A slack analysis framework for IT risk processes management through risk IT framework

The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.

Information technology (IT) risk management plays an important role in controlling security and building confidence in using IT system services.Many organizations have focused on risk management for IT security.In this study the committee of sponsoring organizations of the treadway commission (COSO) enterprise risk management (ERM) was used in risk management by identifying risk factors in accordance with the requirements of COBIT 5 areas that need to be controlled.In addition, 2 experiments were conducted with 3 government organizations and 3 business organizations in order to evaluate the performance of IT security control.The first experiment identified the risk levels with risk assessment, which provided the risk levels that need risk response in accordance with COBIT 5 framework implementation life cycle.From the second experiment, it was found that the risk management using all 7 phases of the COBIT 5 implementation life cycle decreased the risk levels for both government and business organizations.However, moderate and low risk levels were still observed which need to be managed in order to keep them at a very low level.In addition, it was found that the risks of government and Business organizations were different, which was a result of differences in obstacles and the context of the problems encountered in risk management.The findings of this study provide the guidelines for developing a framework for IT risk management in the future.

PurposeRisk management is an under-explored topic in information systems (IS) research that involves complex and interrelated activities. Consequently, the authors explore the importance of interrelated activities by examining how the maturity of one type of information technology risk management (ITRM) practice is influenced by the maturity of other types of ITRM practices. The purpose of this paper is to explore these relationships, the authors develop a model based on organizational strategy implementation theory and the COBIT framework. The model identifies four types of ITRM practices, namely, IT governance (ITG); communications; operations; and monitoring.Design/methodology/approachThe authors use a survey methodology to collect data on senior information technology (IT) executives' perceptions on ITRM practices. The authors use an exploratory factor analysis (EFA) to identify four dimensions of ITR M practices and conduct a structural equation model to observe the associations.FindingsThe survey of senior IT executives' perceptions suggests that the maturity of ITRM practices related to ITG, communications and monitoring positively influence the maturity of operations-related ITRM practices. Further, the maturity of communications-related ITRM practices mediates the relationship between ITG and operations-related ITRM practices. The aggregate results demonstrate the inter-relatedness of ITRM practices and highlight the importance of taking a holistic view of ITRM.Research limitations/implicationsGiven the content and complexity of the study, it is difficult to obtain senior executives’ responses in large firms. Therefore, this study did not use a separate sample to conduct the EFA to obtain the underlying four constructs. Also, the ITRM practices identified are perceptions. Even though the authors consider this to be a limitation, it also communicates the pressing areas that senior IT professionals are expected to focus given various external and internal pressures. This study focuses on large firms, hence, small to midsize firms are not well represented.Practical implicationsGiven the demanding regulatory and financial reporting requirements and the complexity of IT, there is an increasing possibility that the accounting profession will require IT professionals to focus on operations-related ITRM practices, such as security, availability and confidentially of data and IS are closely related to internal controls. However, as this study demonstrates, the maturity of operations-related ITRM practices cannot be achieved by focusing solely on operations-related IT risks. Therefore, IT practitioners can use this study to raise awareness of the complex interrelationships among ITRM practices among managers to improve the overall ITRM practices in a firm.Social implicationsThe study also shows the importance of establishing proper communication channels among various business functions with regard to ITRM. Extant IT research identifies the importance of the firm’s communication structure on various firm performance measures. For example, Krotov (2015) mentions the importance of communication in improving trust between the Chief Executive Officer and Chief Financial Officer. Firms with established communication channels have the necessary medium to educate and involve other departments with regard to the security of data. Thus, such firms are more likely to have mature risk management practices because of increased awareness of risks and preventive techniques.Originality/valueThe study contributes to ITG and risk management literature by identifying the role of monitoring-related ITRM practices on improving other areas of risk management. The study also extends the existing ITRM literature by providing an organizational strategy perspective to ITRM practices and showing how ITRM practices follow organizational strategy implementation. Further, the authors identify four underlying ITRM categories. Consequently, researchers could choose between two factors (Vincent et al., 2017) or four factors based on the level of detail required for the particular study.

Information and Communication Technology (ICT) Governance is strongly associated with the successful of an organization's management especially about how to control physical assets, data and information were applied. In organizations, universities (Higher Education) Data and information is extremely important given the orientation of utilization is in the form of shared knowledge, through teaching and learning, research and community service (Tri Dharma). With a potential source of threats posed by humans (Human Threats), natural disasters (Natural Threats), and disruption of the environment (Environmental Threats) can interfere with the management of ICT colleges. NIST Framework Model is implemented by integrating the concept of Information Technology (IT) Risk Management through assessment risk mitigation strategies and recommendations to measure the probability of the threat and the level of impact on the institution. Then, through indepth interviews with ICT department/unit using IT General Control Questionnaire (ITGCQ) and also review operational documents to found risk analysis issues. Risk analysis results are summarized in the form of safeguard implementation plan to reduce the level of IT risk governance PTS. XYZ. More and more ICT management activities that do not have control, the higher the level of risk management of ICT.

