Assessing the effects of IT changes on IT risk - A business process-oriented view.
Stefan Sackmann · 2008
Abstract: The economic relevance of IT risk is increasing due to various opera-tional, technical as well as regulatory reasons. Increasing flexibility of business processes and rising dependability on IT require continuous risk assessment, challenging current methods of risk management. Extending these methods by a business process-oriented view is a promising approach for taking the occurring dynamics and interlinks into consideration. In this contribution, a layer based approach for systematic modeling of relations between causes (threats) and effects (direct and indirect loss) is pursued. On the basis of these cause-effect relations, the presented IT Risk Indicator InTRIn measures changes in the IT support of business processes. It is discussed how InTRIn can provide accurate and real-time information on the IT risk situation and thus improve IT risk management. 1 Flexible Business Processes and IT Risk The flexibility to adapt business processes to customers ’ changing demands is regarded as an important instrument for companies in order to be able to distinguish themselves from their competitors (e.g. [Sa95; BG05; Mi07]). To create flexibility, information