Risk Assessment of It Governance A Syste

Journal of Theoretical and Applied Information Technology
20th January 2015. Vol.71 No.2

© 2005 - 2015 JATIT & LLS. All rights reserved.
ISSN: 1992-8645 www.jatit.org E-ISSN: 1817-3195
RISK ASSESSMENT OF IT GOVERNANCE:

A SYSTEMATIC LITERATURE REVIEW
1
NORAINI CHE PA, 2BOKOLO ANTHONY JNR, 3ROZI NOR HAIZAN NOR AND 4MASRAH
AZRIFAH AZMI MURAD
1,2,3,4
Faculty of Computer Science and Information Technology, University Putra Malaysia, 43400 UPM,
Serdang, Selangor, Malaysia.
E-mail: 1norainip@upm.edu.my , 2result4real@yahoo.com , 3rozinor@upm.upm.edu.my ,
4
masrah@upm.edu.my
ABSTRACT
Risk assessment (RA) is one of the main activities in risk management of IT governance. Basically, IT
governance is a process or a procedure that involves evaluating and directing the plans for the use of ICT to
support the organization and monitoring the achievement of these plans. The risks that may emerge during
the implementation of IT governance must be properly assessed to ensure its success. In general, risk
assessment in IT governance is focusing on the essential process to aid all relevant parties involved in IT
implementation from both the technical and services aspects. Many studies related to IT risk assessment
and risk assessments of IT governance have been reviewed based on a systematic method which is called
Systematic Literature Review (SLR). Based on this approach, all previous studies related to this title can be
analyzed systematically. Based on the same framework, this paper presents the results of the systematic
reviews on the concept, process, framework, model and challenges of risk assessment of IT governance. In
general, the findings from this review indicate that RA requires a more holistic consideration on numerous
limitations and issues.
Keywords: Risk Assessment, IT Governance, Systematic Literature Review.
1. INTRODUCTION IT enables organizations to move
accordingly with development trends and acquire
Risk is considered as something that might a competitive advantage over their competitors.
go wrong in an establishing process. Risk is also This motivates them to improve IT service
a combination of the likelihood of an event and performance within their organization. This can
its effects. According to [1] there are three be achieved by setting up ICT mission and vision
categories of risks: projects risks, product risks that is in accordance with their organization’s
and business risks. Organizations must learn to mission and vision. This very much depends on
stabilize the possible negative effects of risk smoothness of coordination, effective monitoring
against the possible gains of its related and continuous action that will only be
opportunity. accessible through steady governance aspects for
Risk Assessment (RA) is one of the main IT services [4]. In practice, IT Governance
activities in risk management stages [2]. RA supports business operations, adding plus value
involves five phases; identification, analysis, through IT component and IT risks minimisation.
evaluation, control and mitigation, and IT governance is a very important issue at
documentation. In general, IT risk assessment is present as an integral component of any
referred to as the essential process to aid corporation or organisation. The purpose of IT
enterprise in implementing new business changes governance is to direct IT endeavours to ensure
and where appropriate, invest in information that IT performance meets the objectives set out
systems to accommodate these changes. in its strategy [5]. With effective governance, the
However, the adoption of IT applications has return of IT investment can be optimized to
also exposed organizations to IT related risks support business strategies and goal.
such as strategic risk, financial risk, operational According to [6], IT Governance is
risk and technological risk [3]. In order to faced with different challenges and issues such
minimize and control these risks successfully, IT as part of much broader notion of Governance.
risk assessment policies and strategies have been Lining up in this order the two concepts, IT
developed and implemented in organizations. governance should follow the principles of
184

