IT risk management: interrelationships based on strategy implementation

The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.

Information technology (IT) risk management plays an important role in controlling security and building confidence in using IT system services.Many organizations have focused on risk management for IT security.In this study the committee of sponsoring organizations of the treadway commission (COSO) enterprise risk management (ERM) was used in risk management by identifying risk factors in accordance with the requirements of COBIT 5 areas that need to be controlled.In addition, 2 experiments were conducted with 3 government organizations and 3 business organizations in order to evaluate the performance of IT security control.The first experiment identified the risk levels with risk assessment, which provided the risk levels that need risk response in accordance with COBIT 5 framework implementation life cycle.From the second experiment, it was found that the risk management using all 7 phases of the COBIT 5 implementation life cycle decreased the risk levels for both government and business organizations.However, moderate and low risk levels were still observed which need to be managed in order to keep them at a very low level.In addition, it was found that the risks of government and Business organizations were different, which was a result of differences in obstacles and the context of the problems encountered in risk management.The findings of this study provide the guidelines for developing a framework for IT risk management in the future.

The use of Information Technology (IT) is an important part of all business activities, especially in the service sector. It is important to ensure the security, availability and integrity of their systems. The impact of failure in IT Risk Management greatly influences success. The implementation of IT Risk Management is needed to be able to help companies in the event of losses. In its use, a framework is needed that functions to identify, evaluate and manage existing risks. Therefore, this research will show the COBIT framework that is suitable for managing existing risk management. This research was carried out using the Systematic Literature Review method which started from the stages of formulating research questions, literature search, literature selection, data extraction and discussion aimed at answering Research Questions. In this research, 25 articles were found which were used as literature sources. The research results show that COBIT 2019 is the version of COBIT most often used in IT Risk Management in the industrial service sectors. In implementing COBIT, companies face various challenges such as lack of in-depth understanding of COBIT, lack of work process documentation and lack of operational standards for risk control and incompatibility of IT strategy with company strategy. This research also found that there are 8 points of COBIT implementation strategy to help service industry companies achieve organizational goals more effectively and efficiently through IT risk management.

Effective information asset management is the basis of information security as well as many other issues. IT risk assessments work well with the proper handling of asset values, and also it is for effectively securing information assets. There is also a wide variety of risk assessment methodologies. This chapter presents information about the overall IT risk management process and methodologies. Best practices are mentioned and occasionally compared based on the requirements of the information technology (IT) sector in practice. This chapter will provide deep knowledge about the IT risk management approach and construction to implementers, risk owners, IT auditors, executive managers, and other IT staff.

Information and Communication Technology (ICT) Governance is strongly associated with the successful of an organization's management especially about how to control physical assets, data and information were applied. In organizations, universities (Higher Education) Data and information is extremely important given the orientation of utilization is in the form of shared knowledge, through teaching and learning, research and community service (Tri Dharma). With a potential source of threats posed by humans (Human Threats), natural disasters (Natural Threats), and disruption of the environment (Environmental Threats) can interfere with the management of ICT colleges. NIST Framework Model is implemented by integrating the concept of Information Technology (IT) Risk Management through assessment risk mitigation strategies and recommendations to measure the probability of the threat and the level of impact on the institution. Then, through indepth interviews with ICT department/unit using IT General Control Questionnaire (ITGCQ) and also review operational documents to found risk analysis issues. Risk analysis results are summarized in the form of safeguard implementation plan to reduce the level of IT risk governance PTS. XYZ. More and more ICT management activities that do not have control, the higher the level of risk management of ICT.

It has been recognised that effective risk management is one of the requirements for the success of information technology (IT) projects. This paper proposes a slack analysis framework taken from data envelopment analysis for improving IT-related scenarios through the IT risk management processes mentioned in the most-recent framework for managing IT risks. The proposed framework enables managers to decide on which sub-indicators of an inefficient or weakly efficient scenario should be augmented to improve its CI and how much they should be increased. The proposed improvement framework is a two-stage process in which the suggested scenarios are first evaluated by a linear optimisation model, and then the improvement stage is performed on those scenarios that can increase their CI. The proposed model is applied on Iran Telecommunication Research Center (ITRC) to assess and improve several suggested scenarios that have positively impacts on the maturity level on IT governance.

