[Foundation-l] Risks

[Gerard Meijssen]

Hoi,
Risk management is an activity that has a forerunner. This is risk 
analysis. From everything I understand from what is happening, the 
situation in the management and operations of the WMF is fluid. Many 
aspects of risk aversion are hard or impossible to do because they are 
like shooting at a moving target. When you engage in risk management, it 
is like many other aspects of security; something you have to integrate 
it into your organisational operations to do it well. Risk assessment 
and analysis should be part of the implementation of and the changes to 
procedures.

The question: "Who is willing to take responsibility?" is imho not 
necessarily valid at this time. Risk management is an essential part of 
the whole management and operations set up and consequently the 
responsibility  remains with every manager for the security issues in 
his domain. When you have a security officer in your organisation, in 
essence all he can do is coordinate and integrate the efforts in all 
domains and coordinate and monitor how well relevant issues are handled. 
As security is often seen as key to the health of the organisation, the 
security officer is necessarily a senior manager in an organisation. It 
is important to note that many of the tasks that need to be done in the 
WMF are not filled in. This is a consequence of the seriously 
underfunded and understaffed organisation that is the WMF. The question 
is, is it more important to get the base work done or is having someone 
tasked for security the priority. This is a management question and 
decision.

When an organisation takes security serious, the risk factors are taken 
serious. This already happens. Brion has stated repeatedly that the 
quality of the back-ups has a high priority for him. He has reported 
repeatedly on improvements made in order to improve its quality. David 
Gerard has raised the quality of back-ups as an issue, Jeff Merkey 
indicated his ability and effort in order to ensure that an off-site 
back-up exists. All this happens against this background of continually 
improving WMF functionality. Clearly risks in this domain are managed 
though not necessarily covered perfectly.

When it comes to financial risks, the WMF will only get grants, funding 
from other parties when it is able and willing to go into a dialogue 
with organisations and people that indicate they are willing to 
contribute / cooperate / collaborate with our organisation. This means 
that our organisation has to be willing to go into a dialogue. It starts 
with a willingness to listen. There are indications that this is improving.

Given the relevance of the Wikimedia Foundation, there are many 
organisations that are really keen to work together with us. Many of 
these organisations have a wealth of data and money that they are 
investing in activities that are complementary to what we do. By 
collaborating, there is the potential that much of these resources will 
be directed to Free information and resources. It may mean that things 
do not happen in our projects. Our aim is to bring information to the 
world, we serve our aim when we make this happen. For Free information 
the one thing that really matters is that these resources are relevant 
and easy to reach. Organisations want to collaborate with the WMF 
because increased traffic for the information they care for is often 
what they want to get out of such a collaboration. The opportunities are 
there, one risk is that we are not able or willing to reach out, another 
is that our community is too inward focused and consequently not willing 
or able to collaborate.

To me security and risk management are really important. The work done 
that is in front of us needs to get done. Anthere indicated that issues 
identified by the board have to be solved within specified time frames 
by the executive. This is only feasible when the means to do this exist. 
When the penalty for not finishing in time has the potential of 
dismissal, it means that the risks become personal as well as 
organisational. The consequence will be that day to day issues will 
suffer and this will bring its own risks.

Thanks,
    GerardM