corporate governance e.g. effective, transparent study is concluded and implications of the
and accountable without which IT Governance review are identified in the last section.
cannot be properly implemented in an
organisation. IT Governance reflects broader 2. METHOD OF STUDY
corporate governance principles while focusing
on the management and use of IT to achieve The Systematic Literature Review
corporate performance goals. Because IT (SLR) is “a means of evaluating and interpreting
outcomes are often difficult to measure, firms all available research relevant to a particular
must assign responsibility for desired outcomes research question or topic area or phenomenon of
and assess how well they achieve them. IT interest” [8]. It has been considered as the
Governance shouldn’t be considered in isolation leading method in collecting and analysing
because IT is linked with other key enterprise existing research work. SLR also provides
assets. methodological advantages and applicability to
Thus, IT Governance might share our research questions. It involves three main
mechanisms (such as executive committees and phases namely planning, conducting and
budget processes) with other asset governance reporting [9]. These main phases are illustrated
processes thereby coordinating enterprise wide in Figure 1.
decision making processes [7]. [6] expands on
this definition by adding that IT governance is Planning Conducting Reporting
the delivery of IT, while balancing risks. Risks the the Review the review
can be minimized with the correct organizational review
decision-making structures and the assignment of
roles and responsibilities. For example, strategic Figure 1: SLR Research Phases
risks are lack of investment, different
understanding of the business process, lack of The study started with identifying the
support by the management and unresolved needs for a literature review, formulating the
conflicts between business and IT management. review research questions and review protocol.
Effective risk management makes it easier to The review was performed by defining the initial
cope with problems and to ensure that these do protocol. The actual gathering process was
no lead to unacceptable situation through performed and the results were evaluated using
identifying, controlling, and minimizing the subsequent gathering steps. Then data was
impact of threats. RA needs to be integrated into extracted from the selected studies. Finally, the
the business process in a way that provides data was synthesized and analysed.
timely and relevant risk information to the A systematic literature review evaluates
management. Many researchers state that RA is and interprets all available research relevant to a
one of the main activities in risk management of particular question or topic area. It was not easy
IT governance. to locate articles about this subject as there is
However, the need for this work is to very little existing literature and descriptive
carry out a comprehensive review and synthesis framework. Consequently, the best method to
of the current studies, practices, issues and achieve the research purpose is by assigning a
challenges of Risk Assessment based on the prior common framework or uniform description to
work done by many researchers. Though, all conduct this review. We summarized this
previous studies agree on the importance of Risk evidence in order to investigate risk assessment
Assessment but there is no consensus on the in IT governance. We conduct the SLR by
framework, model and processes involved in following the guidelines by [8]. We looked at the
their implementation. For this reason this paper literature to answer these research questions:
aims to review previous studies on Risk - Question 1: What is the relationship
Assessment from 2005 until 2014 including their between risk assessment and IT
framework, models, processes, and challenges. governance?
The structure of this paper is organized as - Question 2: What are the existing
follows: section 2 presents the method applied in frameworks, models and challenges for
this study which is Systematic Literature Review risk assessment in IT governance?
(SLR). Section 3 describes the findings of the
study regarding the current approaches and A review protocol is essential to any
issues related to challenges of RA. Finally, the systematic literature review. Driven by the
research questions, the protocol defines
185

inclusion/exclusion criteria to select primary Table 2: Electronic databases included in this SLR
studies as shown in Table Electronic databases
IEEE Xplore
ACM Digital library
ScienceDirect
Table 1: Inclusion and Exclusion Criteria SpringerLink
Inclusion criteria Exclusion criteria Wiley InterScience
Google Scholar
IT risk, risk assessment, not described in detail
risk management, IT or a structured template
Governance. is lacking The availability of many data sources that
conference or journal or new and similar study
technical reports or books exists
can be accessed through electronic libraries give
(2005-2014) a reasonable confidence of covering all relevant
publications. These sources include journals and
abstract and content are review or evaluation of
written in English. existing practices for
conference proceedings (refer to Table 3 and
risk assessment. Table 4).
Reported SLRs or meta-
analyses in risk assessment Table 3:List of Journals
and IT Governance.
Journals
2.1 Search Process IEEE Transactions on Software Engineering (TSE)

