News
IT Governance Institute Seeks Public Comments on New Risk IT Framework
February 2009 by IT Governance Institute - ITGI
The nonprofit, independent IT Governance Institute is seeking public comment on its new IT risk framework, which is based on the globally recognized COBIT IT governance tool set. Comments on Enterprise Risk: Identify, Govern and Manage IT Risk: The Risk IT Framework (Risk IT) will be accepted through 13 March 2009 at www.itgi.org.
While COBIT (Control Objectives for Information and related Technology) sets good practices for the means of risk management, Risk IT sets good practices for the ends, by providing a framework for enterprises to identify, govern and manage risk.
The Risk IT framework explains IT Risk and will enable users to:
Integrate the management of IT risk into the overall enterprise risk management of the organization
Make well-informed decisions about the extent of the risk, the risk appetite and the risk tolerance of the enterprise
Understand how to respond to risk
The Risk IT framework addresses many issues enterprises face today and provides:
An accurate view of the current and near-future IT-related risks throughout the extended enterprise and the success with which the enterprise is addressing the risks
End-to-end guidance on how to manage IT-related risks, beyond both purely technical control measures and security
An understanding of how to capitalize on an investment made in an IT internal control system already in place to manage IT-related risk
When assessing and managing IT risk, integration with the overall risk and compliance structures within the enterprise
A common framework/language to help manage the relationship amongst executive decision makers (board/senior management), the chief information officer (CIO) and enterprise risk management, or between auditors and management
Promotion of risk responsibility and its acceptance throughout the enterprise
A complete risk profile to better understand risk, so as to better utilize company resources
Risk IT is designed for:
· Top executives and boards of directors who need to set direction and monitor risk at the enterprise level
· Managers of IT and business departments who need to define risk management processes
· Risk management professionals who need specific IT risk guidance
· External stakeholders
The framework has nine business processes divided into three domains: Risk Governance, Risk Evaluation and Risk Response. It also offers management guidelines, RACI (Responsible, Accountable, Consulted and Informed) charts, maturity models and goals and metrics.
The IT Governance Institute (ITGI) (www.itgi.org) is a nonprofit, independent research entity that provides guidance for the global business community on issues related to the governance of IT assets. ITGI was established by the nonprofit membership association ISACA in 1998 to help executives and IT professionals ensure that IT delivers value and its risks are mitigated through alignment with enterprise objectives, IT resources are properly managed, and IT performance is measured. ITGI developed COBIT and Val IT, and offers original research and case studies to help enterprise leaders and boards of directors fulfill their IT governance responsibilities and help IT professionals deliver value-adding services.
