in corporate security. In the United States, various organizations have successfully implemented gamification programs to enhance internal security.

As outlined in the article “Using Gamification to Improve the Security Awareness of Users: The Security Awareness Escape Room,” employees often represent a high-level risk in all organizations because they are the weakest link in the security chain. Mitigating this risk is not easy, and the only effective countermeasure is to improve employee security awareness and support their knowledge.

Security specialists have many options, including implementing awareness campaigns that may be monthly or annual. Traditional security improvement programs typically use posters or comics (remember the card you find in the seat pocket in front of you on an airplane?) about security rules or printed instructions posted on a bulletin board, which are not very effective. In-class training often involves lectures by security experts or distance learning modules (e-learning).

However, it has been shown that training is more effective when the presentation includes real-life examples or when gamification is introduced, meaning typical game elements and dynamics are used to increase audience engagement. The elements that are part of the game may include badges, leaderboards, scores, levels, and challenges. For example, in a company, employees can earn points by reporting risk factors.

To create a security game that can truly improve user knowledge, it is first necessary to assess the current state of awareness and identify bad habits, then define rules based on experience. Thoughtful program design and creativity are essential for success; it is also important that the game provides something of value to employees because players like to win, even if the prize is just a virtual badge or a certificate.

The most effective way to improve security awareness is to let participants experience what they or their colleagues do wrong. In the game, employees take on the role of “security guardians.” The goal is to protect the company from different types of threats through missions, challenges, and quizzes that test their knowledge and skills in corporate security.

In conclusion, gamification can also be effectively applied to corporate security to engage employees, enhance awareness, and strengthen an organization’s defenses against threats.