Empirical Software Engineering (ESE)
We design a SLR protocol to guide the
search process [8]. Relevant papers were IEEE Software (IEEE SW)
International Journal of Software Engineering and
retrieved automatically from the databases as Knowledge Engineering (IJSEKE)
well as manually from target journals,
Journal of Systems and Software (JSS)
conferences, and workshops as a supplementary
source to the database search. The SLR Information and Software Technology (IST)
guidelines suggested that the creditability of a The Knowledge Engineering Review (KER)
study is based on the type of experiment [8]. In International journal of project management
order to make this SLR credible, the studies Knowledge based systems
without any validation were intentionally
Journal of Information Systems
excluded according to the evidence levels. In the
end, studies that passed this screening process
were finally selected to be further analysed in
Table 4:List of Conferences
this SLR. This review covers previous studies
within the time period from Jan. 2005 to March. Conferences
2014. We discovered that there is an obvious International Conference on Software Engineering and
lack of survey on risk assessment in IT Knowledge Engineering (SEKE)
governance. International Conference on Software Engineering
(ICSE)
2.2 Data Sources IEEE/ACM International Conference on Automated
Software Engineering (ASE)
The following databases as per (Table International Requirements Engineering Conference
2) are selected as the primary study sources. This (RE)
ACM Symposium on Document Engineering
selection based on the previous study by [10] is
(DocEng)
chosen as it is the most promising. In order to
ensure that we did not overlook any important
2.3 Search Terms
material, additional searches were performed
directly on key conference proceedings, journals This section defines the search terms for
and authors. Furthermore we conducted database search. From our research questions, we
secondary searches based on references found in derived the keywords. A search string was
our primary sources. constructed using relevant terms based on the
research questions. The first iteration included a
manual search and an automatic search based on
a list of keywords in the electronic databases.
The following Boolean search strings were used:
186

“Risk assessment” or “Risk management”
or “Knowledge risk” or “risk quantitative” Questionnaire/Survey
or “risk quantification” or “IT governance” 7%
Before selecting the papers to be used 8% Multiple data
for the SLR, we checked for repetition of the collection without
same studies to ensure that there is no questionnaire
Multiple data
duplication; for example if the same study is collection with
published in two different journals with different 15%
questionnaire
70% Others
first authors. In the event that we need to make a
choice we include the most comprehensive study
or the most recent study.
3. SLR FINDINGS Figure3: Data Collection Methods Used in The

Empirical Studies
A total of 32 studies discuss the risk
assessment methods in IT governance. Citations
The reviewed papers were published between
for the papers and other relevant papers are
2005 and 2014. Fig. 4 shows that more papers on
included in the reference for further reading. The
this subject were published in 2005 compared to
inspected publications were classified according
more recent years.
to the applied research method. Figure 2 shows
that out of the 32 studies, 85% are empirical,
12%theoretical and, a small number of studies
(3%) are either reviews of the literature or
secondary studies, where empirical work is re-
examined.
Research methods
Others
in our3%accepted
Empirical
Theoretical
papers Theoretical
Others
12%
Figure 4: Data Collection Methods Used in The

Empirical
Empirical Studies
85%
3.1 Risk Assessment Of IT Governance
Figure 2: Research Method In Paper Study By investigating the two research

questions, we aim to gain a broad picture of what
Out of the 27 studies that are empirically based, the literature is reporting on Risk assessment in
only 4 studies do not include questionnaires. IT governance. We collected information about
Figure 3 shows the breakdown of data collection the relationship between risk assessment and IT
methods for the empirical studies. governance (RQ1); and what are the existing
frameworks and models for risk assessment in IT
governance (RQ2). 19 studies were identified in
answering RQ1 as shown in Table 5. All the
studies analysed gave the impression that many
attempts have been made to define IT
governance and give detailed explanations of
how risk assessment relates to IT governance.
Risk assessment is one of the main activities in
risk management of IT governance [11].
187

