Search

The background of the study was the experience of the major difficulties that IT compliance professionals face in light of emerging technologies like Artificial Intelligence (AI). For this purpose, an in-depth analysis of the current situation and future focus points are provided by a prime coverage of 1,000 survey respondents who are industry cyber practitioners. One in two businesses with between 1000-5000 workers experienced a security breach in 2022, showing that threat actors are still driven to obtain valuable and sensitive data. In contrast to last year's 35% and 57%. Firms anticipate spending more effort on risk compliance management in 2023. The chosen methodology for analyzing this topic is a qualitative retrospective casual comparative positivism approach. Through this analysis, the paper aims to determine whether the C-Suite and board are actively addressing the escalating incidents of security breaches. It is widely recognized that businesses are prepared to enhance their risk and compliance management practices in the future. The paper intends to provide conclusive insights into the current handling of risk and compliance, with indications that these areas are often managed independently and in isolation. Further details on these findings will be presented in the paper. [ABSTRACT FROM AUTHOR]

In recent years, some standards and frameworks proposed the risk management structures for managing and controlling IT risk that is the main component of enterprise governance of IT. Unfortunately, these frameworks have a retrospective view of threat analysis and less pay attention to future threats in the business environment, and do not propose adaptable solutions. At the same time, the current risk framework is not based on a strong scientific system modeling. In this research, the researcher proposed the Viable System Model (VSM) as an adaptable and comprehensive framework that is based on scientific modeling with the systematic approach for managing and controlling IT risk in today's complex business environment. This research did in a systematic action research methodology in the banking context in Iran. The results showed that by applying the VSM as a framework for managing IT risk, adaptability of IT risk criteria according to the future threats can be achieved by this framework. A comprehensive risk management framework (retrospective and prospective view) with a systematic approach could be achieved by this system modeling. [ABSTRACT FROM AUTHOR]

Copyright of Jurnal Sosial dan Sains (SOSAINS) is the property of Green Publisher and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Purpose: Risk management is an under-explored topic in information systems (IS) research that involves complex and interrelated activities. Consequently, the authors explore the importance of interrelated activities by examining how the maturity of one type of information technology risk management (ITRM) practice is influenced by the maturity of other types of ITRM practices. The purpose of this paper is to explore these relationships, the authors develop a model based on organizational strategy implementation theory and the COBIT framework. The model identifies four types of ITRM practices, namely, IT governance (ITG); communications; operations; and monitoring. Design/methodology/approach: The authors use a survey methodology to collect data on senior information technology (IT) executives' perceptions on ITRM practices. The authors use an exploratory factor analysis (EFA) to identify four dimensions of ITR M practices and conduct a structural equation model to observe the associations. Findings: The survey of senior IT executives' perceptions suggests that the maturity of ITRM practices related to ITG, communications and monitoring positively influence the maturity of operations-related ITRM practices. Further, the maturity of communications-related ITRM practices mediates the relationship between ITG and operations-related ITRM practices. The aggregate results demonstrate the inter-relatedness of ITRM practices and highlight the importance of taking a holistic view of ITRM. Research limitations/implications: Given the content and complexity of the study, it is difficult to obtain senior executives' responses in large firms. Therefore, this study did not use a separate sample to conduct the EFA to obtain the underlying four constructs. Also, the ITRM practices identified are perceptions. Even though the authors consider this to be a limitation, it also communicates the pressing areas that senior IT professionals are expected to focus given various external and internal pressures. This study focuses on large firms, hence, small to midsize firms are not well represented. Practical implications: Given the demanding regulatory and financial reporting requirements and the complexity of IT, there is an increasing possibility that the accounting profession will require IT professionals to focus on operations-related ITRM practices, such as security, availability and confidentially of data and IS are closely related to internal controls. However, as this study demonstrates, the maturity of operations-related ITRM practices cannot be achieved by focusing solely on operations-related IT risks. Therefore, IT practitioners can use this study to raise awareness of the complex interrelationships among ITRM practices among managers to improve the overall ITRM practices in a firm. Social implications: The study also shows the importance of establishing proper communication channels among various business functions with regard to ITRM. Extant IT research identifies the importance of the firm's communication structure on various firm performance measures. For example, Krotov (2015) mentions the importance of communication in improving trust between the Chief Executive Officer and Chief Financial Officer. Firms with established communication channels have the necessary medium to educate and involve other departments with regard to the security of data. Thus, such firms are more likely to have mature risk management practices because of increased awareness of risks and preventive techniques. Originality/value: The study contributes to ITG and risk management literature by identifying the role of monitoring-related ITRM practices on improving other areas of risk management. The study also extends the existing ITRM literature by providing an organizational strategy perspective to ITRM practices and showing how ITRM practices follow organizational strategy implementation. Further, the authors identify four underlying ITRM categories. Consequently, researchers could choose between two factors (Vincent et al., 2017) or four factors based on the level of detail required for the particular study. [ABSTRACT FROM AUTHOR]

Copyright of HMD: Praxis der Wirtschaftsinformatik is the property of Springer Nature and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Polish Journal of Management Studies is the property of Czestochowa University of Technology, Faculty of Management and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Risk management should be part of any software development project and the integration of its management processes into the IT business. This leads to successful software development and improvement of the organizational activity of the IT company. In the area of risk management, we define two main levels: strategic and operational. Different processes are differentiated depending on their application in the design, implementation and maintenance stages of software products. It presents the attitude of the individual processes in risk management in the field of IT companies. [ABSTRACT FROM AUTHOR]

