Proceedings

companies, have developed and tested risk management techniques in order to
mitigate the key risks associated to those industries.
Companies have traditionally focused on the financial risks, but recently, increased
attention was paid to the operational risk and systemic risk mainly due to the
regulators’ concerns. The technology and information security risks are a significant
part of the aforementioned risks. Today economy brings a new spectrum of IT related
risks, such as disclosure of confidential data, non-availability of services negotiated
due to systems downtime, or missed business opportunities caused by a rigid IT
infrastructure. Basically, risk management addresses the IT risks, defined as “the
business risk associated with the use, ownership, operation, involvement, influence
and adoption of IT within an enterprise. IT risks consist of IT related events that could
potentially impact the business.” (ISACA, Implementing and Continually Improving
IT Governance, 2009)
Risk management is a continuous process with two components, identification and
control. It begins with a clear understanding of the company’s appetite for risk, which
drives all the risk mitigation efforts and influences future investments in technology.
Afterwards, it continues with the identification of risks and their impact on assets.
Once identified, risks must be controlled and mitigated by countermeasures to an
acceptable level. Consideration should be given to the residual risk, as well. The
performance of risk mitigation process should be measured and monitored on a
continuous basis.
Control Objectives for Information and related Technology – COBIT is an IT
governance framework which provides a structure for developing control objectives.
The framework is strongly focused on controls and less on execution and support. It
allows managers to overpass the gap between control requirements, technical issues
and business risks, by providing clear policies and good practices for IT controls from
a business perspective. COBIT provides a framework to ensure that IT is aligned with
the business, acts as an enabler for business and its usage maximizes benefits, IT
resources are used responsibly and IT risks are managed appropriately. Furthermore,
it covers security topic in addition to other risks that can occur while using
information systems.
COBIT has been aligned and harmonized with other IT standards and best practices
like COSO ERM Framework, ITIL, ISO/IEC 17799 and SEI Capability Maturity
Model. COBIT is positioned at a high level and acts as an integrator of the different
guidance materials. The framework is focused on what is required to achieve,
meaning adequate management and control of IT, while the more detailed IT
standards and best practices are at a lower level of detail describing how to manage
and control specific IT topics.
COBIT framework map IT activities in a generic process model divided in four
domains which are:
• Plan and Organise
• Acquire and Implement
• Deliver and Support
• Monitor and Evaluate
~ 292 ~