IT Risk Management: An Organizational Strategy Implementation Perspective

• In Event: Risk Management and ERP

Abstract

The purpose of this study is to explore how maturity of one type of Information Technology (IT) risk management practices is influenced by the maturity of other types of IT risk management practices. A model of the interrelationships among the four IT risk management practices (vision, communications, monitoring and operations) is developed from an organizational strategy implementation perspective. The findings based on a survey of IT experts suggest that the maturity of IT risk management practices related to vision, communications, and monitoring positively influence the maturity of operations related IT risk management practices. Further, the maturity of communications related IT risk management practices act as a complete mediator between vision and operations related IT risk management practices. The maturity of monitoring related IT risk management practices positively influenced the maturity of vision and communications related IT risk management practices. This study contributes to the IT governance literature by developing an IT risk management practices model that comprises four IT risk management categories. Further, the findings encourage the profession to take a holistic view of IT risk management practices.

Authors

• Surani Nishani Vincent, The University of Tennessee at Chattanooga

• Robert E Pinsker, Florida Atlantic University - Boca