Actions

Difference between revisions of "Risk IT Framework"
m
 
(8 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
Risk IT is a set of proven, real-world practices that helps enterprises achieve their goals, seize opportunities and seek greater return with less risk. It works at the intersection of business and IT and allows enterprises to manage and even capitalize on risk in the pursuit of their objectives. It extends [[COBIT (Control Objectives for Information and Related Technology)| COBIT]], the globally recognized IT governance framework, and saves time, cost and effort by providing enterprises with a way to focus effectively on IT-related business risk areas, including risks related to late project delivery, [[Compliance|compliance]], misalignment, obsolete IT architecture and IT service delivery problems. The Risk IT Framework provides a set of guiding principles and supporting practices for enterprise management, combined to deliver a comprehensive process model for [[Information Technology Risk (IT Risk)|governing and managing IT risk]]. For users of [https://cioindex.com/reference/an-introduction-to-cobit/ COBIT] and [https://cioindex.com/reference/understanding-val-it/ Val IT], this process model will look familiar. Guidance is provided on the key activities within each process, responsibilities for the process, information flows between processes and performance management of each process. The model is divided into three domains Risk Governance, Risk Evaluation, Risk Response each containing three processes: Risk Governance Establish and maintain a common risk view Integrate with [[Enterprise Risk Management (ERM)|enterprise risk management]] Make risk-aware business decisions Risk Evaluation Collect data Analyze risk Maintain risk profile Risk Response Articulate risk Manage risk React to events.<ref>Definition - Risk IT Framework [http://dl.acm.org/citation.cfm?id=1823048 ACM Digital Library]</ref>
+
== What is the Risk IT Framework? ==
 +
Risk IT is a set of proven, real-world practices that helps enterprises achieve their goals, seize opportunities and seek greater returns with less risk. It works at the intersection of business and IT and allows enterprises to manage and even capitalize on risk in the pursuit of their objectives. It extends [[COBIT (Control Objectives for Information and Related Technology)|COBIT]], the globally recognized [[IT Governance Framework]], and saves time, cost and effort by providing enterprises with a way to focus effectively on IT-related business risk areas, including risks related to late project delivery, compliance, misalignment, obsolete IT architecture, and IT service delivery problems.  
  
 +
The '''Risk IT Framework''' provides a set of guiding principles and supporting practices for enterprise management, combined to deliver a comprehensive process model for governing and managing IT risk. For users of COBIT and Val IT Framework, this process model will look familiar. Guidance is provided on the key activities within each process, responsibilities for the process, information flows between processes, and performance management of each process. The model is divided into the following three domains, each of which contains three processes:
 +
*[[Risk Governance]]:
 +
**Establish and maintain a common risk view
 +
**Integrate with [[Enterprise Risk Management (ERM)|enterprise risk management]] and
 +
**Make risk-aware business decisions
 +
*Risk  Evaluation: 
 +
**Collect data
 +
**Analyze risk
 +
**Maintain risk profile
 +
*Risk Response:
 +
**Articulate risk 
 +
**Manage risk
 +
**React to events<ref>[http://dl.acm.org/citation.cfm?id=1823048 Defining Risk IT Framework]</ref>
  
−
The Risk IT Framework fills the gap between generic risk management frameworks and detailed (primarily security-related) IT risk management frameworks. It provides an end-to-end, comprehensive view of all risks related to the use of IT and a similarly thorough treatment of risk management, from the tone and culture at the top, to operational issues. In summary, the framework will enable enterprises to understand and manage all significant IT risk types, building upon the existing risk related components within the current ISACA frameworks, i.e., COBIT and Val IT.<ref>What is the Risk IT Framework [https://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/The-Risk-IT-Framework.aspx isaca.org]</ref>
+
The Risk IT Framework fills the gap between generic Risk Management Frameworks and detailed (primarily security-related) IT risk management frameworks. It provides an end-to-end comprehensive view of all risks related to the use of IT and a similarly thorough treatment of risk management, from the tone and culture at the top to operational issues. In summary, the framework will enable enterprises to understand and manage all significant IT risk types, building upon the existing risk-related components within the current [[Information Systems Audit and Control Association (ISACA)|ISACA]] frameworks, i.e., COBIT and [[Val IT Framework]].<ref>[https://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/The-Risk-IT-Framework.aspx What Does Risk IT Framework Mean?]</ref>
  
