Industry-Level Analysis of Information Technology Return and Risk: What Explains the Variation?

The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.

This paper investigates the impact on productivity of combined changes in information technology (IT) investments and workforce composition of life insurance companies. Workforce composition is defined in terms of three broad classes: clerical, managerial and professional. Hypotheses on the combined impact of changes in IT investments and workforce composition on productivity are proposed and empirically tested on a sample of companies from the US life insurance industry. Companies are clustered based on two main strategy alternatives, focus on a market niche vs diversification. In niche companies, higher IT investments accompanied by a decrease in the clerical and managerial components of the workforce are found to have a positive contribution to productivity. On the contrary, higher IT investments in conjunction with a decrease of the professional component show a negative effect. In diversified companies, increasing IT investments show a positive contribution to productivity when accompanied by a decrease of the professional component and a growth in the clerical and managerial component of the workforce. Findings are discussed in the light of fundamental competitive goals in the industry.

The impact of information technology (IT) investments on firm performance has been the subject of active research in recent years. However, findings of almost all studies are based on data collected in the United States. Little work has been done elsewhere to validate these results and to see if they are applicable across national boundaries. In this study, we fill this gap by comparing four newly-industrialized economies (NIEs) with regard to the impact of IT capital on business performance. Secondary data collected from various sources are used to assess the impact over the period from 1983 to 1991. Findings based on four business measures and a market valuation model based on Tobin's q are reported. While the current results are consistent with work done in the United States in general, discrepancies among the four NIEs are observed. Combined with findings from previous work, three pieces of evidence seem to emerge that are generally observed across country boundaries. First, IT investment is not correlated with shareholder's return. Second, there is little evidence that the level of computerization is valued by the market in developed and newly-developed countries. Third, there is no consistent measurement of IT investment as indicated by the mixed results across different performance ratios. Modeling and measurement concerns expressed in previous U.S.-based studies are also observed in our comparative study. Our findings provide a starting point to accumulate a body of comparative studies for the development of a theory that links IT investment, firm performance, and macro factors such as national technology policy in an integrated framework.

The use of Information Technology (IT) is an important part of all business activities, especially in the service sector. It is important to ensure the security, availability and integrity of their systems. The impact of failure in IT Risk Management greatly influences success. The implementation of IT Risk Management is needed to be able to help companies in the event of losses. In its use, a framework is needed that functions to identify, evaluate and manage existing risks. Therefore, this research will show the COBIT framework that is suitable for managing existing risk management. This research was carried out using the Systematic Literature Review method which started from the stages of formulating research questions, literature search, literature selection, data extraction and discussion aimed at answering Research Questions. In this research, 25 articles were found which were used as literature sources. The research results show that COBIT 2019 is the version of COBIT most often used in IT Risk Management in the industrial service sectors. In implementing COBIT, companies face various challenges such as lack of in-depth understanding of COBIT, lack of work process documentation and lack of operational standards for risk control and incompatibility of IT strategy with company strategy. This research also found that there are 8 points of COBIT implementation strategy to help service industry companies achieve organizational goals more effectively and efficiently through IT risk management.

5 - Information technology risk

Information and Communication Technology (ICT) Governance is strongly associated with the successful of an organization's management especially about how to control physical assets, data and information were applied. In organizations, universities (Higher Education) Data and information is extremely important given the orientation of utilization is in the form of shared knowledge, through teaching and learning, research and community service (Tri Dharma). With a potential source of threats posed by humans (Human Threats), natural disasters (Natural Threats), and disruption of the environment (Environmental Threats) can interfere with the management of ICT colleges. NIST Framework Model is implemented by integrating the concept of Information Technology (IT) Risk Management through assessment risk mitigation strategies and recommendations to measure the probability of the threat and the level of impact on the institution. Then, through indepth interviews with ICT department/unit using IT General Control Questionnaire (ITGCQ) and also review operational documents to found risk analysis issues. Risk analysis results are summarized in the form of safeguard implementation plan to reduce the level of IT risk governance PTS. XYZ. More and more ICT management activities that do not have control, the higher the level of risk management of ICT.

Organizations are investing ever-increasing amounts in information technology (IT). However, the existing literature provides little evidence of a relationship between IT investment and organizational strategic and economic performance. The exploratory research reported here appears to be the first to relate comprehensive sets of IT investment measures to organizational strategic and economic performance measures. Although the individual IT investment variables were found to be only weakly related to organizational strategic and economic performance, they were significantly related to performance when grouped and analyzed by means of canonical correlation. More specifically, canonical results suggest that organizational strategic and economic performance measures such as sales by employee, return on sales, sales by total assets, return on investment, and market to book value are affected by IT investment measures such as IT budget as percentage of revenue, the percentage of IT budget spent on training of employees, number of PCs per employee, and IT value as a percentage of revenue. The organizational performance measure growth in revenue and IT investment measure percentage of IT budget spent on staff were not significantly related to other measures and therefore were not indicated to be useful for investigating possible effects of IT investment on organizational strategic and economic performance. Finally, a model based on these results is suggested. The model depicts a framework for management evaluation of the relationship between IT investment and organizational performance.

Despite its universal appeal, little has been done in the way of empirical research to probe into the role of formal information technology (IT) investment evaluation practices and its influence on IT governance and performance in African firms. A preliminary survey of 74 firms from South Africa, Nigeria and Zimbabwe, reveal that while firms are generally aware of formal IT investment appraisal techniques and IT value realisation prescriptions, relatively less formality is actually applied to appraising, managing and realising IT benefits. This research unveils many issues in exploiting IT benefits, with a majority of firms acknowledging substantial targeted benefits losses. Addressing how IT investments can be managed more effectively using formal investment appraisal and benefits management practices, to predictably realise intended payoffs remains a top concern for African firms and the continent’s IT researchers. Key words: Information technology (IT), IT governance, IT investment appraisal, IT benefits management, IT performance.

