ISO 31000‐based integrated risk management process assessment model for IT organizations. Issue 1 (23rd August 2018)

• Record Type: Journal Article
• Authors: Barafort, Béatrix; Mesquida, Antoni‐Lluís; Mas, Antònia
• Other Names: Biró Miklós guestEditor.; Colomo‐Palacios Ricardo guestEditor.; Messnarz Richard guestEditor.
• Is Part Of: Journal of software. Volume 31:Issue 1(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-08-23
• Subjects: integrated risk management -- ISO -- ISO 31000 -- IT organizations -- process assessment model -- process assessment model engineering -- transformation process; Software engineering -- Periodicals; Computer software -- Development -- Periodicals; Software maintenance -- Periodicals; 005.1
• DOI: 10.1002/smr.1984
• Languages: English
• ISSNs: 2047-7473

Abstract

Abstract: Governance, Risk management, and Compliance activities are key challenges faced by organizations. Process Models and Capability Process Assessments are governance instruments that can help organization in assessing and improving their processes. Several ISO standards propose process models for Management System Standards based on ISO 9001, ISO/IEC 20000‐1, and ISO/IEC 27001, and for project management with ISO 21500. The ISO 31000 standard provides guidance for Risk management with a process approach and systemic perspective. This paper presents an ISO 31000‐based Integrated Risk Management Process Assessment Model (PAM) for IT organizations enabling to integrate on an easy way several ISO process‐oriented standards which are often targeted by IT organizations. This PAM integrates risk management dimensions with ISO 9001, ISO 21500, ISO/IEC 20000‐1, and ISO/IEC 27001. It offers a centralized and integrated risk management approach which provides the basis to improve, coordinate, and interoperate risk management activities. Abstract : Governance, risk management, and compliance activities are key challenges faced by organizations. The ISO 31000 standard provides guidance for risk management with a process approach and systemic perspective. This paper presents an ISO 31000‐based Integrated Risk Management Process Assessment Model (PAM) for IT organizations enabling to integrate on an easy way risk management dimensions with ISO 9001, ISO 21500, ISO/IEC 20000‐1, and ISO/IEC 27001. This PAM provides the basis to improve, coordinate, and interoperate risk management activities.