The use of Information Technology (IT) is an important part of all business activities, especially in the service sector. It is important to ensure the security, availability and integrity of their systems. The impact of failure in IT Risk Management greatly influences success. The implementation of IT Risk Management is needed to be able to help companies in the event of losses. In its use, a framework is needed that functions to identify, evaluate and manage existing risks. Therefore, this research will show the COBIT framework that is suitable for managing existing risk management. This research was carried out using the Systematic Literature Review method which started from the stages of formulating research questions, literature search, literature selection, data extraction and discussion aimed at answering Research Questions. In this research, 25 articles were found which were used as literature sources. The research results show that COBIT 2019 is the version of COBIT most often used in IT Risk Management in the industrial service sectors. In implementing COBIT, companies face various challenges such as lack of in-depth understanding of COBIT, lack of work process documentation and lack of operational standards for risk control and incompatibility of IT strategy with company strategy. This research also found that there are 8 points of COBIT implementation strategy to help service industry companies achieve organizational goals more effectively and efficiently through IT risk management.

Effective information asset management is the basis of information security as well as many other issues. IT risk assessments work well with the proper handling of asset values, and also it is for effectively securing information assets. There is also a wide variety of risk assessment methodologies. This chapter presents information about the overall IT risk management process and methodologies. Best practices are mentioned and occasionally compared based on the requirements of the information technology (IT) sector in practice. This chapter will provide deep knowledge about the IT risk management approach and construction to implementers, risk owners, IT auditors, executive managers, and other IT staff.

The increasing reliance on information technology (IT) across various sectors has led to the growing importance of managing IT risks effectively. Information technology systems are prone to a variety of risks, including cybersecurity threats, system failures, and human errors. These risks can have severe consequences, such as financial loss, data breaches, and operational disruptions. To address these challenges, organizations must adopt comprehensive risk management strategies. This literature-based study explores various approaches and frameworks for managing IT risks, such as ISO 27001, NIST, and OCTAVE, by reviewing existing research and methodologies. The study aims to identify best practices, challenges, and trends in the field of IT risk management, offering insights into how organizations can improve their risk management strategies to enhance the resilience of their IT systems. Through this literature review, the paper highlights the importance of a systematic approach to IT risk management and provides recommendations for organizations seeking to mitigate risks and safeguard their technological.

The healthcare sector has faced increasing pressures to reduce costs and increase healthcare quality in recent years. Thus, managing knowledge in healthcare organizations is critical to achieving low-cost optimization of higher quality services. Also, information technology (IT) plays an essential and crucial role in providing a central database for managing patient data in the healthcare sector. The current study investigates the effects of three aspects of knowledge capabilities (i.e., individual knowledge capabilities, managerial knowledge capabilities, and collaborative organizational capabilities) on information technology governance in healthcare institutions in the Sultanate of Oman. Data were collected using a non-simple random sampling technique by distributing a questionnaire completed by (325) employees working in (13) public hospitals and medical centers in (8) governorates. The collected data were analyzed using AMOS software and structural equation modeling (SEM). This study indicates that individual knowledge capabilities significantly affect only one dimension of IT governance: IT risk management. Moreover, collaborative knowledge capabilities significantly influence all dimensions of IT governance pillars in healthcare institutions, while managerial knowledge capabilities have no significant effect. The study findings can be used to deeply understand the role of knowledge capabilities in sustaining the IT governance application in the health sector context.

PurposeThis paper aims to examine the connection between information system (IS) availability and operational risk losses and the capital requirements. As most businesses today become increasingly dependent on information technology (IT) services for continuous operations, IS availability is becoming more important for most industries. However, the banking sector has particular sector-specific concerns that go beyond the direct and indirect losses resulting from unavailability. According to the first pillar of the Basel II accord, IT outages in the banking sector lead to increased capital requirements and thus create an additional regulatory cost, over and above the direct and indirect costs of an outage.Design/methodology/approachA Bayesian belief network (BBN) with nodes representing causal factors has been used for identification of the factors with the greatest influence on IS availability, thus helping in investment decisions.FindingsUsing the BBN model for making IS availability-related decisions action (e.g. bringing a causal factor up to the best practice level), organization, according to the presented mapping table, would have less operational risk events related to IS availability. This would have direct impact by decreasing losses, related to those events, as well as to decrease the capital requirements, prescribed by the Basel II accord, for covering operational risk losses.Practical implicationsAn institution using the proposed framework can use the mapping table to see which measures for improving IS availability will have a direct impact on operational risk events, thus improving operational risk management.Originality/valueThe authors mapped the factors causing unavailability of IS system to the rudimentary IT risk management framework implied by the Basel II regulations and, thus, established an otherwise absent link from the IT availability management to operational risk management according to the Basel II framework.