IT governance is a very important issue management planning focuses on the
at present as an integral component of any collaboration between the management level
corporation or organisation. The purpose of IT activities and the operational level activities in
governance is to direct IT endeavours to ensure order to cope with IT risks successfully. They
that IT performance meets the objectives set out further commented that the adoption of IT
in its strategy [5]. With effective governance, the applications has also brought organizations risks
return of IT investment can be optimized to related to IT such as strategic risk, financial risk,
extend business strategies and goal. IT operational risk and technological risk. In order
governance has focused on the domains of IT to minimize and control these risks successfully,
strategic alignment, IT resource management, IT risk assessment policies and strategies have
risk management, performance measurement and been developed and implemented in
IT value delivery. Risk management framework organizations.
is put in place to ensure that risks have been However, this management control
adequately managed by the organisation. RA is emphasises both business control and
one of the main activities in risk management of technological control which support business
Categories Paper Frequency
requirement and governance. To be effective,
references (studies) risk assessment cannot be merely a checklist or a
Risk assessment [13]), [6], [11], 6 process that is disconnected from business
and IT [5], [2] and [12] decision making. When the risk assessment
governance. process is incorporated into ongoing business
The interaction [15], [16], [13], 6 practices, risk can be managed as part of day-to-
between Risk [17], [18],and
assessment and [19].
day decision making, in a manner consistent with
IT governance. the organization’s risk appetite and tolerance
[14].
An assessment of [20], [21], [22], 7
Risk in IT [23], [24], [25]
governance. and[3]. Table 5:Risk Assessment in IT Governance Studies
Categories.
3.2 Risk Assessment Frameworks of IT
IT governance [2]. The phases in RA as
Governance
identified by [2] are identification, analysis,
evaluation, control and mitigation, and
documentation. [2] revealed that most critical A total of 22 papers answered RQ2.
risk driver was the choice of methodology, There is general agreement about the need to find
customer involvement, use of formal project effective frameworks relating to Risk assessment
management practices, project complexity, and in IT governance. We identified the three best
requirement volatility. [12] proposed a tool used risk assessment frameworks in the papers
to perform intuitive – if” “what – if” analyses to analysed (refer Table 6) based on literatures by
guide managers in determining how they can [26], [18],[27], [3], [23]. [15] stated that COBIT
proactively reduce software project risk. is one of the preferred frameworks in IT
Risk assessment is a series of steps Governance because it uses a classification
which the objectives are to identify, address, and which consists of five focus areas: strategic
eliminate software risk items before they become alignment, value delivery, resource management,
either threats to successful software operation or risk management, and performance
a major source of expensive rework[13]. In measurement. In COBIT 5.0 the concepts and
general, IT risk assessment is referred to as the ideas contained in these focus areas are
essential process to aid enterprise achieving “the maintained and built upon in the framework, but
new business changes as well as decide on future the focus areas themselves have not been literally
investment in information and information maintained [25].
system”. [18] find out in their research in IT
[3] recommends evaluating risk Governance theory and practice that IT
assessment in organisations by comparing the governance aims to align business and
Control Objectives for the Information and information technology strategies. IT governance
related Technology (COBIT) framework and the frameworks, such as COBIT and ITIL, are
ISO/IEC 17799 standard for dealing with IT risk internationally accepted and promote these
assessment in IT Governance. The findings from benefits.
three case studies indicate that successful IT risk
188