  
 
[[File:RiskIT.png|400px|Risk IT Framework]]<br />
 
[[File:RiskIT.png|400px|Risk IT Framework]]<br />
−
source: [https://managementmania.com/en/riskit-risk-it-framework ManagementMania]
+
source: ManagementMania
  
  
−
'''The Risk IT Principles'''<ref>Risk IT Principles [http://www.isaca.org/knowledge-center/research/documents/risk-it-framework-excerpt_fmk_eng_0109.pdf isaca.org]</ref><br />
+
== The Risk IT Principles<ref>[http://www.isaca.org/knowledge-center/research/documents/risk-it-framework-excerpt_fmk_eng_0109.pdf Risk IT Principles]</ref> ==
−
Risk IT defines, and is founded on, a number of guiding principles for effective management of IT risk. The principles are based on commonly accepted [[Enterprise_Risk_Management_(ERM)|ERM]] principles, which have been applied to the domain of IT. The Risk IT framework is about IT risk—in other words, business risk related to the use of IT. The connection to business is founded in the
+
Risk IT defines and is founded on, a number of guiding principles for the effective management of IT risk. The principles are based on commonly accepted ERM principles, which have been applied to the domain of IT. The Risk IT framework is about IT risk—in other words, business risk related to the use of IT. The connection to business is founded in the
−
principles on which the framework is built, i.e., effective enterprise governance and management of IT risk, as shown in figure below:
+
principles on which the framework is built, i.e., effective enterprise governance and management of IT risk, as shown in the figure below:
−
• Always connect to business objectives
+
*Always connect to business objectives
−
• Align the management of IT-related business risk with overall [https://cioindex.com/reference/an-introduction-to-enterprise-risk-management-erm/ ERM], if applicable, i.e., if [https://cioindex.com/reference/an-introduction-to-enterprise-risk-management-erm/ ERM] is implemented in the enterprise
+
*Align the management of IT-related business risk with overall ERM, if applicable, i.e., if ERM is implemented in the enterprise
−
• Balance the costs and benefits of managing IT risk
+
*Balance the costs and benefits of managing IT risk
−
• Promote fair and open communication of IT risk
+
*Promote fair and open communication of IT risk
−
• Establish the right tone from the top while defining and enforcing personal accountability for operating within acceptable and well-defined tolerance levels
+
*Establish the right tone from the top while defining and enforcing personal accountability for operating within acceptable and well-defined tolerance levels
−
• Are a continuous process and part of daily activities
+
*Are a continuous process and part of daily activities
 +
 
  
 
[[File:RiskIT2.jpg|400px|Risk IT Principles]]<br />
 
[[File:RiskIT2.jpg|400px|Risk IT Principles]]<br />
−
source: [https://www.slideshare.net/maxkeensopisan/the-risk-it-framework Yana R. Sopian]
+
source: Yana R. Sopian
  
  
−
'''Risk IT Domains and Processes'''<ref>Risk IT Domains and Processes [https://en.wikipedia.org/wiki/Risk_IT Wikipedia]</ref><br />
+
== Risk IT Domains and Processes<ref>[https://en.wikipedia.org/wiki/Risk_IT Risk IT Domains and Processes]</ref> ==
 
The three domains of the Risk IT framework are listed below with the contained processes (three by domain); each process contains a number of activities:
 
The three domains of the Risk IT framework are listed below with the contained processes (three by domain); each process contains a number of activities:
−
*Risk Governance: Ensure that IT risk management practices are embedded in the enterprise, enabling it to secure optimal risk-adjusted return. It is based on the following processes:
+
*Risk Governance: Ensure that IT risk management practices are embedded in the enterprise, enabling it to secure optimal risk-adjusted returns. It is based on the following processes:
 
