A Reference Model for Process-Oriented IT Risk Management

The economic relevance of IT risks is increasing due to various operational, technical as well as regulatory reasons. Increasing flexibility of business processes and increasing dependability on IT require continuous risk assessment, challenging current methods for risk management. Extending IT risk management by a business process-oriented view is a promising approach for taking the occurring dynamics and interlinks into consideration. In this contribution, a systematic modeling of relations between causes (threats) and effects (direct and indirect loss) is pursued, bringing together the economic, process-oriented view with the technical, threat-oriented view of IT risks. It is discussed how the integration of cause and effect relations into the risk management process can improve the data basis for continuous risk assessment.