Information and Knowledge Management using ArcGIS ModelBuilder

Mohammad Abooyee Ardakan, Babak Sohrabi and Vahid Saadat
(NIST, 1995). The 2001 publication of NIST handbook defines risk as "the net negative impact of the
exercise of vulnerability, considering both the probability and the impact of occurrence" (NIST, 2001).
Another appropriate definition of risk, related to the computing environment in particular, as stated by
Kailay and Jarratt (1995) is "the potential for damage to a system or associated assets that exists as
the result of a combination of a security threat and vulnerability". The risk exists because of the
combination of threats, vulnerability and asset value. Vulnerability is being a weakness in the security
system that might be exploited to cause loss of or harm to the asset(s) (Pfleeger, 1989) and a threat
being the source or circumstance that has the potential to cause loss or harm (Kailay and Jarratt,
1995; Pfleeger, 1989). Denenberg et al (1974) and Kaplan and Garrick (1981) define project risk as:
project risk = (project uncertainty) * (magnitude of potential loss due to project failure). Boehm (1989)
defines risk impact or risk exposure (RE) as RE= Prob(UO) * Loss(UO) where Prob(UO) is the
probability of an unsatisfactory outcome, and Loss(UO) is the loss to the parties affected if the
outcome is unsatisfactory. Another definition for risk in engineering is: "a combination of the
probability of an undesirable event with the magnitude of each and every foreseeable consequence
(damage to property, loss of money, injury to people, lives lost, and so on)" (Bell, 1989). Risk is often
defined as a measure of probability and severity of adverse effects (Haimes, 1991). The most
common definition of risk is in terms of exposure to specific factors that present a threat to achieving
the expected outcomes of a project. On this basis, risk in IT projects is usually defined as the
probability-weighted impact of an event on a project (Boehm, 1989; Charette, 1989, 1996).
Simplistically, R = P * I where R is the risk exposure attributable to a particular risk factor, P is the
probability the undesirable event will be realized and I is the impact or magnitude of the loss if the
event occurs. Risk exposure is usually measured in dollars or time in commercial projects. This view
of risk was adapted from management theory in the 1980s (March and Shapira, 1987).
Barki et al (2001) have categorized IT projects risks in five dimensions of Technological Newness,
Application Size, Lack of Expertise, Application Complexity and Organizational Environment that
shown in figure 1. These dimensions are used in our research to identify Risk dimensions.
Figure 1: Conceptual model of risk exposure
2.2 IT competency
Since the mid-1980s, as the strategic impact of IT became evident, both researchers and practitioners
have argued that the management of IT and leadership in IT must be a shared endeavor between IT
44