Risk IT, published in 2009 by ISACA,ISACA THE RISK IT FRAMEWORK
(registration required) provides an end-to-end, comprehensive view of all

risk In simple terms, risk is the possibility of something bad happening. Risk involves uncertainty about the effects/implications of an activity with respect to something that humans value (such as health, well-being, wealth, property or the environm ...

s related to the use of

information technology Information technology (IT) is the use of computers to create, process, store, retrieve, and exchange all kinds of data . and information. IT forms part of information and communications technology (ICT). An information technology syste ...

(IT) and a similarly thorough treatment of risk management, from the tone and culture at the top to operational issues. It is the result of a work group composed of industry experts and academics from different nations, from organizations such as

Ernst & Young Ernst & Young Global Limited, trade name EY, is a multinational professional services partnership headquartered in London, England. EY is one of the largest professional services networks in the world. Along with Deloitte, KPMG and Pricewat ...

, IBM,

PricewaterhouseCoopers PricewaterhouseCoopers is an international professional services brand of firms, operating as partnerships under the PwC brand. It is the second-largest professional services network in the world and is considered one of the Big Four accounti ...

, Risk Management Insight,

Swiss Life The Swiss Life Group is the largest life insurance company of Switzerland and one of Europe’s leading comprehensive life and pensions and financial services providers, with approximately CHF 276.3 bn of assets under management. Founded in 185 ...

, and

KPMG KPMG International Limited (or simply KPMG) is a multinational professional services network, and one of the Big Four accounting organizations. Headquartered in Amstelveen, Netherlands, although incorporated in London, England, KPMG is a net ...

Definition

IT risk Information technology risk, IT risk, IT-related risk, or cyber risk is any risk related to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Re ...

is a part of business risk — specifically, the business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise. It consists of IT-related events that could potentially impact the business. It can occur with both uncertain frequency and magnitude, and it creates challenges in meeting strategic goals and objectives. Management of business risk is an essential component of the responsible administration of any organization. Owing to IT's importance to the overall business, IT risk should be treated like other key business risks. The Risk IT framework explains IT risk and enables users to: * Integrate the management of IT risk with the overall ERM * Compare assessed IT risk with risk appetite and risk tolerance of the organization * Understand how to manage the risk IT risk is to be managed by all the key business leaders inside the organization: it is not just a technical issue of IT department. IT risk can be categorised in different ways: ;IT Benefit/Value enabler :risks related to missed opportunity to increase business value by IT enabled or improved processes ;IT Programme/Project delivery :risks related to the management of IT related projects intended to enable or improve business: i.e. the risk of over budget or late delivery (or not delivery at all) of these projects ;IT Operation and Service Delivery :risks associated to the day by day operations and service delivery of IT that can bring issues, inefficiency to the business operations of an organization The Risk IT framework is based on the principles of

enterprise risk management Enterprise risk management (ERM) in business includes the methods and processes used by organizations to manage risks and seize opportunities related to the achievement of their objectives. ERM provides a framework for risk management, which typic ...

standards/frameworks such as Committee of Sponsoring Organizations of the Treadway Commission ERM and

ISO 31000 ISO 31000 is a family of standards relating to risk management codified by the International Organization for Standardization. ISO 31000:2018 provides principles and generic guidelines on managing risks that could be negative faced by organizati ...

. In this way IT risk could be understood by upper management.

Risk IT principles

Risk IT is built around the following principles: * always align with business objectives * align the IT risk management with ERM * balance the costs and benefits of IT risk management * promote fair and open communication of IT risks * establish the right tone at the top while defining and enforcing accountability * are a continuous process and part of daily activities

IT risk communication components

Major IT

risk communication Risk communication is a complex cross-disciplinary academic field that is part of risk management and related to fields like crisis communication. The goal is to make sure that targeted audiences understand how risks effect to them or their commun ...

flows are: * Expectation: what the organization expects as final result and what are the expected behaviour of employee and management; It encompasses strategy, policies, procedures, awareness training * Capability: it indicates how the organization is able to manage the risk * Status: information of the actual status of IT risk; It encompasses risk profile of the organization, key risk indicator (KRI), events, root cause of loss events. An effective information should be: * Clear * Concise * Useful * Timely * Aimed at the correct target audience * Available on a

need to know The term "need to know", when used by government and other organizations (particularly those related to the military or espionage), describes the restriction of data which is considered very sensitive. Under need-to-know restrictions, even if ...

basis

Risk IT domains and processes

The three domains of the Risk IT framework are listed below with the contained

processes A process is a series or set of activities that interact to produce a result; it may occur once-only or be recurrent or periodic. Things called a process include: Business and management *Business process, activities that produce a specific se ...

