Assessing the business consequences of systems risk

Both public media and IS research have produced a detailed view of different risks associated with computers. Measures to prevent systems risks from occurring are also well documented. One of the reported problems in implementing these measures is, however, that business managers often have difficulties to see the benefits of such efforts. The research reported in this paper used action research to examine the potential of using business process analysis as a method to associate system risk with business risk. The analysis was carried out in two different companies, one operating in the forest industry and the other one in the finance sector. The results from these two case studies suggest that business process analysis assisted in making the business consequences of systems risks more visible. But the risk assessment appears to have a systematic bias in risk identification, thus leaving room for further development of the proposed method as well as further research.