Purpose of the Risk IT Framework

Management of business risk is an essential component of the responsible administration of any enterprise. Almost every business decision requires the executive or manager to balance risk and reward.

The pervasive use of IT can provide significant benefits to an enterprise, but it also involves risk. Due to IT’s importance to the overall business, IT risk should be treated like other key business risks, such as market risk, credit risk and other operational risks, all of which fall under the highest ‘umbrella’ risk category: failure to achieve strategic objectives. While these other risks have long been incorporated into corporate decision-making processes, too many executives tend to relegate IT risk to technical specialists outside the boardroom.

The Risk IT framework explains IT risk and will enable users to:
1. Integrate the management of IT risk into the overall enterprise risk management of the organisation

2. Make well-informed decisions about the extent of the risk, the risk appetite and the risk tolerance of the enterprise

3. Understand how to respond to the risk