INFORMATION SYSTEMS IN MANAGEMENT V - SGGW

ments. The problem is that these properties are hard to verify and should be
build-in in software system. In some cases the luck of these properties can leads to
system reengineering what may mean the necessity of partially system
reimplementation.
The aims of risk management at the usage phase can be divided into to basic
scopes: the organizational and the technological ones. The technological scope
covers all technical aspects: hardware infrastructure, software systems maintenance
and system operational management (Pańkowska 2001). Its aim is to ensure that
the system is ready-to-use.
The organizational scope concerns of using of this system for achieving the primary
enterprise goals. In case of IT enterprises it is strongly dependent on the organization
and the IS domains (Rogowski & Michalczewski 2005; Zachorowska
2006).
4. BUILDING AN INTEGRATED RISK MANAGEMENT SYSTEM
The risk management should be established and controlled at the level of the
entire organization but it ought to be carried out but every person who takes a decision.
It means that the risk management should be performed by whole organization
in the conscious and organized way. The same rule concerns the risk management
in IT enterprise.
To talk about the truly integrated risk management in case of the IT enterprise
the following conditions must be met:
- all activities must be goal-driven: the basic objective of risk management is
success of the enterprise, so the goals of the enterprise must be well defined
and known to all who take decisions
- the IT enterprises mark out by cross-domain character: there must be used
methods adequate to each domain
- the risk management in all enterprise have to be based on rules common for
whole organization: every exception should be carefully considered and introduced
on the level of the common organizational rules – this ensure the uniformity
of system and comparability of results
- the IT enterprises are long-lasting and divided into few significantly different
phases: the processes of risk management should be performed continuously,
all kinds of risk must be controlled during the whole enterprise periodically or
in response to events
- the risk management must be tailored for a given enterprise based on common
rules: every IT enterprise is unique so it needs an individual approach but it
must be compatible with organizational standards
- everyone who takes a decisions have to have the knowledge about the risks and
methods used in the risk management processes both on the organization and
23