**RG1 Establish and Maintain a Common Risk View
 
**RG1 Establish and Maintain a Common Risk View
 
**RG1.1 Perform enterprise IT risk assessment
 
**RG1.1 Perform enterprise IT risk assessment
Line 31: Line 46:
 
**RG1.3 Approve IT risk tolerance
 
**RG1.3 Approve IT risk tolerance
 
**RG1.4 Align IT risk policy
 
**RG1.4 Align IT risk policy
−
**RG1.5 Promote IT risk aware culture
+
**RG1.5 Promote IT risk-aware culture
 
**RG1.6 Encourage effective communication of IT risk
 
**RG1.6 Encourage effective communication of IT risk
 
**RG2 Integrate With ERM
 
**RG2 Integrate With ERM
Line 40: Line 55:
 
**RG2.5 Provide independent assurance over IT risk management
 
**RG2.5 Provide independent assurance over IT risk management
 
**RG3 Make Risk-aware Business Decisions
 
**RG3 Make Risk-aware Business Decisions
−
**RG3.1 Gain management buy in for the IT risk analysis approach
+
**RG3.1 Gain management buy-in for the IT risk analysis approach
 
**RG3.2 Approve IT risk analysis
 
**RG3.2 Approve IT risk analysis
 
**RG3.3 Embed IT risk consideration in strategic business decision making
 
**RG3.3 Embed IT risk consideration in strategic business decision making
 
**RG3.4 Accept IT risk
 
**RG3.4 Accept IT risk
 
**RG3.5 Prioritise IT risk response activities
 
**RG3.5 Prioritise IT risk response activities
−
*Risk Evaluation: Ensure that IT-related risks and opportunities are identified, analysed and presented in business terms. It is based on the following processes:
+
*Risk Evaluation: Ensure that IT-related risks and opportunities are identified, analyzed, and presented in business terms. It is based on the following processes:
 
**RE1 Collect Data
 
**RE1 Collect Data
 
**RE1.1 Establish and maintain a model for data collection
 
**RE1.1 Establish and maintain a model for data collection
Line 59: Line 74:
 
**RE3.1 Map IT resources to business processes
 
**RE3.1 Map IT resources to business processes
 
**RE3.2 Determines business criticality of IT resources
 
**RE3.2 Determines business criticality of IT resources
−
**RE3.3 [[IT Capability|Understand IT capabilities]]
+
**RE3.3 Understand IT capabilities
 
**RE3.4 Update risk scenario components
 
**RE3.4 Update risk scenario components
 
**RE3.5 Maintain the IT risk register and iT risk map
 
**RE3.5 Maintain the IT risk register and iT risk map
 
**RE3.6 Develop IT risk indicators
 
**RE3.6 Develop IT risk indicators
−
*Risk Response: Ensure that IT-related risk issues, opportunities and events are addressed in a cost-effective manner and in line with business priorities. It is based on the following processes:
+
*Risk Response: Ensure that IT-related risk issues, opportunities, and events are addressed in a cost-effective manner and in line with business priorities. It is based on the following processes:
 
**RR1 Articulate Risk
 
**RR1 Articulate Risk
 
**RR1.1 Communicate IT risk analysis results
 
**RR1.1 Communicate IT risk analysis results
 
**RR1.2 Report IT risk management activities and state of compliance
 
**RR1.2 Report IT risk management activities and state of compliance
 
**RR1.3 Interpret independent IT assessment findings
 
**RR1.3 Interpret independent IT assessment findings
−
**RR1.4 Identify IT related opportunities
+
**RR1.4 Identify IT-related opportunities
 
