Architecture Risk
IT structures that fail to support operations or projects.
Artificial Intelligence Risks
A special category of risk associated with technologies that learn and self improve.
Asset Management Risk
Failure to control IT assets such as loss of mobile devices.
Audit Risk
The chance that an IT audit will miss things such as security vulnerabilities or legacy risks.
Availability
Downtime of IT services.
Benefit Shortfall
Investments in IT that fail to achieve projected return on investment.
Budget Risk
IT programs, projects or operations teams that go over budget. In many cases, going under budget is considered a positive risk.
Capacity Risk
Capacity management failures such as an overloaded network connection that causes inefficiencies such as process failures.
Change Control
A failure to control change to complex systems including practices such as change management and configuration management.
Compliance Violations
The potential that you will violate laws or regulations.
Contract Risk
A counterparty that fails to meet its contractual obligations to you such as violations of a service level agreement.
Data Loss
Loss of data that can not be restored.
Data Quality
Poor quality data that causes losses due to factors such as process failures, compliance issues or declining customer satisfaction.
Decision Quality
Sub-optimal decision automation or inaccurate decision support information such as analytics.
Design Debt
A low quality design that results in future costs.
Facility Risk
Risks related to facilities such as data centers.
Infrastructure Risk
Failures of basic services such as networks, power and computing resources.
Innovation Risk
A special category of risk associated with experimentation and aggressive rates of change. Typically requires novel approaches to risk management such as designing activities to fail well.
Integration Risk
The potential for integration of organizations, departments, processes, technology or data to fail.
Legacy Technology
Technology that is out of the date to the extent that it is difficult to maintain and at risk of failures.
Operational Risk
The potential for technology failures to disrupt core business processes.
Partner Risk
Risks associated with technology partners such as service providers.
Physical Security
Physical security related to IT such as security at data centers.
Process Risk
The potential for processes to be disrupted by IT failures.
Procurement Risk
Procurement is the purchasing of services, products and resources. It is prone to a number of risks including the chance of fraud, cost and quality issues.
Project Risk
In many cases, IT projects have a high rate of failure due to a number of risk factors such as scope creep, estimation errors and resistance to change.
Quality Risk
Failures of quality assurance and other quality related practices such as service management.
Regulatory Risk
The potential for new information technology related regulations.
Resource Risk
An inability to secure resources such as skilled employees.
Security Threats
Security threats such as malware and hackers.
Security Vulnerabilities
Security vulnerabilities such as weak passwords and poorly designed software.
Single Point Of Failure
A small component of a large system that brings the entire system down when it fails.
Strategy Risk
The risks associated with a particular IT strategy.
Technical Debt
Weak technology implementations that are likely to result in future costs such as a big ball of mud.
Transaction Processing Risk
Failures of transaction processing such as ecommerce purchases.
Vendor Risk
The potential for an IT vendor to fail to meet their obligations to you.
Identification
Technology risks are identified with formal processes that evaluate both vulnerabilities such as legacy technologies and threats such as technical failures. It is also common for all stakeholders of a system or service to be given an opportunity to identify technology risks to your organization. This can be managed with a series of risk workshops or interviews. Once identified, risks are recorded in a risk register with estimates of their probability and impact. The following are basic technology risk identification processes.Asset Inventory | Identify all technology assets within an organization. This can include indicators of their health such as whether they are still supported by vendors. |
Threat Analysis | The process of identifying threats such as cybersecurity threats, technical failures, human error and bugs. |
Vulnerability Assessment | Identify weaknesses in platforms, systems, networks, processes, applications and assets including external elements such as cloud platforms and network providers. |
Regulatory Risk Assessment | Identify the impact of upcoming or potential regulations. |
Compliance Risk Assessment | The risk of compliance violations such as inadequate controls, lack of documentation or incidents. |
System Risk Assessments | Identify vulnerabilities and threats at the system level. This engages the people who know the system best at the architectural, implementation and user levels. |
Process Risk Assessments | Identify risks to end-to-end processes including technology risks to business processes and risks to technology operations processes themselves. |
Data Risk Assessments | Identifying data assets and risks related to data availability, data security, data quality, data compliance, data maintenance and data management. |
Third-Party Risk Assessments | Create an inventory of all third-party vendors, suppliers and service providers. Identify risks for each including cybersecurity risks, data privacy risks, compliance risks, operational risks and reputational risks. |
Business Continuity Planning | Identifying the risks associated with major adverse events such as natural disasters, major technological disruptions or political instability. |
Emerging Threat Identification | The process of continually monitoring the threat landscape. Particularly important for cybersecurity. |