Risk Management Information System Research Articles

Managing the Risks of Risk Management

Enterprise Risk Management (ERM) is a field of enormous importance due to its economic repercussion. More and more companies are paying attention to it, given there is significant economic savings for attending to the various aspects of risk. At the same time, ERM has witnessed a shift in the way firms manage the many uncertainties that stand in the way of achieving their strategic, operational and financial objectives. Nevertheless, existing Risk Management Systems (RMIS) are neither powerful, nor flexible enough to model the complexity of the risk management process. In this paper we will examine these issues in greater detail, explaining the existing problem and proposing a software system that addresses them. We will also show the actual design and operation of ARMISTICE (Advanced Risk Management Information System: Tracking Insurances, Claims and Exposures), a successful RMIS case study.

Information systems security and human behaviour

Until recently, most of the effort for providing security in information systems has been focused on technology. However, it turned out during the last years that human factors have played a central role. Therefore, to ensure appropriate security in contemporary information systems, it is necessary to address not only technology-related issues, but also human behaviour and organisation-related issues that are usually embodied in security policies. This paper presents a template model, which is intended to support risk management for information systems, and which is concentrated on human factors. The model is based on business dynamics that provide the means for qualitative and quantitative treatment of the above-mentioned issues.

Formulating information systems risk management strategies through cultural theory

PurposeThe purpose of this paper is to examine the potential of cultural theory as a tool for identifying patterns in the stakeholders' perception of risk and its effect on information system (IS) risk management.Design/methodology/approachRisk management involves a number of human activities which are based on the way the various stakeholders perceive risk associated with IS assets. Cultural theory claims that risk perception within social groups and structures is predictable according to group and individual worldviews; therefore this paper examines the implications of cultural theory on IS risk management as a means for security experts to manage stakeholders perceptions.FindingsA basic theoretical element of cultural theory is the grid/group typology, where four cultural groups with differentiating worldviews are identified. This paper presents how these worldviews affect the process of IS risk management and suggests key issues to be considered in developing strategies of risk management according to the different perceptions cultural groups have.Research limitations/implicationsThe findings of this research are based on theoretical analysis and are not supported by relevant empirical research. Further research is also required for incorporating the identified key issues into information security management systems (ISMS).Originality/valueIS security management overlooks stakeholders' risk perception; for example, there is no scheme developed to understand and manage the perception of IS stakeholders. This paper proposes some key issues that should be taken into account when developing strategies for addressing the issue of understanding and managing the perception of IS stakeholders.

AgClimate: A climate forecast information system for agricultural risk management in the southeastern USA

Seasonal climate variability plays an important role in the production risks faced by producers. The majority of crop failures in the USA are associated with either a lack or excess of rainfall. Climate forecasts can be used to reduce risks faced by an agricultural enterprise, but simply providing better climate forecasts to potential users is not enough. Climate information only has value when there is a clearly defined adaptive response and a benefit once the content of the information is considered in the decision making process. AgClimate is a response to the need for information and tools on proactive adaptations to seasonal and interannual climate variability forecasts in the southeastern USA. Extension agents, agricultural producers, forest managers, crop consultants, and policy makers may use this decision support system to aid in decision making concerning management adjustments in light of climate forecasts. Adaptations include those that might mitigate potential losses as well those with the potential to produce optimal yields. AgClimate is a web-based climate forecast and information system that was designed and implemented in partnership with the Cooperative State Extension Service. It has two main components: the front-end interface and a set of dynamic tools. The main navigation menu includes the AgClimate tools, climate forecasts, and management options for crops, forestry, pasture, and livestock. It also includes a climate and El Niño section with background information. The tools section contains two applications that allow a user to examine the climate forecast for individual counties based on the ENSO phase and to evaluate yield potentials for certain crops. Applied outlooks for individual agricultural sectors are also provided on a quarterly basis. AgClimate is now operational under the Southeast Climate Consortium and several upgrades are under development and consideration.