**RR2 Manage Risk
 
**RR2 Manage Risk
 
**RR2.1 Inventory controls
 
**RR2.1 Inventory controls
Line 74: Line 89:
 
**RR2.3 Respond to discovered risk exposure and opportunity
 
**RR2.3 Respond to discovered risk exposure and opportunity
 
**RR2.4 Implement controls
 
**RR2.4 Implement controls
−
**RR2.5 [[Risk Communication|Report IT risk action plan progress]]
+
**RR2.5 Report IT risk action plan progress
 
**RR3 React to Events
 
**RR3 React to Events
 
**RR3.1 Maintain incident response plans
 
**RR3.1 Maintain incident response plans
 
**RR3.2 Monitor IT risk
 
**RR3.2 Monitor IT risk
 
**RR3.3 Initiate incident response
 
**RR3.3 Initiate incident response
−
**RR3.4 [[Risk Communication|Communicate lessons learned from risk events]]
+
**RR3.4 Communicate lessons learned from risk events
  
 
Each process is detailed by:
 
Each process is detailed by:
Line 85: Line 100:
 
*Management practice
 
*Management practice
 
*Inputs and Outputs
 
*Inputs and Outputs
−
*[[RACI Matrix|RACI charts]]
+
*RACI charts
 
*Goal and metrics
 
*Goal and metrics
  
  
−
'''Risk IT Process Model '''- see illustration below<br />
+
=== Risk IT Process Model (see illustration below) ===
 +
 
 
[[File:RiskIT3.png|400px|Risk IT Process Model]]<br />
 
[[File:RiskIT3.png|400px|Risk IT Process Model]]<br />
−
source: [http://slideplayer.com/slide/2352919/ Urs Fischer, CISA, CRISC]
+
source: Urs Fischer, CISA, CRISC
  
  
−
'''RiskIT - Implementation Approach'''<ref>An Implementation Approach to the Risk IT Framework [https://www.isaca.org/Knowledge-Center/cobit/Pages/Risk-IT-Case-Study-Risk-IT-Framework-for-IT-Risk-Management-A-Case-Study-of-National-Stock-Exchange-of-India-Limited.aspx Sunil Bakshi]</ref><br />
+
== Risk IT - Implementation Approach<ref>[https://www.isaca.org/Knowledge-Center/cobit/Pages/Risk-IT-Case-Study-Risk-IT-Framework-for-IT-Risk-Management-A-Case-Study-of-National-Stock-Exchange-of-India-Limited.aspx An Implementation Approach to the Risk IT Framework]</ref> ==
 
The implementation approach for the risk framework at NSE, (National Stock Exchange) the largest stock exchange in  India is described in the figure below:
 
The implementation approach for the risk framework at NSE, (National Stock Exchange) the largest stock exchange in  India is described in the figure below:
  
  
 
[[File:ITRisk1.jpg|600px|Risk IT  Implementation Approach]]<br />
 
[[File:ITRisk1.jpg|600px|Risk IT  Implementation Approach]]<br />
−
source: [https://www.isaca.org/Knowledge-Center/cobit/Pages/Risk-IT-Case-Study-Risk-IT-Framework-for-IT-Risk-Management-A-Case-Study-of-National-Stock-Exchange-of-India-Limited.aspx ISACA]<br />
+
source: ISACA
  
  
−
The implementation of risk management was conducted at two levels:<br />
+
The implementation of risk management was conducted at two levels:
−
*1. Develop risk register for business functions.
+
#Develop risk register for business functions.
−
*2. Define aggregation process to arrive at an organization-level risk profile.
+
#Define aggregation process to arrive at an organization-level risk profile.
  
  
−
Business processes were categorized in the following areas:<br />
+
Business processes were categorized in the following areas:
−
*1. Most critical (core production)
+
#Most critical (core production)
−
*2. Critical (production)
+
#Critical (production)
−
*3, Support functions
+
#Support functions
  
−
For each business function, the following activities were performed:<br />
+
For each business function, the following activities were performed:
 
*Conduct risk evaluation facilitated workshops.
 
*Conduct risk evaluation facilitated workshops.
 
*Generate risk profile for inherent risk (risk without considering controls).
 
