Cost Estimation of Information Technology Risks and Instituting Appropriate Controls

Abstract

Nothing puzzles an enterprise’s Information Technology (IT) manager like the term “cost value†when deciding investments made in IT risk management. Today, businesses are more dexterous in planning as decision makers examine the value proposition towards controlling the enterprise’s IT risk. The conventional approach to managing IT risk is to look out for a change in the current business scenario, that is, a paradigm shift from value decision-making techniques to a pragmatic data-driven approach. The background behind the development of the data-driven approach is to arrive at a standardized methodology for an enterprise that strikes a correct balance between the cost and value elements of managing its IT risks, eliminating any disproportionate expenditure on controls. The approach has been architected in alignment with enterprise risk management concepts, industry best practices and data-driven techniques that have evolved over the years. This paper is structured in two major sections: the risk analysis stage, where IT risks are identified and estimated, and the control selection stage, where the cost of appropriate control is selected to reduce or eliminate a given IT risk. The paper works through a given scenario to practically demonstrate the data-driven approach.