IT Risk Management Practices: Management Focus and Patterns

• In Event: Risk Management and ERP

Abstract

Information Technology (IT) risk management is an important component of enterprise risk management. As a result of increased cybersecurity incidents, regulators and external stakeholders are putting pressure on the board of directors and the management to take adequate actions to reduce risks related to IT. Therefore, this study explores whether firms emphasize on a particular IT risk type at different maturity levels and identify any underlying patterns in IT risk management practices.
I survey IT professionals on their perception of IT risk management practices in their respective firms. I determine maturity scores for benefit/value enablement, operations/service delivery, and both risk types (overall maturity score). The findings suggest that firms focus more on operations/service delivery IT risk management practices in spite of the level of maturity. Further, the results suggests that management is not taking a holistic view of IT risk management practices.
These results contribute to 1) IT risk management strategies, an under researched area, in IT governance literature, and 2) the profession by highlighting the current management practices and emphasizing that management is not taking an holistic view of IT risk management.

Author

• Surani Nishani Vincent, The University of Tennessee at Chattanooga