Towards a corporate IT risk management model

  • Authors:
  • Mario Spremic;Matija Popovic

  • Affiliations:
  • Faculty of Economics and Business Zagreb, University of Zagreb, Zagreb, Croatia;Ernst & Young, Technology & Security Risk Services, Zagreb, Croatia

  • Venue:
  • ISP'07 Proceedings of the 6th WSEAS international conference on Information security and privacy
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

New business era inaugurate the information infrastructure as a business backbone and a platform for conducting transactions and economic activities, what makes information technology (IT) a key prerequisite and the very basis for any competitive business model. Although IT is taking significant role in businesses with its innovating and supporting potential, it seems that it is least understood company asset. Successful organizations manage IT function in much the same way that they manage their other strategic functions and processes. This in particular means that they understand and manage risks associated with growing IT opportunities as well as critical dependence of many business processes on IT and vice-versa. IT risk management issues are not only any more marginal or 'technical' problems and become more and more a 'business problem'. Therefore, in this paper a Corporate IT Risk Management model is proposed and contemporary frameworks of IT Governance and IT Audit explained. Also the methodologies for their implementation (CobiT, ISO 27000 'family', ITIL) is shown and explained.