Information Technology Risk Research Articles

Perceived Attitudes & Disquiets on the Adoption of Enterprise Application Architecture for Supply Chain Management in SMEs

Background: Throughout the history of information systems, perceived attitudes and concerns (PADs) have been seen as a key factor in actual adoption (AA) of Enterprise Application Architecture (EAA), in this case for supply chain management. Systems development life cycle by John Zachman, who explains seven steps for systems development by Hay (1997), which include: strategy, analysis, reactance theory, design, construction, documentation, transition and production. Objectives: This research aims to determine whether PADs affect the AA of EAA for SCM. In addition, the impact of the systems development life cycle is determined by the following factors: communication and common language, commitment, governance, scope and purpose, business-oriented and approach. Methodology: To provide statistical analysis of diagnostic tests and data analysis, a quantitative research design was adopted. A stratified random sample was considered for two parameters: information technology users, resource optimizers, risk takers, customer-centric approaches, and malleability. The sample was compressed to 310. For the first estimation, the linear regression model using IBM SPSS software version 26 was used. Results: The results showed that PADs have a negative impact on the AA of EAA as indicated by the negative-slope linear regression. However, personal perspectives such as techie, determinism, romanticism, and scepticism result in a negative bias. Findings: These results cannot be extrapolated to all SME owners and managers as they act on the basis of different characteristics such as: Information system components, internet connectivity and contextual information technology. Nonetheless, the modus operandi for mitigating negativity includes: intrinsic and extrinsic motivation, perceived behavioral control, subjective norm, social factors, system complexity, and social factors. Keywords: perceived attitudes and disquiets, enterprise application architecture, supply chain management, actual adoption, small and medium enterprises.

Risk-Management Framework and Information-Security Systems for Small and Medium Enterprises (SMEs): A Meta-Analysis Approach

Information-technology (IT) security standards are regularly updated in a rapidly changing technological world to maintain pace with advanced technologies. This study was motivated by the realization that established IT risk-management frameworks might provide an adequate defence for small- and medium-sized enterprises (SMEs), especially those actively adopting new technologies. We reviewed that a dynamic IT risk-management framework, updated to reflect emerging technological changes, would offer improved security and privacy for SMEs. To evaluate this, we conducted a systematic literature review spanning 2016 to 2021, focusing on IT risk-management research in various application areas. This study revealed that, while established frameworks like NIST have their benefits, they need to be better suited to the unique needs of SMEs due to their high degree of abstractness, vague guidelines, and lack of adaptability to technological advancements. The findings suggest a pressing need to evolve IT risk-management frameworks, particularly by incorporating advanced methods such as system dynamics, machine learning, and technoeconomic and sociotechnological models. These innovative approaches provide a more dynamic, responsive, and holistic approach to risk management, thereby significantly improving the IT security of SMEs. The study’s implications underscore the urgency of developing flexible, dynamic, and technology-informed IT risk-management strategies, offering novel insights into a more practical approach to IT risk management.

Transformasi Digital InsurCo dengan Merancang Pengelolaan Risiko Teknologi Informasi Menggunakan Framework COBIT 2019 IT Risk Management Focus Area

Rapid advancements in Information Technology (IT) play a vital role in fostering innovation within a company. Previous research has successfully identified the significance of IT Governance and Management (ITGM) in the process of Digital Transformation (DT). However, a more comprehensive analysis is needed to understand the role of IT risk management in supporting such changes, particularly through a case study on the insurance company InsurCo. This study employs the Design Science Research (DSR) method, utilizing interview data and the COBIT 2019 IT Risk Management Focus Area framework to design an IT risk management approach that supports InsurCo's DT. Capability assessments, gap analysis, potential improvements, improvement designs, roadmap development, and impact estimation of implementation have been executed on seven ITGM components. InsurCo, being a State-Owned Enterprise, is bound by the regulation PER-2/MBU/03/2023 concerning the Guidelines for Governance and Significant Corporate Activities of State-Owned Enterprises. Additionally, the Financial Services Sector Master Plan 2021-2025 highlights the acceleration of DT. The prioritized ITGM objectives required by InsurCo are derived from three design factor determinations: focus areas, design mechanisms, and ITGM mechanisms concerning DT, resulting in the following prioritized ITGM objectives: APO12 Managed Risk, EDM03 Ensure Risk Optimization, and DSS04 Managed Continuity. There is an estimated average capability increase of 3.57% across these three ITGM objectives. The research outcome presents a recommended design for the seven components of the governance system, aiming to enhance the IT risk management capability index within InsurCo. This study contributes to a deeper understanding of the concept of prioritizing IT risk management to support organizational digital transformation, specifically providing practical implications for InsurCo to bolster the success of their strategic programs, and benefit the insurance industry.