Estudos sobre a terceirização da Tecnologia da Informação (TI) nas pequenas empresas são pertinentes em virtude da posição de destaque que essas organizações ocupam no mercado. Deste modo, esta pesquisa visa identificar os riscos da terceirização da TI nas pequenas empresas e analisar as iniciativas/ações adotadas para reduzir tais riscos. Como método de pesquisa, utilizou-se o estudo de casos múltiplos em pequenas empresas que utilizam Sistema de Informação (SI) terceirizado. Para tratamento dos dados, utilizou-se a análise de conteúdo. Os resultados indicam que o modelo identificado para as pequenas empresas, em que imperam as estratégias de curto prazo e as ações reativas, acaba por torná-las vulneráveis aos riscos da terceirização da TI. Limitações e oportunidades de pesquisa constam nas considerações finais.

This study documents variation across industries in creditors’ perceptions of the risk of information technology (IT) investments. The associations we document between IT investments and both initial bond ratings and yield spreads suggest that credit-rating agencies and bond investors consider IT investments in automate and informate industries less risky than those in transform industries. We document that IT investments are associated with more volatile future cash flows in transform industries than in automate or informate industries. The findings indicate that bond investors prefer IT investments in automate industries, where the cash flow payoffs to IT investment are smaller but more stable than in transform industries. Overall, these findings provide the important insight that bondholders’ perceptions of IT investments vary across industries based on bondholders’ aversion to the riskiness and the lack of collateralizability of IT investments. Senior managers should recognize that IT investments have implications for both operational performance and financing costs (e.g., costs of debt) of the firm, and they should consider the potential financial benefits of increased IT capabilities, such as the willingness of corporate bond investors to accept lower financing costs.

The impact of IT investment on firm performance in China: An empirical investigation of the Chinese electronics industry

Information technology (IT) risk management plays an important role in controlling security and building confidence in using IT system services.Many organizations have focused on risk management for IT security.In this study the committee of sponsoring organizations of the treadway commission (COSO) enterprise risk management (ERM) was used in risk management by identifying risk factors in accordance with the requirements of COBIT 5 areas that need to be controlled.In addition, 2 experiments were conducted with 3 government organizations and 3 business organizations in order to evaluate the performance of IT security control.The first experiment identified the risk levels with risk assessment, which provided the risk levels that need risk response in accordance with COBIT 5 framework implementation life cycle.From the second experiment, it was found that the risk management using all 7 phases of the COBIT 5 implementation life cycle decreased the risk levels for both government and business organizations.However, moderate and low risk levels were still observed which need to be managed in order to keep them at a very low level.In addition, it was found that the risks of government and Business organizations were different, which was a result of differences in obstacles and the context of the problems encountered in risk management.The findings of this study provide the guidelines for developing a framework for IT risk management in the future.

Effective information asset management is the basis of information security as well as many other issues. IT risk assessments work well with the proper handling of asset values, and also it is for effectively securing information assets. There is also a wide variety of risk assessment methodologies. This chapter presents information about the overall IT risk management process and methodologies. Best practices are mentioned and occasionally compared based on the requirements of the information technology (IT) sector in practice. This chapter will provide deep knowledge about the IT risk management approach and construction to implementers, risk owners, IT auditors, executive managers, and other IT staff.

The increasing reliance on information technology (IT) across various sectors has led to the growing importance of managing IT risks effectively. Information technology systems are prone to a variety of risks, including cybersecurity threats, system failures, and human errors. These risks can have severe consequences, such as financial loss, data breaches, and operational disruptions. To address these challenges, organizations must adopt comprehensive risk management strategies. This literature-based study explores various approaches and frameworks for managing IT risks, such as ISO 27001, NIST, and OCTAVE, by reviewing existing research and methodologies. The study aims to identify best practices, challenges, and trends in the field of IT risk management, offering insights into how organizations can improve their risk management strategies to enhance the resilience of their IT systems. Through this literature review, the paper highlights the importance of a systematic approach to IT risk management and provides recommendations for organizations seeking to mitigate risks and safeguard their technological.

We reexamine the •Information Technology (IT) productivity paradox• from the standpoints of theoretical basis, measurement issues and potential inefficiency in IT management. Two key objectives are: (i) to develop an integrated microeconomic framework for IT productivity and efficiency assessment using developments in production economics, and (ii) to apply the framework to a dataset used in prior research with mixed results to obtain new evidence regarding IT contribution. Using a stochastic frontier with a production economics framework involving the behavioral assumptions of profit maximization and cost minimization, we obtain a unified basis to assess both productivity and efficiency impacts of IT investments. The integrated framework is applied to a manufacturing database spanning 1978–1984. While previous productivity research with this dataset found mixed results regarding the contribution from IT capital, we show the negative marginal contribution of IT found in an important prior study is attributable primarily to the choices of the IT deflator and modeling technique. Further, by ignoring the potential inefficiency in IT investment and management, studies that have reported positive results may have significantly underestimated the true contribution of IT. This positive impact of IT is consistent across multiple model specifications, estimation techniques and capitalization methods. The stochastic production frontier analysis shows that while there were significant technical, allocative and scale inefficiencies, the inefficiencies reduced with an increase in the IT intensity. Given that the organizational units in our sample increased their IT intensity during the time period covered by the study, management was taking a step in the right direction by increasing the IT share of capital inputs. Our results add to a small body of MIS literature which reports significant positive returns from IT investments.