(three by domain); each process contains a number of activities: #Risk Governance: Ensure that IT risk management practices are embedded in the enterprise, enabling it to secure optimal risk-adjusted return. It is based on the following processes: ## RG1 Establish and Maintain a Common Risk View ### RG1.1 Perform enterprise IT risk assessment ### RG1.2 Propose IT risk tolerance thresholds ### RG1.3 Approve IT risk tolerance ### RG1.4 Align IT risk policy ### RG1.5 Promote IT risk aware culture ### RG1.6 Encourage effective communication of IT risk ## RG2 Integrate With ERM ### RG2.1 Establish and maintain accountability for IT risk management ### RG2.2 Coordinate IT risk strategy and business risk strategy ### RG2.3 Adapt IT risk practices to enterprise risk practices ### RG2.4 Provide adequate resources for IT risk management ### RG2.5 Provide independent assurance over IT risk management ## RG3 Make Risk-aware Business Decisions ### RG3.1 Gain management buy in for the IT risk analysis approach ### RG3.2 Approve IT risk analysis ### RG3.3 Embed IT risk consideration in strategic business decision making ### RG3.4 Accept IT risk ### RG3.5 Prioritise IT risk response activities #Risk Evaluation: Ensure that IT-related risks and opportunities are identified, analysed and presented in business terms. It is based on the following processes: ## RE1 Collect Data ### RE1.1 Establish and maintain a model for data collection ### RE1.2 Collect data on the operating environment ### RE1.3 Collect data on risk events ### RE1.4 Identify risk factors ## RE2 Analyse Risk ### RE2.1 Define IT risk analysis scope ### RE2.2 Estimate IT risk ### RE2.3 Identify risk response options ### RE2.4 Perform a peer review of IT risk analysis ## RE3 Maintain Risk Profile ### RE3.1 Map IT resources to business processes ### RE3.2 Determines business criticality of IT resources ### RE3.3 Understand IT capabilities ### RE3.4 Update risk scenario components ### RE3.5 Maintain the IT risk register and iT risk map ### RE3.6 Develop IT risk indicators # Risk Response: Ensure that IT-related risk issues, opportunities and events are addressed in a cost-effective manner and in line with business priorities. It is based on the following processes: ## RR1 Articulate Risk ### RR1.1 Communicate IT risk analysis results ### RR1.2 Report IT risk management activities and state of compliance ### RR1.3 Interpret independent IT assessment findings ### RR1.4 Identify IT related opportunities ## RR2 Manage Risk ### RR2.1 Inventory controls ### RR2.2 Monitor operational alignment with risk tolerance thresholds ### RR2.3 Respond to discovered risk exposure and opportunity ### RR2.4 Implement controls ### RR2.5 Report IT risk action plan progress ## RR3 React to Events ### RR3.1 Maintain incident response plans ### RR3.2 Monitor IT risk ### RR3.3 Initiate incident response ### RR3.4 Communicate lessons learned from risk events Each process is detailed by: * Process components * Management practice * Inputs and Outputs * RACI charts *

Goal A goal is an idea of the future or desired result that a person or a group of people envision, plan and commit to achieve. People endeavour to reach goals within a finite time by setting deadlines. A goal is roughly similar to a purpose or ...

and metrics For each domain a Maturity Model is depicted.

Risk evaluation

The link between IT risk scenarios and ultimate business impact needs to be established to understand the effect of adverse events. Risk IT does not prescribe a single method. Different methods are available. Among them there are: * COBIT Information criteria *

Balanced scorecard A balanced scorecard is a strategy performance management tool – a well structured report, that can be used by managers to keep track of the execution of activities by the staff within their control and to monitor the consequences arising from ...

* Extended balanced scorecard * Westerman George Westerman, Richard Hunter, IT risk: turning business threats into competitive advantage, Harvard Business School Press series , * COSO * Factor Analysis of Information Risk

Risk scenarios

Risk scenarios is the hearth of risk evaluation process. Scenarios can be derived in two different and complementary ways: * a top-down approach from the overall business objectives to the most likely risk scenarios that can impact them. * a bottom-up approach where a list of generic risk scenarios are applied to the organizaztion situation Each risk scenarios is analysed determining frequency and impact, based on the risk factors.

Risk response

The purpose of defining a risk response is to bring risk in line with the overall defined risk appetite of the organization after risk analysis: i.e. the residual risk should be within the risk tolerance limits. The risk can be managed according to four main strategies (or a combination of them): * Risk avoidance, exiting the activities that give rise to the risk * Risk mitigation, adopting measures to detect, reduce the frequency and/or impact of the risk * Risk transfer, transferring to others part of the risk, by outsourcing dangerous activities or by insurance * Risk acceptance: deliberately running the risk that has been identified, documented and measured. Key risk indicators are metrics capable of showing that the organizaztion is subject or has a high probability of being subject to a risk that exceeds the defined risk appetite.

Practitioner Guide

The second important document about Risk IT is the Practitioner Guide.The Risk IT Practitioner Guide, ISACA
(registration required) It is made up of eight sections: # Defining a Risk Universe and Scoping Risk Management # Risk Appetite and Risk Tolerance # Risk Awareness, Communication and Reporting # Expressing and Describing Risk # Risk Scenarios # Risk Response and Prioritisation # A Risk Analysis Workflow # Mitigation of IT Risk Using COBIT and Val IT

Relationship with other ISACA frameworks

Risk IT Framework complements ISACA’s COBIT, which provides a comprehensive framework for the control and governance of business-driven information-technology-based (IT-based) solutions and services. While COBIT sets good practices for the means of risk management by providing a set of controls to mitigate IT risk, Risk IT sets good practices for the ends by providing a framework for enterprises to identify, govern and manage IT risk. Val IT allows business managers to get business value from IT investments, by providing a governance framework. VAL IT can be used to evaluate the actions determined by the Risk management process.

Relationship with other frameworks

Risk IT accept Factor Analysis of Information Risk terminology and evaluation process.

ISO 27005

For a comparison of Risk IT processes and those foreseen by ISO/IEC 27005 standard, see IT risk management#Risk management methodology and IT risk management#ISO 27005 framework

ISO 31000

The Risk IT Practitioner Guide appendix 2 contains the comparison with

COSO

The Risk IT Practitioner Guide appendix 4 contains the comparison with COSO

References

{{Reflist

External links

Risk IT main page on ISACA web site
Risk analysis methodologies Information technology governance IT risk management