Manajemen Risiko Teknologi Informasi Aplikasi E-Office ASN Menggunakan ISO 31000:2018

In carrying out the task of government affairs at Diskominfosanditik Sumedang Regency, an E-Government system is implemented, namely the ASN E-Office application which is a website-based and mobile-based application with a minimum specification of Android 4 which is used by all ASN (State Civil Apparatus) consisting of PNS (Civil Servants) and PPPK (Government Employees with Work Agreements) in Sumedang Regency. With this application, there may be threats and attacks including vulnerabilities that pose a risk, which disrupt the process of using the application. Therefore, the researcher decided to conduct information technology risk management research as a handling and protection of the application by applying the risk management process from ISO 31000:2018 where any information needed in this research was obtained from internal sources at Diskominfosanditik Sumedang Regency. This research was conducted in the informatics section and resulted in 14 possible risks consisting of 3 risks with high levels, 2 risks with medium levels, and 9 risks with low levels. From the GAP measurement, there is a difference that the need for risk measurement as the first step for risk management.

Capability Assessment of IT Governance Using the 2019 COBIT Framework for the IT Business Consultant Industry

Most Indonesian businesses need help with business alignment with information technology. COBIT is one of the frameworks controlled by IT Governance. COBIT 2019, the most recent COBIT framework, assesses information technology governance and capability levels at PT Kwadran Lima, Indonesia. Capability is measured by interviews regarding COBIT operations using a specified process domain. The COBIT Design Toolkit was used to establish the process domains. The process domains acquired were APO12-Managed Risk, BAI10-Managed Configuration, and DSS03-Managed Problem. These three domains solve challenges at PT Kwadran Lima in Indonesia. The process domain was assessed through interviews using the RACI Chart. Following the collection of measurement results, suggestions are made based on the findings of the evaluation results. According to the findings, PT Kwadran Lima Indonesia is still at level 2 to reach level 3. As a result, a proposal is made to develop or design a team whose tasks and responsibilities are to plan and execute ways of collecting categorization and associated data analysis of Information Technology risk for the Company to achieve level 3.

Context-Based and Adaptive Cybersecurity Risk Management Framework

Currently, organizations are faced with a variety of cyber-threats and are possibly challenged by a wide range of cyber-attacks of varying frequency, complexity, and impact. However, they can do something to prevent, or at least mitigate, these cyber-attacks by first understanding and addressing their common problems regarding cybersecurity culture, developing a cyber-risk management plan, and devising a more proactive and collaborative approach that is suitable according to their organization context. To this end, firstly various enterprise, Information Technology (IT), and cybersecurity risk management frameworks are thoroughly reviewed along with their advantages and limitations. Then, we propose a proactive cybersecurity risk management framework that is simple and dynamic, and that adapts according to the current threat and technology landscapes and organizational context. Finally, performance metrics to evaluate the framework are proposed.

Information Technology Risk Management in Educational Institutions Using ISO 31000 Framework

As information technology becomes increasingly integrated into daily business processes within educational institutions in Indonesia, the need to address potential risks associated with this integration has become crucial. This research focuses on analyzing information technology risk management in Indonesian educational institutions using the ISO 31000 framework. The study aims to minimize the occurrence and impact of various information technology risks that can disrupt organizational processes. Through a comprehensive examination encompassing risk assessment, analysis, evaluation, and treatment, this research provides valuable insights into identifying potential risks within educational institutions. Furthermore, the findings serve as a reference for formulating risk management policies, enabling institutions to proactively mitigate the possibility of information technology risks and their future impact. By adopting the ISO 31000 framework, educational institutions can enhance their efficiency, effectiveness, and accessibility while safeguarding against potential disruptions.