Motivated by the wide dispersion in the returns on the use of information technology (IT) across industries, we conduct an industry-level examination of IT return and risk, focusing on the moderating role of industry competition, regulation, and technological change. We address the following research questions: What is the impact of IT investment on the return and risk dimensions of industry financial performance? How do industry characteristics moderate the relationship between IT investment and industry performance? Our analysis of these questions finds that higher levels of industry competition are associated with higher IT productivity (contribution of IT to value-added output), lower IT profitability (contribution of IT to industry average return on assets [ROA]), and higher IT risk (contribution of IT to ex ante variability of ROA). This is consistent with the notion that competition induces riskier IT investments, despite the fact that returns tend to be competed away. Higher levels of industry regulation are associated with lower IT returns in both productivity and profitability, but also lower IT risk. Finally, a higher rate of technological change induces both higher IT returns and higher IT risk. A variety of tests indicate that our results are robust. Our results shed light on factors that drive variation in IT performance across industries, and provide useful industry-level performance benchmarks of the return and risk impacts of IT investments.

Enterprises have reached to understanding that information technology (IT) is more than just a technical issue. Domains such as IT governance, risk management and compliance (GRC) have been established to steer it. Though there has been some improvements, these domains are usually considered separately, thus less business value is created due to complexity of the process flows. There has been little attempts to integrate all three aspects, however this was done using domain specific standard and not taking into account the existing state of the art. In this paper, we conduct a systematic literature review to understand the processes, roles, strategies, and technologies of IT GRC as well as their integration. Based on the results of the review, we propose an assessment framework, which could guide evaluation of the enterprise’s IT GRC concerns.

Digitization is fundamentally changing how organizations create and deliver business value, with information technology (IT) leveraged to improve business processes and controls. Its pervasive effects upon organizations’ risk exposures and performance requires boards’ prudent and integrated consideration of the resultant IT opportunities and risk management. However, IT governance research suggests that boards’ governance of IT is more commonly delegated and relegated to management and committees than integrated as part of their corporate governance practices. In response, our study contributes timely and structured understanding of boards’ roles and the mechanisms required for IT governance to become an integrated component of corporate governance.

This paper analyses and presents a case study on information technology governance (ITG) practices in a government-linked company (GLC) by looking at the ITG process, accountability and the desirable behaviours of information technology (IT) at the project level of the organization. The study reveals a number of important findings in the context of ITG implementation at the project level. As far as ITG documentation was is concerned, there are numerous standards currently available of which many are continuously undergoing further development by IT professionals. Nonetheless, there is still no one correct way of governing IT in an organization, more specifically, in IT project management. In addition, there is not much known concerning the ITG outcome of ITG practices in Malaysian organizations. Thus, this paper shares the level of readiness and awareness of ITG practices, for this particular case, when it comes to implementing IT projects. Key words: Information technology governance (ITG), information technology governance (ITG) practices, accountability, information technology (IT) outcome.

In E-society IT risk management has become both prudent practice and, in many cases, a legal necessity to protect the organization and its ability to perform their mission, not just its IT assets with respect to the cost. In this paper we will provide information on the selection of cost-effective security controls used to mitigate risk for the better protection of mission-critical information and the IT systems that process, store, and carry this information. The issue is raised to know how much security is enough? We will analyze the term risk as well as the importance of executing proper risk management planning by means of a risk management plan in terms of Risk Management overview, Risk Assessment, Risk Mitigation and Evaluation and Assessment and the factors that will lead to a successful risk management program. We observed that present risk might be problematic for future. We emphasized enhanced ethical and professional roles. Our paper explores the impact on E-society with practical approach of preventing tomorrow’s probable problem by managing today’s risk efficiently. Keywords—Risk, Cost,Security,Time, Information Technology(IT)

IT Governance is a branch of the corporate governance system focused on information technology (IT) as well as performance and risk management. IT Governance is defined as the processes that ensure the effective and efficient use of IT in enabling an organization to achieve its goal. There are many different frameworks that can be used for managing the delivery of cost-effective IT services. IT managing the delivery of cost-effective IT services does not always give the advantage to the company. There are times when the IT managing the delivery of cost-effective IT services does not provide any benefit, it can cause IT Productivity Paradox. IT Productivity Paradox can be prevented, one is to analyze the processes undertaken with IT. From this analysis we will get the significance of the relationship processes with the IT Goal. The significance will be seen which one significant process and which one are not significant to the IT Goal. If the IT process there are not significant to the IT Goal, the process does not need to be repaired because it has no effect on IT Goal. Existing IT governance frameworks are COBIT, ITIL, ISO 20000, 17799/27001, Six Sigma, etc. The IT Infrastructure Library (ITIL), initially developed in the UK by the Office of Government Commerce (OGC), is gaining traction in the global IT community as a framework for IT governance. ISO 20000-focusing upon IT service management. ISO 17799 / ISO 27001 - focusing upon information. Six Sigma-focusing upon operational performance and defect identification. COBIT - framework for information IT management risks. Control Objectives for Information and related Technology (COBIT) provides good practices across a domain and process framework and presents activities in a manageable and logical structure. COBIT’s good practices represent the consensus of experts. They are strongly focused more on control, less on execution. These practices will help optimise IT-enabled investments, ensure service delivery and provide a measure against which to judge when things do go wrong. This research is intend to find out whether Cobit mapping Business Goal to IT Goal appropriate with case study. The result The results using SEM approach shows that the mapping of COBIT is not significant in the case studies of academic administration.