Important Functions Of Information Technology

Risk assessment is used to determine the extent of handling threats and the risks associated with an IT system throughout its life cycle.

In my past job, the company mandates risk assessment before doing for any business transactions, so that we are in compliant with relevant regulations and do not do any risky deals that end up with litigation or incur losses to our business. The guidelines also apply for non-business transactions and any internal decisions. The strategy is to take a risk that is known and manageable or spread, so that we add value to the company's profit and shareholders. The task was to scale the current information system, so that we can comply with regulatory requirement which always has time commitment.

Risk management is the process where individual and overall risks are understood and managed, thus optimizing success by minimizing the threats and to maximize opportunities [APM Body of Knowledge, p. 179]. All projects are inherently risky, because it performed by people and subject to the external influences or environment. Risk is something that it cannot be predicted. That is why into the company’s organization, risk management has an essential and vital part in any project whether that is in the planning procedure or to project implementation. Risks are always exists and can be translated as an opportunity to gain benefits. In addition a risk may incur serious monetary losses. The first step of risk management begins when identifies risk. These are identified through several techniques that risk management can select and use. One of the most effective techniques is brainstorming where members are attending meetings in order to gain ideas of either to identify a risk or how to overcome the arising risk. However a document review technique is also applied which is also very helpful, in this technique, documents are reviewed from prior projects which leads to a better understanding of the risks that may do occur. If a company seeks risk management capabilities, is to gaining competitive advantage, riskier businesses seek potential and higher profits.

Risk management is a process for identifying, assessing and prioritizing risks of different kinds. Once the risks are identified, the risk manager will create a plan to minimize or eliminate the impact of negative events. A variety of strategies is available, depending on the type of risk and the type of business. There are a number of risk management standards including those developed by the Project Management Institute the International Organization for Standardization the National Institute of Science and Technology and actuarial societies. Organizations uses different strategies in proper management of future events such as risk assumption, risk avoidance,

Risk management includes the “overall decision-making process of identifying threats and vulnerabilities and their potential impacts, determining the costs to mitigate such events, and deciding what actions are cost effective to take to control these risks” (Conklin et al, 2012, pg. 678). For the proper development of risk management techniques, every person at every level of the organization, especially those involved in the Information Security (IS) department “must be actively involved in the following activities:

However, companies generally adopt a methodology for overall risk assessment. Sometimes these methodologies involve the assignation of risk oversight to leaders in each area. The approach is based upon the assumption that each area knows itself best. However, this often overlooks potential issues in favor of confronting them after they develop. As the need for

Risk assessment is the systematic process of evaluating and estimation of the level of risk in the potential risks that may be involved in a projected activity or undertaking.

Risk refers to a likelihood, probability, a chance that a loss may occur in a given organization. Most of the times, there is a high risk when there is vulnerability. In this case, vulnerability refers to a weakness that the organization has. Risk assessment refers to the process of identification of potential hazards and proper analysis of the expected losses if those hazards occur (Homeland Security, n.d.). Risk assessment as a way of profiling risk according to impact to the organization. Some organizations have business impact analysis exercises geared towards determination of potential hazards based risk assessment approaches. Organizations’ risk differ depending on the size and the type of business they are doing. The disparity in organizations’ risk call for different adaptation of risk assessment approaches. Even with the disparities of the businesses, proper risk management not only ranks the risks according to the seriousness but also identifies the best methods to control risks in an organization.

Risk analysis is an integral part of data safety within an organization and the analysis is vital to the mission and success of an organization. Risk analysis is used “to identify threats and then provide recommendations to address these threats” (Taylor et al, 2006). Risk analysis encompasses not only the equipment and programs used in an organization but also covers the culture, managerial, and administrative processes to assure data security. A key factor in risk analysis is to have a good Information Resource Management Plan.

A risk assessment is a way to identify, evaluate, quantify, and prioritize risks (Gibson, 2011).

IT risk is any threat to organization’s information technology, data, critical systems and business processes. When the businesses depend on information technology for main operations and activities, they need to be aware of the extent and nature of those threats hence they can be external, internal, intentional or accidental. IT risk includes business-critical areas, such as:

Risk assessment is about identifying the risks and putting things in place to reduce or remove the risks.

Collier (2009) claims that the fundamental role of the Board of the directors in a company is to apply risk management and to review the performance of the organisations’ internal control procedures; these two principal processes will support the Board in the setting of the strategic targets, the transformation of the targets into real products and services, the effective business overseeing, and the realistic reporting to the external stakeholders. Apart from the Board, the author suggests that an effective risk management framework must be facilitated by a risk management group, a chief risk officer, external and internal audits, and a mature organisational culture disseminated to the line managers and employees. Under the same concept, Hampton (2009) presented a flow gram that suggests the path towards the establishment of enterprise risk management, starting from the risk recognition and ending to the standardization of a risk evaluation process, having prior involved the Board, the risk owners and the accountable staff.

Risk Assessment - The risk assessment is the process of evaluating threats to a business, customers and stakeholders. Threats may range from a high probability to a minimal impact to a business. Such as faulty power grid to a high impact such as a cyber-attack to natural disasters. This step is vital in examining how effective a business continuity plan will succeed if subject to a threat scenario. This analysis will provide feedback or refinement to the

One well accepted description of risk management is the following: risk management is a systematic approach to setting the best course of action under uncertainty by identifying, assessing, understanding, acting on and communicating risk issues. In order to apply risk management effectively, it is vital that a risk management culture be developed. The risk management culture supports the overall vision, mission and objectives of an organization. Limits and boundaries are established and communicated concerning what are acceptable risk practices and outcomes. Since risk management is directed at uncertainty related to future events and outcomes, it is