How to Build Cross-Functional IT Risk Management Teams

Enterprise IT risk management requires a cross-disciplinary council that integrates technical, operational, legal, and financial leadership to address escalating cyber threats.

This shift moves beyond traditional server-room security to a governance model where business stakeholders share accountability for the digital risk profile.

The Tech TL;DR:

• IT risk teams must move beyond simple perimeter defense to include business unit leaders who evaluate operational impact.
• Effective governance requires a designated owner for the risk register to prevent accountability gaps between IT, finance, and operations.
• Human-centric vulnerabilities, such as social engineering, require specific testing and training protocols that often remain absent from technical security stacks.

The recent breach of the cryptocurrency exchange Binance, which resulted in the theft of $6.3 billion in digital assets and subsequent customer withdrawals of at least $3 billion, highlights the consequences of inadequate risk management.

According to Information Week, this attack utilized a combination of social engineering and a deceptive job interview process to compromise internal systems. This incident shows that C-suite leaders must assemble multifaceted teams that can identify, assess, and control disruptions before they impact corporate earnings.

Cross-Functional Team Composition

Chris McGlasson, a fractional CIO for several midmarket firms, manages risk by keeping teams small and cross-functional by design. “I want someone who owns security, someone who owns infrastructure and backups, a partner in finance, and a leader from operations,” McGlasson told Information Week. He emphasizes that finance team members are nonnegotiable additions because every risk decision is fundamentally a business decision.

Paul Zikmund, who teaches in the chief risk program at Carnegie Mellon University’s Heinz College, notes that an effective IT risk team cannot operate as a technical island.

“While core IT operations, infrastructure, architecture and information security leaders are essential foundationally, the team must also extend to key business stakeholders,” Zikmund told Information Week. He argues that including business unit leaders ensures that risks are evaluated based on operational impact rather than managing technical vulnerabilities in a vacuum.

Identifying Internal Blind Spots

Internal IT teams often develop blind spots after defending the same systems for extended periods. Mark Sternig, CTO at the healthcare IT firm Focus, explains that an outside hire or partner brings pattern exposure. “They’ve watched this go wrong at plenty of other organizations, so they can catch the early warning your own team has stopped noticing,” Sternig told Information Week. Bryan Martin, CTO at 8×8, adds that leaders often wait too long to engage external partners. Martin told Information Week that what matters more than a resume is the ability for a partner to sit down with an engineer and talk through a real system rather than presenting slides to a board.

Tengo Meskhi, CEO of Conceptdigital and former deputy CIO at the Bank of Georgia, identifies the underestimation of the human element as the primary failure in current risk management strategies.

“As a result, most teams are built to defend the perimeter and its systems, and almost nothing is built to defend the people,” Meskhi told Information Week. He suggests that the risk register must include a specific line for personnel, as social engineering often bypasses technically sound infrastructures.

Establishing Risk Ownership

Accountability remains the most significant hurdle for risk management teams. McGlasson advises that one person must be named as the accountable owner for the risk register, the review cadence, and the associated uncomfortable conversations. “The biggest risk isn’t a missing control, it’s that risk floats between IT, finance and operations, and belongs to no one,” McGlasson told Information Week.

Zikmund warns that the ultimate failure in building an IT risk team is inadvertently creating a technical vacuum.

“A successful team must speak the language of the business, operate hand-in-glove with the central enterprise risk management program function, and evaluate every technology risk through the lens of enterprise resilience and strategic continuity,” Zikmund told Information Week.

Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.