石炭資源の開発・利用に係わる環境技術と安全のアジアネットワーク 坑内リスク管理情報システム

Communication in underground is essential for mine safety and the importance is increasing rapidly. JCOAL and CSIRO in Australia are cooperating a research project about underground communication and risk management information system. The aim of the research is to make a revolutionary new mine safety monitoring system that involves a total risk management information system called Nexsys in the center. The new monitoring system intends to include a real time risk profile that indicates safety conditions in underground and decision support system that offer appropriate counter measures to mine operators in case of an accident. To realize these functions a knowledge base about various accidents is very important. Historical various accidents data on gas explosions and spontaneous combustions in Japan have been reviewed and a new accident knowledge base has been developed which includes newly-made three dimensional views of mine structure where the accidents occurred.Ventilation is a key factor for underground mine safety. An abnormal condition in a ventilation network such as a mine fire or roadway collapse is reflected on ventilation airflow rates rapidly. A computer program to locate the abnormal condition in the network using the airflow data from underground through the mine monitoring system was also developed and tested to add a useful tool to the new monitoring system. The details about the method for locating of abnormal condition in the network are described in the paper.

Risk management of real-time earthquake information system for construction filed

Recently, a real-time earthquake information system has been developed for railway companies, education facilities, manufacturing businesses, and in other public and private sectors. The system provides an alarm and various security controls to facilitate a person's safety a few seconds before an earthquake occurrence. The risk mitigation of such a real-time earthquakeinformation system for the construction field is discussed through a questionnaire survey of construction managers. According to the results of the survey, the system is expected to decrease certain risks. We suggest the following points to be important: 1. A discussion for countermeasures until earthquake occurrence is required. 2. The cost-benefit balance of the system is debatable.

A longitudinal study of information system threat categories

Taxonomies of information security threats usually distinguish between accidental and intentional sources of system risk. Security reports have paid a great deal of attention in recent years to the growing problem of hacking and intentional abuse. The prevalence of these reports suggests that hacking has become a more severe problem in relation to other security threats, such as human error. In this paper, we report on research that addresses this question: "How have changes over time in the frequency of hacking and other intentional forms of security threats affected the validity of information systems risk management taxonomies?" We replicate a simple study of the proportions of categories of security threats that was originally completed in 1993. Comparing the results from the replicated study with the results from the original study, we find that the proportions of threat categories have, in contradiction with the popular perception, remained relatively stable over the past decade. These results indicate that human error remains a significant and poorly recognized issue for information systems security. We propose and validate an elaborated taxonomy of information security threats that provides additional insight into human error as a significant source of security risk.

Applying forensic techniques to information system risk management – first steps

Over the past 15 months we have been discussing End-to-End Digital Investigation (EEDI) and how we can use structured approaches to system modeling to help solve security incidents and perform incident post mortems. Our next task is to apply some of these techniques to information security and risk management.

Development of an Inland Marine Transportation Risk Management Information System

Historically, inland marine transportation has been one of the most efficient and reliable modes of commercial freight transportation. However, hazardous material shipments have become more common on inland waterways, creating concerns about the dissemination of shipment information to land-based emergency responders immediately following an incident. Marine transportation accidents have demonstrated that a spill involving hazardous materials near a major urban area can have devastating consequences. For these reasons a prototypical decision support system for inland marine transportation risk management has been developed. The system is designed to support real-time response as well as planning decisions such as risk resource allocation and evaluation of potential response strategies. It can be applied to barge accidents as well as counterterrorism planning activities. The system is based on the integration of geographic information systems (GIS), database management systems, Global Positioning Systems, and the Internet. In the event of an incident, this system enables en route responders to view incident details via an Internet GIS map service. The map service contains data that describe land use, population, and dispersion results for air and surface water at downstream intakes. To illustrate system capability, a recent accident is re-created to show how the response could have been improved with system access. A case study showing planning applications is also provided.

New Developments in Practice I: Risk Management in Information Systems: Problems and Potential

Risk management can be an extremely powerful approach to dealing with the complexities and uncertainties that increasingly surround technological change and its management. Conventionally in information technology (IT) projects, risks have been narrowly defined. Today, with IT becoming integral to a company’s existence, the stakes are considerably higher and broader in scope. However, risk is sometimes seen a negative concept in information systems (IS) organizations because it implies that something could go wrong with an IT project. To understand effective risk management in IS, the authors convened a focus group of senior IS managers from a number of organizations in a variety of industries. The results of this discussion, the managers’ presentations, and a review of the current research on risk management, were integrated and are presented in this paper. The nature of risk, identifying risk in IT initiatives, determining appropriate levels of risk, and dealing with unacceptable types and levels of risk are discussed. The following conclusions were reached. Risk management is a means to an end – whether it is a successful IS project; stable, secure technical