[3] identifies the current profile of IT nowadays and many more emerging every day.
risk management planning and investigates They all have the same basic goal, but very
success in implementation in Thai organizations different perspectives and addressing different
of both the Control Objectives for the problems. Some of them applied to all kinds of
Information and related Technology (COBIT) risk, while others are specific for particular risks.
framework and the ISO/IEC 17799 standard for These papers compare and clarify the different
dealing with IT risk assessment. The findings activities, components, advantages and
from three case studies on successful IT risk limitations required by each risk assessment
assessment conclude that ITIL is considered the model/ framework in IT. The risk assessment
best practice and it is also recommended to models in IT are shown in Table 7.
supplement the COBIT and the ISO 17999 for [5] proposed a risk assessment
dealing with IT risk assessment [3]. framework in supply chain (Information
[27]in their case study in organizational System)that addresses the problem of operational
challenges and barriers to implementing IT risk assessment in supply chain operations. The
Governance presented both a COBIT and an framework consists of four components: Value
ITIL assessment framework applied. The Modelling, Process Analysis, Uncertainty
outcome of both the COBIT and ITIL Estimation and Multi-Criteria Decision Making
assessments have shown that organisation is still that used to assess the risk level on user,
not fully using all components of COBIT and at application and database architecture. In
low level usage of ITIL tools, respectively [27]. developing the framework a Value Based
[28] in their report started that COBIT Method was used as a technique. The framework
provides a framework of processes and key is representing a general conceptual road-map
controls that can be matched to identified key and serves as a guideline but not tested in real
risks to which the enterprise has decided to environment.
respond to via mitigation. COBIT framework [38]designed a software risk assessment
provides a reference model for the second line of model (SRAM) in software engineering to access
defence because it defines IT activities in a the level of risk in software project. The model
generic process [28]. includes three main components namely quality,
[23]stated that the COBIT distinguishes schedule and cost. The model is able to predict a
itself as a well-recognized framework for IT possible outcome of project risks. This model
governance and auditing accounting IT systems. works as questionnaire to assess the risks. The
It is designed as an accessible guide for SRAM is considering for risk in software
managers, users, auditors others who use the development (software engineering). [39]
computer for their business in order to ensure the proposed a software risk assessment
confidentiality, integrity and availability of data identification and estimation model (SRAIEM)
and information. for software engineering process. SRAIEM is
able to assess, identify, prioritize, estimate and
Table 6: Best Risk Assessment in IT Governance predict the risks by using software metrics. [40]
Framework and Models proposed Genetic Risk Assessment Model
Categories Paper references Frequency (GePRA) in programming logic domain(software
(studies) engineering). The model uses vulnerability and
COBIT [29], [13], [30], 6 asset value as technique to support risk
framework [31], [21], [32]. assessment and decision making process for
ISO 27002 [33], [34], [35], 8 intrusion detection system. GePRA model
(ISO 17799) [36][37], [38], [21] performs quickly due to its utilisation of simple
and [39]. processes such as simulation and programming.
ITIL [6], [26], [18]. [3], 8
GePRA concentrate on particular risks such as
[27], [28], [23], [29] technical risk. [41] proposed risk-assessment
model to assess the impact of cyber-attacks in
software engineering. The model uses
mathematical technique to aid different
3.3 Risk Assessment Model /Framework organizations to perform risk assessment of their
control systems and facilitate cost-benefit
There are numerous risk assessment analysis. The model considers technical and
models of Information Technology (IT) financial risks.[42] designed Quantitative Risk
189

Assessment Model in Project Management management of IT governance [11], [2]. The
comprising Qualitative Rules, Risk Factors, findings confirmed that The Information
Project Risk and Risk Taxonomy. The model Technology Infrastructure Library (ITIL)is
applies a quantitative CMMI assessment as their considered best practice for ICT, service
technique for quantifying and monitoring risks. management and it is also recommended to
The model is automated and provides specific supplement the COBIT and the ISO 17999 for
decision-making guidance. dealing with ICT risk management. Further
[43]contributed a knowledge-based risk research work could be conducted on the need of
assessment framework in Knowledge a tool for assisting RA process in IT governance.
management to capture, codify, store and To date, there is no standard guideline to help
distribute knowledge in Small Medium managers in conducting main risks assessment
Businesses (SME). The model is being used as a consisting of operational, technical and strategic
template for evaluating the benefits and risks of risks. As the final conclusion, findings obtained
application outsourcing of SME. The model in this review, including an examination of the
components comprise of delivery and shortcomings found in this systematic literature
enablement; integration; management and review provides a strong evidence to encourage
operations; business transformation; and further research in the development of a new
client/vendor relationships.[44] proposed a methodology to adequately perform Risk
Fuzzy risk assessment model in information assessment in IT governance.
system. The model helps to integrate possible
risk factors for decision making process to
support the implementation of new information ACKNOWLEDGEMENTS
systems. The model uses a Fuzzy Algorithm as a The authors gratefully acknowledged supports
technique. The model components include risk by the Faculty of Computer Science &
likelihood, risk severity, risk factor, risk, Information Technology, Universiti Putra
aggregation, fuzzy inference. Malaysia and to our parents.
[45]developed a Fussy ExCOM risk assessment
model for Information system to integrate the REFERENCES:
estimation and assessment of risk activities in
software project. The model uses a fussy novel
as a technique. The model component comprise [1] I.Sommerville, “Software Engineering”, 9th
of Software size, Project Risk, Contingency Edition; Addison-Wesley Publishers, (USA),
Allowance and Effort Estimation.[46] developed May 21-23, 2011.
an architecture-oriented information security risk [2] A. Tiwana and M. Keil, “The one-minute risk
assessment model (AOISRAM) for Information assessment tool”,Communications of the
system. The model components include risk ACM, Vol. 47, No. 11, 2005, pp. 73-77.
monitoring, risk resolution, risk management [3] S.Kumsuprom,
planning, risk prioritization, risk analysis and B.CorbittandS.Pittayachawan, “ICT Risk
risk identification. The model can be applied as a Management in Organizations: Case studies
guideline in particular domains such as in Thai Business”, 19th Australasian
information security. The model was appraised Conference on Information System,Dec 3-5
to solves many difficulties caused by the process 2008, pp.513-522.
oriented approach in ISO 27001 of IS risk [4] R. NHaizan, “ICT Service Quality
assessment such as irregular distribution of Measurement Framework for the Context of
resources, poor safety performance and high risk. Malaysian Universities”,Doctor of
Philosophy, February 2013,
4. CONCLUSION AND FURTHER UniversitiTeknologi Malaysia, Skudai Johor,
RESEARCH Malaysia, 2013, pp. 1-343.
[5] L. Liu and H. Daniels, “Towards a Value-
This paper presents a systematic based Method for Risk Assessment in
literature review that investigates risk assessment Supply Chain Operations”,Journal of
of IT governance. The aim is to identify the Economic Literature (JEL), May 2011, pp.
process, frameworks, model and their challenges 1-3.
in implementing RA in IT governance. Risk
assessment is one of the main activities in risk
190