*Generate risk profile for inherent risk (risk without considering controls).
 
*Determine response options.
 
*Determine response options.
−
*Identify and assess controls from control catalog.
+
*Identify and assess controls from the control catalog.
 
*Identify positive (excess) and negative (missing) control gaps.
 
*Identify positive (excess) and negative (missing) control gaps.
 
*Define a plan for closing control gaps.
 
*Define a plan for closing control gaps.
 
*Finalize the risk register.
 
*Finalize the risk register.
−
*Obtain confirmation from risk owner (department heads).
+
*Obtain confirmation from the risk owner (department heads).
  
−
For aggregation of the risk profile at the organization level, the following activities were performed:<br />
+
For an aggregation of the risk profile at the organization level, the following activities were performed:<br />
−
*Build a matrix for all identified risk.
+
*Build a matrix for all identified risks.
 
*Collect department-wide data, and build the matrix.
 
*Collect department-wide data, and build the matrix.
 
*Add weightage of criticality for each department.
 
*Add weightage of criticality for each department.
Line 131: Line 147:
  
  
−
'''Benefits/Outcomes of Risk IT'''<br />
+
== Benefits/Outcomes of Risk IT ==
 
The benefits of using Risk IT include:
 
The benefits of using Risk IT include:
−
*A common language to help communication between business IT, risk and audit management
+
*A common language to help communication between business IT, risk, and audit management
 
*End-to-end guidance on how to manage IT-related risks
 
*End-to-end guidance on how to manage IT-related risks
 
*A complete risk profile to better understand risk, so as to better utilize enterprise resources
 
*A complete risk profile to better understand risk, so as to better utilize enterprise resources
Line 145: Line 161:
  
  
−
'''The Cons of Risk IT'''<ref>The Cons of Risk IT [https://cmu95752.wordpress.com/2012/07/22/risk-it-a-risk-management-framework-by-information-technology-governance-institute-itgi/ cmu]</ref><br />
+
== The Cons of Risk IT<ref>[https://cmu95752.wordpress.com/2012/07/22/risk-it-a-risk-management-framework-by-information-technology-governance-institute-itgi/ The Cons of Risk IT]</ref> ==
−
*While the framework’s purpose and design are to address Risk IT, the framework has been recently developed and therefore, the assessments of touted benefits are not available for longer terms.
+
*While the framework’s purpose and design are to address Risk IT, the framework has been recently developed, and therefore, the assessments of touted benefits are not available for longer terms.
−
*The framework is left flexible and therefore, the incorrect or less robust implementation may not be able to provide the benefits, and may leave un-addressed or undetected risks within the enterprise IT organization.
+
*The framework is left flexible and therefore, the incorrect or less robust implementation may not be able to provide the benefits, and may leave unaddressed or undetected risks within the enterprise IT organization.
 
*The framework is maintained and published by ISACA, and not adopted by any standards body, such as ANSI, etc. but instead is based on best practices and therefore, the acceptability of the framework may not have wider appeal.
 
*The framework is maintained and published by ISACA, and not adopted by any standards body, such as ANSI, etc. but instead is based on best practices and therefore, the acceptability of the framework may not have wider appeal.
−
*The framework relies on appropriate implementation of both COBIT and Val IT, which may not be the case at all organizations, and therefore, may offer hindrance in its acceptability within many organizations.
+
*The framework relies on appropriate implementation of both COBIT and Val IT, which may not be the case in all organizations, and therefore, may offer hindrance in its acceptability within many organizations.
−
*The comprehensive nature of the framework can quickly become a cost overhead of IT risk management, in spite of utilization of existing IT controls.
+
*The comprehensive nature of the framework can quickly become a cost overhead of IT risk management, in spite of the utilization of existing IT controls.
  