Managing Information Technology Risks to Achieve Business Goals: A Case of Pharmaceutical Company

Extant literature has shown that sectoral characteristics play a critical role in business value creation through information technology (IT). Therefore, managing IT and its associated risks needs to consider specific industrial traits to understand the distinct business nature and regulations that shape IT-enabled business value creation. This study presents an in-depth analysis of business goals, IT processes, and IT risks in the case of a pharmaceutical company through which appropriate controls are designed to ensure business value creation through IT. Drawing on a case study of a pharmaceutical company in Indonesia, we found that managing IT risks in the pharmaceutical industry entails two main objectives: 1) ensuring compliance with external laws and regulations as well as internal policies, 2) supporting the optimization of business functions, processes, and costs. Throughout one year of engagement during the project, this study identified ten risks associated with the operation of business processes. Risks are dominated by moderate levels given the current state of controls and appetite, most of which emerge from the company’s existing internal processes. Internal actors are involved in all risks, with most events occurring due to laws and regulations. Further, the study designs and elaborates IT risk controls by drawing from COBIT 5 Seven Enablers. Overall, IT risk management through cascading processes of analysis ensures the alignment of IT risk controls with achieving business goals in the pharmaceutical industry.

Small and Medium Businesses Readiness towards Cyberattacks in Saudi Arabia

While large companies have the capability and resources to protect their systems from the increasing number of cyberattacks, little is known regarding the recent cybersecurity preparedness of Small and Medium Businesses (SMBs). The purpose of this study is to examine the factors that impact the SMB's readiness towards cyberattacks, this research used the identified constructs, the SMB's readiness toward cyberattacks, government regulations and support, cyberattacks, awareness of cybersecurity-threat, and information technology risk management that were established in prior research. The findings demonstrated an overall good model. In addition, the results showed that government regulations and support, awareness of cybersecurity-Threat, and information technology risk management have a significant impact on the SMB's readiness toward cyberattack. Furthermore, government regulations and support have a significant impact on cyberattacks and awareness of cybersecurity-threat. These findings can be used to facilitate future studies and improve the existing understanding of how SMBs can be prepared to reduce the incidence and effect of cyberattacks.

Food supply chain risk of community group buying in the post-epidemic era

Due to the outbreak of COVID-19 at the beginning of 2020, community group buying is booming again, but at the same time, it will bring new risks. Combining with the characteristics of food quality and community group purchase management, from food procurement, supply, distribution, sales link of food supply chain risk is analyzed, by using analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method in the food supply chain risk factors, the result shows that in the community group to the importance of the food supply chain risk for commodity procurement risk > External environmental risk > Logistics distribution risk > Information Technology Risk >Mission risk, By analyzing these five risks, preventive measures are provided for food supply chain risk management in community group buying.

Digitalization and sustainability: A systematic literature analysis of ICT for Sustainability research

Close scrutiny of the ICT for Sustainability conference proceedings on digitalization and sustainability reveals a bias on (technological) efficiency solutions. This bias is mirrored in blind spots in the public discourse and the political debate. The sustainable transformation of society calls for more comprehensive research ‐ and research funding ‐ to fill the gaps and integrate efficiency, consistency, and sufficiency strategies on the levels of life-cycle, enabling, and structural effects.In order to govern processes of digitalization for the purpose of the common good, it is important to understand the opportunities and risks of information and communications technology (ICT) for a sustainable transformation of society. In this article, we systematically review 215 publications from the ICT for Sustainability (ICT4S) conference corpus in order to investigate the state of debate. We analyze to what extent research covers sustainability implications of ICT, 1. regarding different levels of actions and effects, as well as 2. regarding the three different strategies of sustainability ‐ efficiency, consistency, and sufficiency. We find that ICT4S research has a one-sided focus on digital efficiency improvements and on life-cycle impacts of ICT devices and applications. There is far less research on digitalization’s potential to advance sufficiency-oriented practices, and questions of how to foster digital sustainability transformations at macro- and structural level are only marginally treated. We draw conclusions for funding and science politics.

Internal Auditors’ Perceptions of Information Technology-Related Risks: A Comparison Between General Auditors and Information Technology Auditors

ABSTRACTWith the growing role of information technology (IT), many organizations have incorporated IT governance practices that include keeping executives apprised of IT risks. To perform this function, organizations rely upon their internal audit staff to obtain an independent evaluation of IT risks. Although both general and IT auditors are involved in assessing IT risks, they may not be equally adept at identifying such risks. We draw on the expert versus nonexpert perspective to understand how general and IT auditors perceive IT risks differently. Through a quasi experiment with 70 internal auditors of a financial institution, we found that general auditors perceived IT risks to be lower than their IT audit colleagues. We also found that personal IT risk preferences influenced the level of IT risks that general auditors perceived. Personal IT risk preferences did not affect the risk perceptions of IT auditors. Implications for both research and practice are discussed.

