Perceptions of Information Technology Risk: A Delphi Study
James L. “Jamey” Worrell, Ashley A. Bush · Journal of the Association for Information Systems · 2007
Reliance on IT has complicated risk management efforts by introducing IT risk, defined as the risk that an organization’s information systems will not adequately support achieving business objectives, sufficiently safeguard information resources, or deliver accurate and complete information to users. There are multiple stakeholders involved in the effort to manage IT risk, however it is not clear how these different stakeholder groups perceive this risk. We conducted a Delphi study consisting of three expert panels from “Big 4” public accounting firms and Fortune 1000 companies to investigate perceptual differences among three key stakeholder groups: IT audit and security experts, business users of IT, and IT professionals. Our results suggest that these stakeholder groups not only lack consensus on important IT-related risk factors within their groups but also across groups. This research highlights the importance of accounting for multiple perspectives in risk management activities.