  
−
===See Also===
+
== See Also ==
−
*[[Risk Management|Managing business risk]]<br />
+
[[IT Governance]]
−
*[[Risk-Adjusted Return|Risk adjusted return on investment]]<br />
 
−
*[[Risk-Adjusted Return on Capital (RAROC)|Risk-Adjusted Return on Capital (RAROC)]]<br />
 
−
*[[Risk Analysis|Analysis of risk]]<br />
 
−
*[[Risk Assessment|Assessing risk]]<br />
 
−
*[[Risk Assessment Framework (RAF)|Framework for risk assessment]]<br />
 
−
*[[Risk Based Testing|Risk based testing]]<br />
 
−
*[[Risk Communication|Communication of risk ]]<br />
 
−
*[[Risk Matrix]]<br />
 
−
*[[Risk Maturity]]<br />
 
−
*[[Risk Maturity Model (RMM)]]<br />
 
−
*[[Risk Mitigation]]<br />
 
−
*[[Risks Analysis]]<br />
 
−
*[[RACI Matrix]]<br />
 
−
*[[IT_Governance|IT Governance]]<br />
 
−
*[[ITIL_(Information_Technology_Infrastructure_Library)|ITIL]]<br />
 
−
*[[IT_Governance_Framework|IT Governance Framework]]<br />
 
−
*[[ICT_Investment_Framework|ICT Investment Framework]]<br />
 
−
*[[Information_Technology_Investment_Management_(ITIM)|Information Technology Investment Management (ITIM)]]<br />
 
−
*[[COBIT_(Control_Objectives_for_Information_and_Related_Technology)|Control Objectives for Information and Related Technology (COBIT)]]<br />
 
−
*[[Val_IT_Framework|Val IT]]<br />
 
−
*[[Business_Model_for_Information_Security_(BMIS)|Business Model for Information Security (BMIS)]]<br />
 
−
*[[COSO_Internal_Control_Integrated_Framework|COSO]]<br />
 
−
*[[Capability_Maturity_Model_Integration_(CMMI)|CMMI]]<br />
 
−
*[[IT_Assurance_Framework_(ITAF)|IT Assurance Framework (ITAF)]]<br />
 
  
  
−
===References===
+
== References ==
 
<references/>
 
<references/>
  
  
−
===Further Reading===
+
== Further Reading ==
−
*Risk IT Framework for Management of IT Related Business Risks  [http://www.isaca.org/knowledge-center/risk-it-it-risk-management/pages/default.aspx isaca.org]
+
* [http://www.isaca.org/knowledge-center/risk-it-it-risk-management/pages/default.aspx Risk IT Framework for Management of IT Related Business Risks]
−
*Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks [http://www.infocomsecurity.gr/ppts_2012/demopoulos_isaca.pdf Anestis Demopoulos, Vice President ISACA Athens Chapter, & Senior Manager, Advisory Services, Ernst & Young]
+
*[http://www.infocomsecurity.gr/ppts_2012/demopoulos_isaca.pdf Assessing & Managing IT Risks: Using ISACA's CobiT & Risk IT Frameworks]
 +
__NOTOC__

Latest revision as of 19:23, 10 August 2023

What is the Risk IT Framework?

Risk IT is a set of proven, real-world practices that helps enterprises achieve their goals, seize opportunities and seek greater returns with less risk. It works at the intersection of business and IT and allows enterprises to manage and even capitalize on risk in the pursuit of their objectives. It extends COBIT, the globally recognized IT Governance Framework, and saves time, cost and effort by providing enterprises with a way to focus effectively on IT-related business risk areas, including risks related to late project delivery, compliance, misalignment, obsolete IT architecture, and IT service delivery problems.