콜드체인 물류시스템 운용 중소수출기업의 공급망 리스크 관리가 해운물류 효율성에 미치는 영향에 관한 연구

Recently, the size of the global cold chain market is growing. Therefore, the cold chain has increased management risks. The purpose of this study is to identify potential supply chain risk factors that could emerge during the operation of the cold chain logistics system for small and medium-sized export businesses. Additionally, we attempted to comprehend how risk management affected the effectiveness of logistics and shipping.
 Structured questionnaires were distributed from October 11, 2022, to October 28, 2022, focused on lists of randomly chosen member organizations, including the Korea International Trade Association, the Korea Fisheries Trade Association, the Korea Pharmaceutical Bio Association, the Korea Trade-Investment Promotion Agency, and the Korea Small and Medium Business Association. As for the survey method, about 225 copies were collected by distributing Google questionnaires online, and a total of 202 copies were used for empirical analysis, excluding 23 insincere copies. For empirical analysis, the Smart PLS statistical package was used to evaluate external measurement models, internal structural model evaluation, and structural equation modeling, focusing on conceptual research models.
 The results of this study are as follows. Among risk factors, low temperature maintenance risk had a negative (-) effect on cold chain risk management, and transportation environment risk and information technology risk had a significant positive (+) effect on cold chain risk management. And risk management was found to have an effect on responsiveness and flexibility in shipping and logistics. This study supplements the contents of previous studies on the risks that small and medium-sized export companies with limited human and financial resources may encounter in the process of operating a cold chain logistics system and examines the causal relationship that related risk management has on shipping logistics efficiency.

Modeling perceived information technology (IT) risk as a third-order latent construct and its effect on satisfaction

ABSTRACT Mobile phones have become helpful travel companions to backpackers – supporting decision-making and enhancing their overall travel experiences meanwhile, associated with using smartphones are risk concerns that affect the experiences of users. However, the theorization of perceived risk (PR) toward IT in tourism has been mainly understood using first- and second-order modeling perspectives, hence the need for a parsimonious model (i.e., simpler with greater explanatory predictive power). Based on data from 567 backpackers who visited Ghana, PLS-SEM was used to specify PR toward their smartphone usage as a third-order hierarchical latent construct. The study confirmed that modeling PR toward smartphones as a third-order construct is theoretically tenable, with IT and destination risks as underlying factors. The findings also show that PR is a significant predictor of backpackers’ satisfaction with their smartphones during travel and with their travel experience in general. The academic and practical implications of the study are discussed.

Energy-efficient internal audit for IT-risks in municipal facilities and environmental technologies

In this study, the authors analyze the contemporary factors within the external environment that impact the operation of municipal facilities and environmental technology endeavors, provided special emphasis to energy management and sustainability. The main goal of this research is to tailor the internal audit system to accommodate the evolving external landscape in the realm of municipal facilities and environmental technologies, ultimately advancing its efficiency. Employing a blend of analytical and synthetic techniques, along with logical and systematic approaches, the authors combine traditional internal audit methodologies with process-based management in the context of energy-efficient municipal facilities and environmental technologies. Notably, the focus of this investigation centers on addressing IT risks, which are deemed among the most consequential yet under-addressed components within the internal audit system, mainly due to the novelty of this trend in this sector. This study delves into the outcomes of an extensive exploration of IT risks, encompassing their classification and the categorization of information system and information technology risks, all of which are detailed in this article. Additionally, the research introduces a comprehensive methodology for conducting internal audits of IT risks within the sphere of municipal facilities and environmental technologies. Finally, it provides insight into the results of testing and the implementation of this methodology within a substantial municipal facility, shedding light on its practical applicability in this context.