The increasing reliance on information technology (IT) across various sectors has led to the growing importance of managing IT risks effectively. Information technology systems are prone to a variety of risks, including cybersecurity threats, system failures, and human errors. These risks can have severe consequences, such as financial loss, data breaches, and operational disruptions. To address these challenges, organizations must adopt comprehensive risk management strategies. This literature-based study explores various approaches and frameworks for managing IT risks, such as ISO 27001, NIST, and OCTAVE, by reviewing existing research and methodologies. The study aims to identify best practices, challenges, and trends in the field of IT risk management, offering insights into how organizations can improve their risk management strategies to enhance the resilience of their IT systems. Through this literature review, the paper highlights the importance of a systematic approach to IT risk management and provides recommendations for organizations seeking to mitigate risks and safeguard their technological.

The healthcare sector has faced increasing pressures to reduce costs and increase healthcare quality in recent years. Thus, managing knowledge in healthcare organizations is critical to achieving low-cost optimization of higher quality services. Also, information technology (IT) plays an essential and crucial role in providing a central database for managing patient data in the healthcare sector. The current study investigates the effects of three aspects of knowledge capabilities (i.e., individual knowledge capabilities, managerial knowledge capabilities, and collaborative organizational capabilities) on information technology governance in healthcare institutions in the Sultanate of Oman. Data were collected using a non-simple random sampling technique by distributing a questionnaire completed by (325) employees working in (13) public hospitals and medical centers in (8) governorates. The collected data were analyzed using AMOS software and structural equation modeling (SEM). This study indicates that individual knowledge capabilities significantly affect only one dimension of IT governance: IT risk management. Moreover, collaborative knowledge capabilities significantly influence all dimensions of IT governance pillars in healthcare institutions, while managerial knowledge capabilities have no significant effect. The study findings can be used to deeply understand the role of knowledge capabilities in sustaining the IT governance application in the health sector context.

PurposeThis paper aims to examine the connection between information system (IS) availability and operational risk losses and the capital requirements. As most businesses today become increasingly dependent on information technology (IT) services for continuous operations, IS availability is becoming more important for most industries. However, the banking sector has particular sector-specific concerns that go beyond the direct and indirect losses resulting from unavailability. According to the first pillar of the Basel II accord, IT outages in the banking sector lead to increased capital requirements and thus create an additional regulatory cost, over and above the direct and indirect costs of an outage.Design/methodology/approachA Bayesian belief network (BBN) with nodes representing causal factors has been used for identification of the factors with the greatest influence on IS availability, thus helping in investment decisions.FindingsUsing the BBN model for making IS availability-related decisions action (e.g. bringing a causal factor up to the best practice level), organization, according to the presented mapping table, would have less operational risk events related to IS availability. This would have direct impact by decreasing losses, related to those events, as well as to decrease the capital requirements, prescribed by the Basel II accord, for covering operational risk losses.Practical implicationsAn institution using the proposed framework can use the mapping table to see which measures for improving IS availability will have a direct impact on operational risk events, thus improving operational risk management.Originality/valueThe authors mapped the factors causing unavailability of IS system to the rudimentary IT risk management framework implied by the Basel II regulations and, thus, established an otherwise absent link from the IT availability management to operational risk management according to the Basel II framework.

Past research in information technology (IT) governance has shown that strong IT governance results in improved business performance. Despite widespread acceptance that IT governance is important, there are limited studies focusing on IT practitioners in IT governance initiatives. This study aims to examine the extent of commitment, awareness, perceived importance and competency in influencing IT practitioners’ participation in IT governance initiatives. Data analysis using Partial Least Squares reveals that awareness, perceived importance and competency have positive influence on participation in IT governance. However, commitment is not a significant predictor of participation in IT governance. The practitioner-centric approach taken by this study adds knowledge to the existing IT governance literature from organisational perspective. The findings from this study help IT management identify focus areas in increasing to maximise participation of IT practitioners in IT governance initiatives.