The Risk IT Framework provides a set of guiding principles and supporting practices for enterprise management, combined to deliver a comprehensive process model for governing and managing IT risk. For users of COBIT and Val IT Framework, this process model will look familiar. Guidance is provided on the key activities within each process, responsibilities for the process, information flows between processes, and performance management of each process. The model is divided into the following three domains, each of which contains three processes:

  • Risk Governance:
  • Risk Evaluation:
    • Collect data
    • Analyze risk
    • Maintain risk profile
  • Risk Response:
    • Articulate risk
    • Manage risk
    • React to events[1]

The Risk IT Framework fills the gap between generic Risk Management Frameworks and detailed (primarily security-related) IT risk management frameworks. It provides an end-to-end comprehensive view of all risks related to the use of IT and a similarly thorough treatment of risk management, from the tone and culture at the top to operational issues. In summary, the framework will enable enterprises to understand and manage all significant IT risk types, building upon the existing risk-related components within the current ISACA frameworks, i.e., COBIT and Val IT Framework.[2]


Risk IT Framework
source: ManagementMania


The Risk IT Principles[3]

Risk IT defines and is founded on, a number of guiding principles for the effective management of IT risk. The principles are based on commonly accepted ERM principles, which have been applied to the domain of IT. The Risk IT framework is about IT risk—in other words, business risk related to the use of IT. The connection to business is founded in the principles on which the framework is built, i.e., effective enterprise governance and management of IT risk, as shown in the figure below:

  • Always connect to business objectives
  • Align the management of IT-related business risk with overall ERM, if applicable, i.e., if ERM is implemented in the enterprise
  • Balance the costs and benefits of managing IT risk
  • Promote fair and open communication of IT risk
  • Establish the right tone from the top while defining and enforcing personal accountability for operating within acceptable and well-defined tolerance levels
  • Are a continuous process and part of daily activities


Risk IT Principles
source: Yana R. Sopian


Risk IT Domains and Processes[4]

The three domains of the Risk IT framework are listed below with the contained processes (three by domain); each process contains a number of activities:

  • Risk Governance: Ensure that IT risk management practices are embedded in the enterprise, enabling it to secure optimal risk-adjusted returns. It is based on the following processes:
    • RG1 Establish and Maintain a Common Risk View
    • RG1.1 Perform enterprise IT risk assessment
    • RG1.2 Propose IT risk tolerance thresholds
    • RG1.3 Approve IT risk tolerance
    • RG1.4 Align IT risk policy
    • RG1.5 Promote IT risk-aware culture
    • RG1.6 Encourage effective communication of IT risk
    • RG2 Integrate With ERM
    • RG2.1 Establish and maintain accountability for IT risk management
    • RG2.2 Coordinate IT risk strategy and business risk strategy
    • RG2.3 Adapt IT risk practices to enterprise risk practices
    • RG2.4 Provide adequate resources for IT risk management
    • RG2.5 Provide independent assurance over IT risk management
    • RG3 Make Risk-aware Business Decisions
    • RG3.1 Gain management buy-in for the IT risk analysis approach
    • RG3.2 Approve IT risk analysis
    • RG3.3 Embed IT risk consideration in strategic business decision making
    • RG3.4 Accept IT risk
    • RG3.5 Prioritise IT risk response activities
  • Risk Evaluation: Ensure that IT-related risks and opportunities are identified, analyzed, and presented in business terms. It is based on the following processes:
    • RE1 Collect Data
    • RE1.1 Establish and maintain a model for data collection
    • RE1.2 Collect data on the operating environment
    • RE1.3 Collect data on risk events
    • RE1.4 Identify risk factors
    • RE2 Analyse Risk
    • RE2.1 Define IT risk analysis scope
    • RE2.2 Estimate IT risk
    • RE2.3 Identify risk response options
    • RE2.4 Perform a peer review of IT risk analysis
    • RE3 Maintain Risk Profile
    • RE3.1 Map IT resources to business processes
    • RE3.2 Determines business criticality of IT resources
    • RE3.3 Understand IT capabilities
    • RE3.4 Update risk scenario components
    • RE3.5 Maintain the IT risk register and iT risk map
    • RE3.6 Develop IT risk indicators
  • Risk Response: Ensure that IT-related risk issues, opportunities, and events are addressed in a cost-effective manner and in line with business priorities. It is based on the following processes:
    • RR1 Articulate Risk
    • RR1.1 Communicate IT risk analysis results
    • RR1.2 Report IT risk management activities and state of compliance
    • RR1.3 Interpret independent IT assessment findings
    • RR1.4 Identify IT-related opportunities
    • RR2 Manage Risk
    • RR2.1 Inventory controls
    • RR2.2 Monitor operational alignment with risk tolerance thresholds
    • RR2.3 Respond to discovered risk exposure and opportunity
    • RR2.4 Implement controls
    • RR2.5 Report IT risk action plan progress
    • RR3 React to Events
    • RR3.1 Maintain incident response plans
    • RR3.2 Monitor IT risk
    • RR3.3 Initiate incident response
    • RR3.4 Communicate lessons learned from risk events

