Past research concerning information systems (IS) risk has mainly focused on development risk. However, the impact of any risk event that occurs once the system is operational can be far more extensive. Such events are due to what has been termed operational risk. Our research is concerned with operational risk that involves an IS – or IS-related operational risk – which has received little att...

Risk analysis is the only effective way of making value judgments about the need for security. Established analysis methods apply to whole operational systems, taking a necessarily holistic view of security, but this makes them difficult to integrate into the design process for service-based applications, where design and implementation is independent of operational deployment. However, the mos...

The typical insurance firm is subject to a wide variety of risks. Understanding and quantifying the interrelationships between individual risk elements is a significantly important but complex challenge. If we view all the risks in a firm as an integrated system, we can apply a computer-assisted learning process called Interpretive Structural Modeling (ISM) to construct a structural graph and i...

Operational risk is being considered as an important risk component for financial institutions as evinced by the large sums of capital that are allocated to mitigate this risk. Therefore, risk measurement is of paramount concern for the purposes of capital allocation, hedging, and new product development for risk mitigation. We perform a comprehensive evaluation of commonly used methods and int...

Operational-risk quantification has recently become important owing to the new Basel II regulations. Current methods based on observation of losses and their magnitudes to quantify operational risk do not preserve the cause-toeffect relationship that shows how operational risk can be reduced, managed, and controlled. We introduce a cause-to-effect operational-risk modeling methodology that enab...