[6] ITGI,“Board Briefing on IT Governance”, Tertiary Education, Pretoria, South Africa,
IT Governance Institute, Retrieved from Vol. 1, No. 2, 20 September 2006, pp. 1-14.
http://www.itgi.org, 2010, pp. 1-20. [19] G. Stoneburner, A.Goguen, and A. Feringa,
[7] P. Weill and J. W. Ross, “IT Governance on “Risk Management Guide for Information
One Page”, CISR Working Paper, June Technology Systems”,Recommendations of
2005, pp. 1-349. the National Institute of Standards and
[8] B.A. Kitchenham, “Procedures for Technology. February 2002, pp. 434-470.
Performing Systematic Reviews”,Joint [20] L. Jack and B. Junior, “Information Security
Technical Report Software Engineering Risk Assessment GAO Practices of Leading
Group. Department of Computer Science Organizations”,Accounting and Information
Keele University (UK) and Empirical Management DivisionJordan, May 2009, pp.
Software Engineering, National ICT 1-12.
Australia.Vol. 4, No. 2, 2005, pp. 45-56. [21] E. Jordan, and Silcock L, “Beating IT risks.
[9] P. Brereton, B. A. Kitchenham, D. Budgen, West Sussex, England: John Wiley & Sons
M. Turner, and M. Khalil, “Lessons from Ltd, May 2005.
Applying The Systematic Literature Review [22] Laurie Williams, “Risk Management”,IEEE
Process within The Software Engineering Computer Society Press, Vol. 5, No. 2,
Domain”,School of Computing and 2005, pp. 1-15.
Mathematics Keele University Keele, [23] M. Gheorghe, “Risk Management in IT
Staffordshire, ST5 5BG Governance Framework”, The Bucharest
UKVol. 80, No. 3, 2007, pp. 571–583. Academy of Economic Studies, Romania.
[10] W. Ding, P. Liang, A. Tang and Van Vliet, Vol. 14, No. 3, 2011, pp. 545-552.
“Knowledge-based Approaches in Software [24] R. Beers, “Risk Management Fundamentals;
Documentation: A Systematic Literature Risk Management for Decision
Review”, Information and Software Making”,Homeland Security Risk
Technology, Journal of Information and Management Doctrine, Vol. 1, No 3 2011,
Software Technology18 January 2014, pp.1-31.
pp.1-51. [25] R. Oyemade, “Effective IT Governance
[11] P. Woods and R.Byrt, “Risk assessment, through the Three Lines of Defence, RiskIT
measurement and management”, Book on and COBIT ISACA Journal Vol. 5, No. 4,
Forensic, November 2006. 2012, pp. 10-21.
[12] M. A. Mustafa, and J.F. Al-Bahar,“Project [26] W. D. Junior, "Assessing IT Governance
risk assessment using analytical hierarchy Maturity: The Case of San Marcos, Texas".
process”,IEEE Transactions on Engineering Applied Research Projects, Texas State
Management, Vol. 3, No. 2, 2010, pp. 1-11. University-San Marcos Luis, February 21-
[13] G. H. Bodnar, “IT Governance”, Internal 23, 2013, pp. 626-632.
Auditing, Vol. 18, No.3, May 2008, pp. 27- [27] ISACA, 2013.“Issues COBIT 5 Governance
32 Framework". ISACA.org. retrievedonline,
[14] R. McAdams and A. Galloway, “Enterprise Vol. 5, No. 4, 2013, pp. 1-10.
Resource Planning and Organisational [28] J. W.Lainhart, 2010. “Why IT governance is
Innovation: A Management a top management issue”, The Journal of
Perspective”,Industrial Management & Data Corporate Accounting & Finance,Vol. 11,
Systems, Vol. 105, No. 3, 2005, pp. 1-14. No.5, July, pp. 33-40.
[15] A.R. Rim, “A Risk Management Standard [29] S. B. Von, “Information Security
AIRMIC, ALARM, IRM”, Journal of Risk governance: COBIT or ISO 17799 or
Management,Febuary2005, pp.1-39. both?”, Journal of Computers &
[16] P.Coopers,IT Governance in Practice Insight Security,Elsevier Advanced Technology
from leading CIOs; PricewaterhouseCoopers Publishers, May 10-11, 2005 pp. 1-10.
International Limited,June 2007. [30] G.Sarens and I. De-Beelde, “The
[17] D.Steuperaert, “The Risk IT Relationship between Internal Audit and
Framework”,Excerpt ISACA Journal USA, Senior Management: A Qualitative Analysis
March 2009, pp. 234-343. of Expectations and
[18] E. Wessels and J.L .Van, “IT Governance: Perceptions”.International Journal of
Theory and Practice”,Proceedings of the Auditing, Febuary 8-9, 2007 pp. 10-21.
Conference on Information Technology in
191