The Effectiveness of Implementing an Information Technology Risk Assessment System in Improving the Perfoemance of the Al-Misk Organization

The Effectiveness of Implementing an Information Technology Risk Assessment System in Improving the Perfoemance of the Al-Misk Organization

IT GOVERNANCE CAPABILITY LEVEL IDENTIFICATION OF COBIT 2019 AT THE RSUP PROF. DR. R.D. KANDOU, MANADO, NORTH SULAWESI

In terms of technology, governance can be implemented effectively and efficiently if it can provide functionality or value that applies to businesses of all sizes and types. IT governance design can help you explore design factors that influence governance and includes a workflow for planning a governance system for your enterprise. Control Objectives for Information and Related Technologies (COBIT) is a framework created by ISACA that contains guidance or guidance documents that may be useful to auditors, users, and management. COBIT is an internationally recognized and applied best practice for information, information technology, and organizational risk which can be used to define information technology to maximize IT control. As it is required to improve IT service, the design of IT governance was conducted at the Central Unit Hospital (RSUP) Prof. Kandou, Manado, North Sulawesi, using the latest version of COBIT, COBIT 2019. The following is an explanation of the priorities of Malayang Hospital. Governance below 25 points is proficiency level 1. The results shows that there are five objectives that becomes main priority (reaching level 4): EDM03, APO12, BAI02, BAI03 and BAI05. These objectives are the ones recommended to be audited. The second tier that may also suggested to be audited are objectives with capability level 3: APO07, APO08, BAI01, BAI07, DSS01, DSS02 and MEA01.Keywords; COBIT 2019, IT Governance, RSUP Prof. Kandou Malalayang

Does IT Matter to Acquisitions? The Impacts of IT Distance on Post-Acquisition Performance

Although researchers have examined the role of dyadic dynamics (i.e., interactions between the acquirer and the target firm) in the success of acquisitions, little attention has been devoted to the role of information technology (IT). In this study, we extend this literature by examining how pre-acquisition IT distance (i.e., the difference between the enterprise IT systems of the two firms that reflects the system incompatibility and resulting costs of system integration) affects the acquirer’s post-acquisition performance. To measure IT distance, we used a word-embedding technique to map each firm’s IT systems portfolio to a low-dimensional embedding space and calculate the distance between the firms in that space. Using data on U.S. firms’ acquisition activities over seven years, we found that IT distance is negatively associated with the acquirer’s post-acquisition performance. Also, the adverse effect of IT distance is stronger for acquisitions motivated by operational synergies, compared to those seeking non-operational synergies. This finding supports our fundamental premise that IT distance disrupts post-acquisition synergy creation, and more so when the combined firm has a greater need for tight integration to create acquisition synergies. This research contributes to the merger and acquisition (M&A) literature in management and IS by introducing a novel concept of IT distance and by theorizing and empirically examining its performance implications in acquisitions. The findings of this study can inform practitioners on how to devise IT strategies in corporate acquisitions to mitigate IT risks and achieve greater post-acquisition performance.

Information Technology Risk Control of University in a Work from Home Situations

The University is one of the educational institutions affected by the COVID-19 pandemic. Most of its activities, which are academic management, human resource management, information technology services, and so on were changed into WFH (Work from Home) supported by information technology. Utilization of information technology in supporting WFH can create various risks and needs to be controlled either preventive, detective, or corrective to minimize the impact. This research will focus on planning for university information technology risk control in working from home conditions by referring to the ISO 31000:2018 standard for risk management processes, COBIT 5 Generic Risk Scenario for defining risk scenarios, and DoD Instruction 8500.2 and NIST SP 800-53 in the identification of risk controls. The resulting solution is in the form of a risk treatment plan. This solution is expected to assist universities in identifying risks related to information technology and planning controls related to the implementation of work-from-home in their environment.

Unified risk analysis in radiation therapy

PurposeThe increasing complexity of new treatment methods as well as the Information Technology (IT) infrastructure within radiotherapy require new methods for risk analysis. This work presents a methodology on how to model the treatment process of radiotherapy in different levels. This subdivision makes it possible to perform workflow-specific risk analysis and to assess the impact of IT risks on the overall treatment workflow. MethodsA Unified Modeling Language (UML) activity diagram is used to model the workflows. The subdivision of the workflows into different levels is done with the help of swim lanes. The model created in this way is exported in an xml-compatible format and stored in a database with the help of a Python program. ResultsBased on an existing risk analysis, the workflows CT Appointment, Glioblastoma Multiforme, and Deep Inspiration Breath Hold (DIBH) were modeled in detail. Part of the analysis are automatically generated workflow-specific risk matrices including risks of medical devices incorporated into a specific workflow. In addition, SQL queries allow to quickly retrieve e.g., the details of the medical device network installed in a department. ConclusionActivity diagrams of UML can be used to model workflows in radiotherapy. Through this, a connection between the different levels of the entire workflow can be established and workflow-specific risk analysis is possible.