PO9  Assess Risks
Control over the IT process of ...
assess risks
    with the business goal
    to support management decisions in achieving IT objectives and responding to threats by reducing complexity, increasing objectivity and identifying important decision factors
     
      is enabled by
      • the organisation engaging itself in IT risk-identification and impact analysis, involving multi-disciplinary functions and taking cost-effective measures to mitigate risks

        and takes consideration

        • Critical Success Factors that leverage
        • specific IT Resources and is measured by
        • Key Performance Indicators

Record of Assessment
Assignment ID: * Enter Name:*
Reference Code: * Enter Location:* Tel. Num: *
Enter Full e-mail Address: *
  Control Objective:

Define and manage service levels. 

CRITICAL SUCCESS FACTORS
Selected Status
Description
*
There are clearly defined roles and responsibilities for risk management ownership and management accountability
*
A policy is established to define risk limits and risk tolerance
*
The risk assessment is performed by matching vulnerabilities, threats and the value of data
*
Structured risk information is maintained, fed by incident reporting
*
Responsibilities and procedures for defining, agreeing on and funding risk management improvements exist
*
Focus of the assessment is primarily on real threats and less on theoretical ones
*
Brainstorming sessions and root cause analyses leading to risk identification and mitigation are routinely performed
*
A reality check of the strategy is conducted by a third party to increase objectivity and is repeated at appropriate times
*
*
*
*
*
*
KEY GOAL INDICATORS
*
Increased degree of awareness of the need for risk assessments
*
Decreased number of incidents caused by risks identified after the fact
*
Increased number of identified risks that have been sufficiently mitigated
*
Increased number of IT processes that have formal documented risk assessments completed
*
Appropriate percent or number of cost effective risk assessment measures
*
*
*
*
*
*
*
*
KEY PERFORMANCE INDICATORS
*
Number of risk management meetings and workshops
*
Number of risk management improvement projects
*
Number of improvements to the risk assessment process
*
Level of funding allocated to risk management projects
*
Number and frequency of updates to published risk limits and policies
*
Number and frequency of risk monitoring reports
*
Number of personnel trained in risk management methodology
*
*
*
*
*
*
  Conclusions:
* Non-existent 
Risk assessment for processes and business decisions does not occur. The organisation does not consider the business impacts associated with security vulnerabilities and with development project uncertainties. Risk management has not been identified as relevant to acquiring IT solutions and delivering IT services.
* Optimised 
Risk assessment has developed to the stage where a structured, organisation-wide process is enforced, followed regularly and well managed. Risk brainstorming and root cause analysis, involving expert individuals, are applied across the entire organisation. The capturing, analysis and reporting of risk management data are highly automated. Guidance is drawn from leaders in the field and the IT organisation takes part in peer groups to exchange experiences. Risk management is truly integrated into all business and IT operations, is well accepted and extensively involves the users of IT services.
* Managed and Measurable 
The assessment of risk is a standard procedure and exceptions to following the procedure would be noticed by IT management. It is likely that IT risk management is a defined management function with senior level responsibility. The process is advanced and risk is assessed at the individual project level and also regularly with regard to the overall IT operation. Management is advised on changes in the IT environment which could significantly affect the risk scenarios, such as an increased threat from the network or technical trends that affect the soundness of the IT strategy. Management is able to monitor the risk position and make informed decisions regarding the exposure it is willing to accept. Senior management and IT management have determined the levels of risk that the organisation will tolerate and have standard measures for risk/return ratios. Management budgets for operational risk management projects to reassess risks on a regular basis. A risk management database is established.
* Defined Process 
An organisation-wide risk management policy defines when and how to conduct risk assessments. Risk assessment follows a defined process that is documented and available to all staff through training. Decisions to follow the process and to receive training are left to the individual's discretion. The methodology is convincing and sound, and ensures that key risks to the business are likely to be identified. Decisions to follow the process are left to individual IT managers and there is no procedure to ensure that all projects are covered or that the ongoing operation is examined for risk on a regular basis.
* Repeatable but Intuitive 
There is an emerging understanding that IT risks are important and need to be considered. Some approach to risk assessment exists, but the process is still immature and developing. The assessment is usually at a high-level and is typically applied only to major projects. The assessment of on-going operations depends mainly on IT managers raising it as an agenda item, which often only happens when problems occur. IT management has not generally defined procedures or job descriptions dealing with risk management.  
* Initial / Adhoc 
The organisation is aware of its legal and contractual responsibilities and liabilities, but considers IT risks in an ad hoc manner, without following defined processes or policies. Informal assessments of project risk take place as determined by each project. Risk assessments are not likely to be identified specifically within a project plan or to be assigned to specific managers involved in the project. IT management does not specify responsibility for risk management in job descriptions or other informal means. Specific IT-related risks such as security, availability and integrity are occasionally considered on a project-by-project basis. IT-related risks affecting day-to-day operations are infrequently discussed at management meetings. Where risks have been considered, mitigation is inconsistent.
Settings will expire on: 

(Do NOT edit.) Field set by Form.
Save and E-mail this form. (Saves only "*" fields & sends E-mail to address above):


Maintenance Functions

Note: If using Netscape on a Macintosh you may have to submit twice, the first will fail, or you can push the "Save Changes and/or Set New Expiration" then Submit.