“IRM Is Not a Project, It’s an Operating Discipline.“
About the Author
Lee Childs
Lee Childs is the Center of Excellence lead for Risk & Compliance at Wrangu and is a certified ServiceNow IRM specialist.
He leverages over 25 years of experience in the IT industry, with extensive knowledge ranging from architectural roles to Pre Sales management, to guide clients on their Governance, Risk, and Compliance (GRC) journey. His role involves helping organisations understand and solve their business challenges using ServiceNow solutions.
The Root Issue:
After years leading and supporting Integrated Risk Management (IRM) programmes across industries, one truth remains consistent: Most IRM implementation programmes fail to deliver the transformation they promise. Not because of poor technology or lack of ambition but because organisations underestimate what IRM truly demands.
The problem isn’t the tool. It’s the approach.
Every platform has its strengths, and each enterprise has unique regulatory, cultural, and operational needs. Yet too many still chase the elusive “silver bullet”: the idea that a single system will solve every risk or compliance challenge. The reality is far less glamorous. Technology is only one piece of a complex ecosystem built on people, process, and purpose.
IRM Is Not a Project, It’s an Operating Discipline
Integrated Risk Management is often treated as a one-time initiative, a box to tick or a tool to deploy. In truth, it is a sustained capability requiring continuous evolution.
Just like cybersecurity, IRM is an ongoing campaign against a constantly shifting threat landscape. Risks evolve daily; operations pivot hourly. The people and processes managing those risks must adapt just as dynamically.
So, why do implementations struggle to achieve meaningful outcomes? The failure typically lies in fundamental areas of discipline and design.
9 Mistakes to Avoid:
1. No Clear North Star
Keep the reason for your implementation front and centre.
IRM programmes lose direction when the original intent gets buried beneath functionality discussions and feature excitement.
Every workshop, design choice, and governance decision should connect back to a clearly defined North Star: the business goal the IRM implementation is meant to achieve.
If an activity does not directly accelerate progress toward that goal, defer it. Focus drives progress, and progress is what ultimately delivers measurable return on investment.
2. Recreating Legacy Processes
Adopt and adapt, don’t replicate the past.
Legacy thinking is the single biggest barrier to IRM success. Organisations often feel compelled to re-create their old tool configurations, reports, and workflows within a new platform.
This defeats the purpose of transformation. Implementing IRM should be an opportunity to question why processes exist, not simply how to reproduce them.
Challenge legacy habits. The real value comes from redesigning risk management processes for today’s needs, not rebuilding the past in a new system.
3. Scaling Too Quickly
Start small, prove impact, then expand.
IRM maturity is not achieved overnight, it is a multi-year transformation. Equally, organisations cannot wait years to demonstrate value.
The most successful initiatives begin with focused, high-yield pilots. Start with a small number of critical business processes, the organisation’s “crown jewels”, and deliver measurable outcomes within the first three to six months.
Early success builds credibility, secures ongoing funding, and creates the momentum needed to scale the programme sustainably.
4. Shaky Foundations
Lay foundations capable of supporting strategic growth.
IRM transformations unfold in phases, and each phase must align to a well-defined target operating model. Early design decisions, particularly around data structures, taxonomies, and governance, determine how effectively the programme can scale later.
Both a skyscraper and a bungalow require solid foundations, but they are engineered very differently. Before you begin building your IRM programme, be clear about which one you intend to construct.
5. Overly Complex Scope
Only capture what’s essential for oversight and control.
One of the most common pitfalls in IRM implementations is over-scoping. Trying to model every asset, control, or process quickly creates unnecessary complexity and slows adoption.
Instead, right-size your scope to what is required for meaningful governance, assurance, and insight.
Granularity should enable better decision-making, not burden teams with excessive administration.
6. Reinventing The Wheel
Industry standards accelerate maturity.
Reinventing frameworks from first principles wastes valuable time. Industry models such as ISO, COSO, NIST, and others are proven, mapped to multiple regulations, and widely accepted by auditors and regulators alike.
Adopting them as a baseline enables consistency, comparability, and faster maturity without sacrificing customisation where it truly matters.
7. Failure to Treat Risk Management as Data-Driven
Data enables consistency, automation, and informed decisions.
Effective Integrated Risk Management is data-driven, not document-driven. Organisations should use existing enterprise data to power workflows, identify trends, and inform policies.
Automation should be applied wherever logic and validation can replace manual review. This frees human capacity for higher-value activities such as analysis, foresight, and strategic decision-making.
8. Underestimating Cultural Change
Tools don’t change culture, leaders do.
Technology alone will not transform a risk culture.
Successful IRM programmes require visible senior sponsorship, sustained investment in change management, and clear communication across the organisation. Training, incentives, and messaging must reinforce that IRM is part of how the business operates, not just another reporting requirement.
Without engagement at every level, even the most advanced platforms fail through lack of adoption.
9. Unrealistic Expectations About Speed
IRM implementations take time because changing behaviour takes time. Specialist capabilities, expert configuration, and stakeholder alignment all require deliberate effort.
If speed is essential, accept that disruption will follow. Sometimes the fastest path is a clean start, leaving historical data and legacy processes behind in favour of a modern, scalable model.
The Bottom Line:
IRM is not about technology; it’s about resilience.
Success depends on aligning people, data, process, and purpose, supported by technology that amplifies, not defines, capability. Organisations that treat IRM as an evolving business discipline, rather than a software project, will ultimately build stronger, more adaptive enterprises ready for the risk landscape ahead.