Enterprises have reached to understanding that information technology (IT) is more than just a technical issue. Domains such as IT governance, risk management and compliance (GRC) have been established to steer it. Though there has been some improvements, these domains are usually considered separately, thus less business value is created due to complexity of the process flows. There has been little attempts to integrate all three aspects, however this was done using domain specific standard and not taking into account the existing state of the art. In this paper, we conduct a systematic literature review to understand the processes, roles, strategies, and technologies of IT GRC as well as their integration. Based on the results of the review, we propose an assessment framework, which could guide evaluation of the enterprise’s IT GRC concerns.

Digitization is fundamentally changing how organizations create and deliver business value, with information technology (IT) leveraged to improve business processes and controls. Its pervasive effects upon organizations’ risk exposures and performance requires boards’ prudent and integrated consideration of the resultant IT opportunities and risk management. However, IT governance research suggests that boards’ governance of IT is more commonly delegated and relegated to management and committees than integrated as part of their corporate governance practices. In response, our study contributes timely and structured understanding of boards’ roles and the mechanisms required for IT governance to become an integrated component of corporate governance.

In E-society IT risk management has become both prudent practice and, in many cases, a legal necessity to protect the organization and its ability to perform their mission, not just its IT assets with respect to the cost. In this paper we will provide information on the selection of cost-effective security controls used to mitigate risk for the better protection of mission-critical information and the IT systems that process, store, and carry this information. The issue is raised to know how much security is enough? We will analyze the term risk as well as the importance of executing proper risk management planning by means of a risk management plan in terms of Risk Management overview, Risk Assessment, Risk Mitigation and Evaluation and Assessment and the factors that will lead to a successful risk management program. We observed that present risk might be problematic for future. We emphasized enhanced ethical and professional roles. Our paper explores the impact on E-society with practical approach of preventing tomorrow’s probable problem by managing today’s risk efficiently. Keywords—Risk, Cost,Security,Time, Information Technology(IT)

A Novel Approach for Optimizing Governance, Risk management and Compliance for Enterprise Information security using DEMATEL and FoM

IT Governance is a branch of the corporate governance system focused on information technology (IT) as well as performance and risk management. IT Governance is defined as the processes that ensure the effective and efficient use of IT in enabling an organization to achieve its goal. There are many different frameworks that can be used for managing the delivery of cost-effective IT services. IT managing the delivery of cost-effective IT services does not always give the advantage to the company. There are times when the IT managing the delivery of cost-effective IT services does not provide any benefit, it can cause IT Productivity Paradox. IT Productivity Paradox can be prevented, one is to analyze the processes undertaken with IT. From this analysis we will get the significance of the relationship processes with the IT Goal. The significance will be seen which one significant process and which one are not significant to the IT Goal. If the IT process there are not significant to the IT Goal, the process does not need to be repaired because it has no effect on IT Goal. Existing IT governance frameworks are COBIT, ITIL, ISO 20000, 17799/27001, Six Sigma, etc. The IT Infrastructure Library (ITIL), initially developed in the UK by the Office of Government Commerce (OGC), is gaining traction in the global IT community as a framework for IT governance. ISO 20000-focusing upon IT service management. ISO 17799 / ISO 27001 - focusing upon information. Six Sigma-focusing upon operational performance and defect identification. COBIT - framework for information IT management risks. Control Objectives for Information and related Technology (COBIT) provides good practices across a domain and process framework and presents activities in a manageable and logical structure. COBIT’s good practices represent the consensus of experts. They are strongly focused more on control, less on execution. These practices will help optimise IT-enabled investments, ensure service delivery and provide a measure against which to judge when things do go wrong. This research is intend to find out whether Cobit mapping Business Goal to IT Goal appropriate with case study. The result The results using SEM approach shows that the mapping of COBIT is not significant in the case studies of academic administration.