Assessing the effects of IT changes on IT risk - A business process-oriented view

The economic relevance of IT risk is increasing due to various operational, technical as well as regulatory reasons. Increasing flexibility of business processes and rising dependability on IT require continuous risk assessment, challenging current methods of risk management. Extending these methods by a business process-oriented view is a promising approach for taking the occurring dynamics and interlinks into consideration. In this contribution, a layer based approach for systematic modeling of relations between causes (threats) and effects (direct and indirect loss) is pursued. On the basis of these cause-effect relations, the presented IT Risk Indicator InTRIn measures changes in the IT support of business processes. It is discussed how InTRIn can provide accurate and real-time information on the IT risk situation and thus improve IT risk management. 1 Flexible Business Processes and IT Risk The flexibility to adapt business processes to customers’ changing demands is regarded as an important instrument for companies in order to be able to distinguish themselves from their competitors (e.g. [Sa95; BG05; Mi07]). To create flexibility, information technology adopts an increasingly supportive role. While, at least in Germany, two out of three companies already use IT systems such as ERP or SCM to manage their business processes [Sa05], the need for flexibility is further reinforced by current technological trends. The increasing operational use of web services and the realization of service-oriented architectures (SOA), as well as the use of virtualization approaches or so-called services on demand, provide a helpful and suitable IT infrastructure [Mi07; Kr05]. However, increasing automation of business processes by relying on a flexible IT infrastructure does not only improve business process performance but also places particular emphasis on IT risk. On the one hand, business processes are directly linked with a company’s economic return as well as compliance with regulations, contracts, and standards [LK06] [Ka08]. Increasing dependency of business processes on IT also increases the possible indirect losses resulting from a malfunction of IT that can easily