I

Management Summary

In organizations are plenty of IS/IT investments to choose from. All of these opportunities compete for the limited resources of the organization. The process of risk management which can be divided into the four phases of Identification, Quantification, Management/Government and Containment helps to analyze possible risks. This is necessary because every forth IS/IT projects fails ¹ , because of non identified risks. The aim of Risk Management is to increase the probability of success of IS/IT investments ² , so that the investments drive to the desired outcome and bene-

fits for the organization. In the following the four steps of risk management will be illustrated with an example of a logistic company which has to decide on two investments. Additionally the role of risk management in strategic planning will be examined.

¹ C.f.: [Pütt2009].

² C.f.: [WaPe2002] p.462.

II

Table of contents

Management  Summary  I

List  of abbreviations.  III

Table of  figures  IV

1  The concept of risk management.  1

1.1  Steps of application  1

1.2  Its role in strategic planning  3

2  Practical Situation.  3

2.1  Phase 1 Risk Identification.  4

2.2  Phase 2 - Risk Quantification.  5

2.3  Phase 3 Risk Management/Government  5

2.4  Conclusion.  6

List  of literature.  7

3  Addendum  9

III

List of abbreviations

IV

Table of  figures  

Figure  1 - Investments comparison  

Figure  2 - Risk Identification of investments.  

Figure  3 Kind of change  

Figure  4 - State of readiness  

Figure  5 - Likely reaction  

Figure  6 - Contextual change  

Figure  7 - Quantification of example  

1

1 The concept of risk management

When it comes to the decision of investing in new developments or significant enhancements in existing IT/IS (Information Technology/ Information System) systems, the expected benefits of the investments have to be established, the costs of the systems have to be justified, the involvement of technology and business changes and the priorities to individual developments across the portfolio have to be allocated. ³ Apart from that one of the main issues of the investment decision in IT/IS systems, is the

assessment of the risk. Risk, which is in the failure oriented definition the negative deviation from expectancy ⁴ , has to be assessed in order to revise the viability of the investment to deliver all of the benefits which were expected ⁵ . The reasons for failure of an investment in IT/IS systems can be divided into five domains. Beside the technical, data and user failure there are organizational failures ⁶ and failure in the business environment which this paper focuses on ⁷ , because they are the factors with the highest risk ⁸ . Organizational failures occur if ISs satisfy the functional needs but do not satisfy the organizational or business needs ⁹ . For example, a storage-IS, which contains the amounts of goods in a

storage, fails to meet the needs of accounting because it does not contain monetary values for the goods. Failures in the business environment result if systems do not assists internal and external business requirements. This lack of support could be ascribed to changing business practices or changes in the business strategy which cause a gap between target state and actual state of the IS/IT portfolio. ¹⁰ These two facts comprise the most potential risk in IS/IT projects. But in most of the projects organizational failures and failures in the business environment are not considered as risky. This is due to the disability to address and identify risks in these categories which could threaten the achievement of the desired outcome. Especially in strategic investments of IS/IT the consequences of failure are significant and the assessment of risks is becoming more difficult. 11

1.1 Steps of application

The process of risk management, which is defined as the systematical handling of risk ¹² , can be divided into four phases: Identification, Quantification, Management/Government and Containment ¹³ .

³ c.f.: [WaPe2002] p.420.

⁴ C.f.: [ScLi2002] p.183.

⁵ C.f.: [WaPe2002] p.455.

⁶ C.f.: [LyHi1987].

⁷ C.f.: [WaPe2002] p.455.

⁸ C.f.: [EwPr1994].

⁹ C.f.: [WaPe2002] p.456.

¹⁰ C.f.: [WaPe2002] p.456.

¹¹ C.f.: [WaPe2002] p.456f.

¹² C.f.: [AhMa2008] p.11.

¹³ C.f.: [Höls2002] p.13; [Schi2001] p.13; [Fais2009] p.4.