[31] G. R.Saint, “Information Security CMMI Quantitative Approach; Faculty of
Management Best Practice Based on Information and Communication
ISO/IEC 17799”', Information Management Technology Mahidol University Bangkok,
Journal,Vol. 39, No. 4, July 2005, pp. 60- Thailand”, Fifth International Conference
66. on Software Engineering Advances,
[32] K. Bilge and I.Sogukpinar., A quantitative February 10-11, 2010, pp 331-337
method for ISO 17799 gap [43] W. L. Currie, “A Knowledge-Based Risk
analysis. Computers & Security, Vol.25, No. Assessment Framework for Evaluating
6, 2006, pp. 413-419 Web-Enabled Application Outsourcing
[33] D.Mellado and D. G. Rosado, “An Projects”, International Journal of Project
Overview of Current Information Systems Management, Vol. 21, No.2 2005, pp. 207-
Security Challenges and Innovations”, 217
Journalof Universal Computer Science, [44] G.Yucel, S. Cebi, B.Hoege and Ahmet F.
February 21-23, 2007, pp. 234-241. Ozok, “A Fuzzy Risk Assessment Model for
[34] J. Eloffand M.Eloff, “Information Security Hospital Information System
Management-A New Paradigm”, Implementation”; Experts systems with
Proceedings of SAICSIT, February 21-23, applications Elsevier publishers, Expert
2003, pp. 130-136. Systems with Applications, Vol. 39,No.7,
[35] S. Groves, “The Unlikely Heroes of Cyber 2011 pp.1211–1218.
Security”, Information Management [45] E.Manalif, L. F. Capretz and H. Danny,
Journal,Vol. 37, No. 3, May 2003, pp. 34-40. “Software Project Risk Assessment and
[36] M.Theoharidou, S.Kokolakis, Karyda, M. Effort Contingency Model based on
and E. Kiountouzis, “The insider threat to COCOMO Cost Factors” Journal of
information systems and the effectiveness of Computations & Modeling, Vol.3, No.1,
ISO17799”,Computers & Security, Vol. 24, 2013, pp. 113-132.
No. 6, May2005, pp. 472-484. [46] M. Wei-Ming, Study on Architecture-
[37] N.Robinson, “IT excellence starts with Oriented Information Security Risk
governance”, The Journal of Investment Assessment Model Information
Compliance, Vol. 6, No.3, April 2005, pp. Management Department, Cheng-Shiu
45-49. University, Vol. 3, No.4, 2010, pp. 218–226,
[38] F. Say-weiand A.Muruganantham,
“Software Risk Assessment Model; National
University of Singapore”,IEEEinternational
conference on management of innovation
and technology, May 21-23, 2005, pp. 536-
544.
[39] B.Singh, D. S.Kapil and S. Chandra, “A
New Model for Software Risk Management”
Inc. Computer Technology & Applications,
Vol. 3, No.3, 2012,pp. 953-956.
[40] A. Abraham and S. Y. Han, “Programming
Risk Assessment Models for Online Security
Evaluation Systems”, International Journal
of Computer Trends and Technology
(IJCTT), Vol. 9, No 6,2009, pp.279-285
[41] S. Patel and J.Zaveri, “A Risk-Assessment
Model for Cyber Attacks on Information
Systems Department of Information Science
& Systems”, Morgan State University,
Baltimore, Journal Of Computers, Vol. 5,
No. 3, 2010, pp. 352-359
[42] M. ChoetkiertikulandT.Sunetnanta, “A Risk
Assessment Model for Offshoring Using
192