Risk Management and Hospital Information System —Development of Risk Management System for the Quality of Nursing—

Risk Management and Hospital Information System —Development of Risk Management System for the Quality of Nursing—

Information Systems for Risk Management

Risk management information systems are designed to overcome the problem of aggregating data across diverse trading units. The design of an information system depends on the risk measurement methodology that a firm chooses. Inherent in the design of both a risk management information system and a risk measurement methodology is a tradeoff between the accuracy of the resulting measures of risk and the burden of computing them. Technical progress will make this tradeoff more favorable over time, leading firms to implement more accurate methodologies, such as full revaluation of nonlinear positions. The current and likely future improvements in risk management information systems make feasible new ways of collecting aggregate data on firms' risk-taking activities.

Information Systems Risk Management: Key Concepts and Business Processes

Information systems risk management is as a problem area extremely wide, complex and of an interdisciplinary nature, which highlights the importance of having an adequate understanding of the many concepts that are included in the area. Dealing with definitions of those concepts is a somewhat ‘boring’ task, however probably it can be considered to be an important one. In the second part of this article my attempt is to move to perhaps more ‘exciting’ things, namely to highlight the significant importance that business processes and internal controls have in IS risk management.

The Implications of Risk Management Information Systems for the Organization of Financial Firms

Financial dealer firms have invested heavily in recent years to develop information systems for risk measurement. I take it as given that technological progress is likely to continue at a rapid pace, making it less expensive for financial firms to assemble risk information. I look beyond questions of risk measurement methodology to investigate the implications of risk management information systems. By examining several theoretical models of the firm in the presence of asymmetric information, I explore how a financial firm's capital budgeting, incentive compensation, capital structure, and risk management activities are likely to change as it becomes less costly to assemble risk information. I also explore the likely effects of the falling cost of assembling risk information on a financial firm's organizational structure. Two common themes emerge: centralization within the firm and increased disclosure of risk information outside the firm are both likely to increase.

The Implications of Risk Management Information Systems for the Organization of Financial Firms

Financial dealer firms have invested heavily in recent years to develop information systems for risk measurement. I take it as given that technological progress is likely to continue at a rapid pace, making it less expensive for financial firms to assemble risk information. I look beyond questions of risk measurement methodology to investigate the implications of risk management information systems. By examining several theoretical models of the firm in the presence of asymmetric information, I explore how a financial firmâ s capital budgeting, incentive compensation, capital structure, and risk management activities are likely to change as it becomes less costly to assemble risk information. I also explore the likely effects of the falling cost of assembling risk information on a financial firmâ s organizational structure. Two common themes emerge: centralization within the firm and increased disclosure of risk information outside the firm are both likely to increase.

Information Systems for Risk Management

Risk management information systems are designed to overcome the problem of aggregating data across diverse trading units. The design of an information system depends on the risk measurement methodology that a firm chooses. Inherent in the design of both a risk management information system and a risk measurement methodology is a tradeoff between the accuracy of the resulting measures of risk and the burden of computing them. Technical progress will make this tradeoff more favorable over time, leading firms to implement more accurate methodologies, such as full revaluation of nonlinear positions. The current and likely future improvements in risk management information systems make feasible new ways of collecting aggregate data on firms' risk-taking activities.

An Information Architecture For Risk Assessment And Management

As systems become more complex, project managers need a means of accessing risk management experience gained on other projects. To address this need, the authors developed RAMP (Risk Assessment and Management Program), a risk management information system that provides interactive support for identifying, analyzing and sharing risk mitigation experience.

An information architecture for risk assessment and management

As systems become more complex, project managers need a means of accessing risk management experience gained on other projects. To address this need, the authors developed RAMP (Risk Assessment and Management Program), a risk management information system that provides interactive support for identifying, analyzing and sharing risk mitigation experience.

A key issue for ecotoxicity: Environmental risk management information system

A key issue for ecotoxicity: Environmental risk management information system

A Key Issue for Ecotoxicity: Environmental Risk Management Information System

A Key Issue for Ecotoxicity: Environmental Risk Management Information System