1. IT Infrastructure Amna Riaz007 Tayaba Ashraf008

3. Risk 0 Uncertain or chance events that planning can not overcome or control. 0 A risk is a potential problem – it might happen and it might not 0 Risk concerns future happenings 0 Two characteristics of risk 0 Uncertainty – the risk may or may not happen, that is, there are no 100% risks (those, instead, are called constraints) 0 Loss – the risk becomes a reality and unwanted consequences or losses occur

4. Risk Management 0 Risk Management is the name given to a logical and systematic method of identifying, analyzing, treating and monitoring the risks involved in any activity or process. 0 Risk Management is a methodology that helps managers make best use of their available resources.

5. Risk Management 0 Risk management is a structured approach to managing uncertainty and includes actions taken to: 0 identify; 0 assess; 0 monitor; and 0 reduce the impact of risks to your business.

6. Risk management process 0 Risk Identify 0 Identify possible risks; recognize what can go wrong 0 Assessment Risk 0 Analyze each risk to estimate the probability that it will occur and the impact (i.e., damage) that it will do if it does occur 0 Evaluate the risks 0 Rank the risks by probability and impact - Impact may be negligible, marginal, critical, and catastrophic 0 Develop a contingency plan to manage those risks having high probability and high impact

7. The Risk Management Process

8. IT Risk by George Westerman and Richard hunter

9. IT Risk 0 IT risk not as a technical issue, but as a business and management one. It can be thought of as being split in three parts. 0 Part One: 0 About the framework and the overall approach to risk management. 0 Part Two: 0 Concentrates on the actionable management steps business and technology executives can use to manage risk. 0 Part Three: 0 looks at the future and proposes improvements to risk management.

10. IT Risk Part One 0 The 4A Risk Management Framework A framework of four A’s that looks at risk from a business perspective, rather than an assurance or compliance perspective. The four A’s that define IT risk are: 0 Availability—Keeping Existing processes running and information flowing through the business 0 Access—Ensuring that the appropriate people, including customers and suppliers, can get the information and functionality they need to be effective, but Unauthorized people do not gain access.

11. Part one cont. … 0 Accuracy—Concentrating on providing accurate, timely and complete information to meet Requirements of management, Staff, customers, supplier 0 Agility—Implement new Strategy initiatives, such as acquiring a firm, completing a major business process redesign or lunching a new product/services. The ability to change with managed cost and speed.

13. Part 1 Cont.… 0 The Three Core Disciplines of IT Risk Management These are: 0 A well-structured foundation of IT assets, an installed technology base of infrastructure and application technologies, and supporting personnel and procedures 0 A well-designed and well-executed risk governance process that provides an enterprise-level view of all risks 0 A risk-aware culture in which everyone has appropriate knowledge of risk

14. IT Risk Part 2 0 Fixing the Foundation 0 Strengthening the base of the pyramid; the importance of infrastructure in risk management 0 Simplifying the base of the pyramid; about how complexity drives risk, cost and performance levels. 0 Critical point when they show how change in infrastructure is IT change, while change in applications is business change.

16. Part 2 Cont.... 0 Developing the Risk Governance Process 0 Covering how to manage and make decisions regarding IT and business risks 0 Building a Risk-aware Culture 0 An important connection between risk and culture, and a critical distinction between being risk-aware and risk-averse.

18. IT RiskPart 3 0 Looking Ahead 0 Talks about how to incorporate risk management as a positive force in planning and strategy setting 0 Some Ways Executives Can Improve IT Risk Management 0 Different ways executives can improve IT risk management. Some of these ways are: 0 Treat IT risk as business risk. 0 Simplify the foundation. 0 Give to every employee an appropriate awareness of the risks, vulnerabilities and policies that matter most to them. 0 Measure effectiveness. 0 Lead by example.