Table 7: Risk Assessment Model/Framework of Information Technology
Model/Categories Researchers Components/ Technique Limitation

Risk assessment framework [5] Value Modeling, Process The framework is still a general conceptual Road-
in supply chain Analysis, Uncertainty map, serving as a guideline for future research.
Estimation & Multi-Criteria Much work has to be done to make it practically
Decision Making applicable to real world business.
Use Value based method as a

technique
Software risk assessment [38] Quality, Schedule & cost of a addresses the development risk and does not assess
model (SRAM) project risk the marketing risk.
Use questionnaire as a technique
(SRAIEM) software risk [39] Level of risk, prioritize the risk Is not able to manage the risks in web distributed
assessment identification and categorize the risk. environment alone.
and estimation model
Use software metrics as a
technique
Genetic Risk Assessment [40] Threat level, vulnerability & Only able to assess technical risk in networks
Model (GePRA) Asset Value
Simulations/
Programming based technique
Risk-assessment model to [41] Employees/Customers, Only able to assess risk loss in technical and financial
assess the impact of cyber Corporate network, Monitoring damages
attacks Interface,
Media, Control Station &
Internet
Mathematical technique
A Quantitative Risk [42] Qualitative Rules, Risk Factors, No proof-of-concept prototype of this work. The
Assessment Model Project Risk & Risk Taxonomy validation of
this model and its assessment rules will need to be
Technique use is the further investigated
quantitative CMMI assessment
A knowledge-based risk [43] delivery and enablement; Risk assessment can only be carried on a web based.
assessment framework integration;
management and operations;
business transformation; and
client/vendor relationships
Technique is Knowledge
management
A Fuzzy risk assessment [44] Risk Likelihood, risk Severity, Can only assess risk
model Risk factor, Risk, Aggregation, for a hospital information system & has been
Fuzzy Inferencing & developed to estimate risk for the implementation of
Deffuzification new IS
Technique is Fuzzy Algorithm

A Fussy ExCOM risk [45] Software size, Project Risk, Model cannot be implemented thus needs learning
assessment model Contingency Allowance & ability and feasibility
Effort Estimation
Technique is fuzzy novel

Architecture-oriented [46] Risk monitoring, Risk Research model is based on addressing security
information security risk resolution, Risk management related risk
assessment model planning, Risk prioritization,
(AOISRAM) Risk analysis & Risk
identification.
Technique is a structure
behaviour coalescence method
193

Risk Assessment of It Governance A Syste

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Risk Assessment of It Governance A Syste

Uploaded by

Copyright:

Available Formats

Journal of Theoretical and Applied Information Technology

20th January 2015. Vol.71 No.2

ISSN: 1992-8645 www.jatit.org E-ISSN: 1817-3195