After the recent financial crises, regulators have started reform projects for the auditor's report, the part of a company's financial statements that presents the auditor's opinion. One of the reforms is the transition from a standardised auditor's report without any company-specific information to a report that discloses company-specific information in the so-called key audit matters, significant risks of material misstatement in the company's financial statements. In this paper, we investigate whether a specific subset of the key audit matters, namely those that are IT-related, can be a useful source of company-specific information. Information on IT is important for stakeholders: research in the past decades has shown that IT can potentially disrupt industries, affect a company's stock market value, create risks for a company's continuity, or endanger the integrity of the financial statements. Company-specific information on IT is therefore relevant, but it is also scarce, as there are hardly any mandatory disclosures and companies do not frequently disclose IT-related information voluntarily. IT-related key audit matters could fill a gap in information availability for stakeholders such as investors, auditors and academics. We study the auditor's reports in the financial statements of the companies list on the main Dutch stock market, the AEX. This Dutch market regulator has been a frontrunner for the implementation of the new auditor's report: disclosure of key audit matters has been voluntary in 2012, and mandatory since 2013. In the 75 annual reports, we identify 255 key audit matters, 39 of which were IT-related. We find that the IT-related key audit matters already contain useful information for investors. However, both auditors and academics can play a role in further development of the value of key audit matter disclosures. We argue that auditors may need to pay more attention to high-risk areas such as cyber security. We encourage academics to identify and design innovations of the auditor's report proactively. [ABSTRACT FROM AUTHOR]

We are passing through information age with lightning communication speed. Information asset storage in Cloud and retrieval in the net has become the new invisible corporate voyage into the information space. Information Assets are a valuable source of Knowledge for both Information asset creator as well as the user. These are fluid assets that change overtime based on several internal and environmental factors! This paper seeks to address these aspects of Change that impacts such "fluid" Information Assets and the need to raise up to the changing expectations of the millions of users by satisfying the ever growing information hungry businesses. Providing unreliable information and suboptimal analytical tools can destroy the user in the first instance and can lead to self-destruction as Information asset provider will find no takers in the long run. In this context this assorted information on Change management is chosen carefully and it is hoped, will benefit the reader who may be a technical expert in his field. [ABSTRACT FROM AUTHOR]

Copyright of Sistemas & Telemática is the property of Universidad ICESI and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Economic Annals-XXI / Ekonomìčnij Časopis-XXI is the property of Institute of Society Transformation and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Copyright of Science: Future of Lithuania / Mokslas: Lietuvos Ateitis is the property of Vilnius Gediminas Technical University and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The continuous development of the new IT technologies was followed up by a rapid integration of them at the organization level. The management of the organizations face a new challenge: structural redefinition of the IT component in order to create plus value and to minimize IT risks through an efficient management of all IT resources of the organization. These changes have had a great impact on the governance of the IT component. The paper proposes an audit methodology of the IT Governance at the organization level. From this point of view the developed audit strategy is a strategy based on risks to enable IT auditor to study from the best angle efficiency and effectiveness of the IT Governance structure. The evaluation of the risks associated with IT Governance is a key process in planning the audit mission which will allow the identification of the segments with increased risks. With now ambition for completeness, the proposed methodology provides the auditor a useful tool in the accomplishment of his mission. [ABSTRACT FROM AUTHOR]

As organizations become increasingly reliant on information technology (IT) they are exposed to a growing number of risks. Surprisingly, however, very few studies to date have investigated the psychometric representation of IT risks, and none have been undertaken in the workplace. Accordingly, the present study was designed to map the judgments of a representative group of workplace IT users. Fifty-seven participants evaluated 18 IT risk scenarios by means of 13 bipolar attribute-rating scales. Profile proximities derived from the raw data were submitted to a weighted multidimensional scaling analysis. The results indicated that a six-dimensional solution was required on both statistical and conceptual grounds to represent adequately the participants' judgments. The dimensions reflected the extent to which the various risk scenarios were perceived as: (1) serious or minor in nature; (2) having a high or low probability of occurrence; (3) causing a high or low degree of stress; (4) deliberate or accidental; (5) having an impact on the organization or on individuals; and (6) the product of human or technological causes. The data were also submitted to a series of hierarchical cluster analyses, using a variety of agglomeration techniques. This second approach revealed a robust structure in which the risk scenarios were grouped into two broad categories, based on whether the events depicted would be likely to have a major or minor impact. The major impact category broke down further, into two subcategories, based on whether the scenarios were seen to arise from deliberate causes or through negligence. In conclusion, we consider the implications of our findings for future research, the refinement of IT risk assessment frameworks and tools, and the training of risk management professionals. [ABSTRACT FROM AUTHOR]

This paper takes an event study approach to jointly examine the wealth and risk effects associated with electronic commerce announcements, contributing to the emerging research on the riskiness of IT investments and the trade-off between risk and return in the information systems literature. We estimate a generalized event study model that allows for both systematic and unsystematic risk changes on data collected for electronic commerce announcements in the 1996-2002 time frame. A striking result emerging from our analysis is that wealth effects are not significant after controlling for contemporaneous risk changes. Both total and unsystematic risk show a significant postevent increase in 1998 and 2000, whereas systematic risk adjusts downward in 1996 and 2002. Put together, our results contribute to our nascent understanding of how IT initiatives affect the risk-return profile of the firm. [ABSTRACT FROM AUTHOR]