Each process is detailed by:

  • Process components
  • Management practice
  • Inputs and Outputs
  • RACI charts
  • Goal and metrics


Risk IT Process Model (see illustration below)

Risk IT Process Model
source: Urs Fischer, CISA, CRISC


Risk IT - Implementation Approach[5]

The implementation approach for the risk framework at NSE, (National Stock Exchange) the largest stock exchange in India is described in the figure below:


Risk IT Implementation Approach
source: ISACA


The implementation of risk management was conducted at two levels:

  1. Develop risk register for business functions.
  2. Define aggregation process to arrive at an organization-level risk profile.


Business processes were categorized in the following areas:

  1. Most critical (core production)
  2. Critical (production)
  3. Support functions

For each business function, the following activities were performed:

  • Conduct risk evaluation facilitated workshops.
  • Generate risk profile for inherent risk (risk without considering controls).
  • Determine response options.
  • Identify and assess controls from the control catalog.
  • Identify positive (excess) and negative (missing) control gaps.
  • Define a plan for closing control gaps.
  • Finalize the risk register.
  • Obtain confirmation from the risk owner (department heads).

For an aggregation of the risk profile at the organization level, the following activities were performed:

  • Build a matrix for all identified risks.
  • Collect department-wide data, and build the matrix.
  • Add weightage of criticality for each department.
  • Arrive at organization-level risk profile.
  • Review and sanitize the risk profile by eliminating mathematically inappropriate impacts and likelihood.
  • Present risk profile to board and senior management.


Benefits/Outcomes of Risk IT

The benefits of using Risk IT include:

  • A common language to help communication between business IT, risk, and audit management
  • End-to-end guidance on how to manage IT-related risks
  • A complete risk profile to better understand risk, so as to better utilize enterprise resources
  • A better understanding of the roles and responsibilities with regard to IT risk management
  • Alignment with ERM
  • A better view of IT-related risk and its financial implications
  • Fewer operational surprises and failures
  • Increased information quality
  • Greater stakeholder confidence and reduced regulatory concerns
  • Innovative applications supporting new business initiatives


The Cons of Risk IT[6]

  • While the framework’s purpose and design are to address Risk IT, the framework has been recently developed, and therefore, the assessments of touted benefits are not available for longer terms.
  • The framework is left flexible and therefore, the incorrect or less robust implementation may not be able to provide the benefits, and may leave unaddressed or undetected risks within the enterprise IT organization.
  • The framework is maintained and published by ISACA, and not adopted by any standards body, such as ANSI, etc. but instead is based on best practices and therefore, the acceptability of the framework may not have wider appeal.
  • The framework relies on appropriate implementation of both COBIT and Val IT, which may not be the case in all organizations, and therefore, may offer hindrance in its acceptability within many organizations.
  • The comprehensive nature of the framework can quickly become a cost overhead of IT risk management, in spite of the utilization of existing IT controls.


See Also

IT Governance


References

  1. ↑ Defining Risk IT Framework
  2. ↑ What Does Risk IT Framework Mean?
  3. ↑ Risk IT Principles
  4. ↑ Risk IT Domains and Processes
  5. ↑ An Implementation Approach to the Risk IT Framework
  6. ↑ The Cons of Risk IT


Further Reading

Retrieved from "https://cio-wiki.org//index.php?title=Risk_IT_Framework&oldid=17085"