scholarly journals Analisis Manajemen Risiko Startup pada Masa Pandemi COVID-19 Menggunakan COBIT® 2019

2021 ◽  
Vol 8 (3) ◽  
pp. 635
Author(s):  
Dio Febrilian Tanjung ◽  
Aulia Oktaviana ◽  
Aris Puji Widodo
Keyword(s):  
Information Technology ◽  
Risk Management ◽  
Qualitative Method ◽  
Business Processes ◽  
Business Continuity ◽  
Business Success ◽  
It Risk Management ◽  
Corporate Business ◽  
A Company ◽  
It Risk

<p>Perkembangan <em>startup </em>berbasis teknologi informasi (TI) semakin meningkat dewasa ini. Sebagai penunjang keberhasilan bisnis perusahaan, TI memiliki risiko yang timbul di berbagai keadaan terutama di era pandemi COVID-19. Salah satu alternatif yang dapat dimanfaatkan untuk mengelola dan menjamin usaha yang lebih kondusif dan kredibel yaitu manajemen risiko yang tepat. Hal ini karena manejemen risiko menjadi hal yang penting pada bisnis dalam meningkatkan keuntungan dan mempertahankan kontinuitas bisnis, terutama dalam kondisi pandemi COVID-19. Pembahasan manajemen risiko TI secara umum sudah cukup banyak, namun penelitian manajemen risiko dalam menghadapi masa pandemi perlu dipertimbangkan. Hal ini dikarenakan pada masa pandemi ini, TI menjadi salah satu kunci agar bisnis dapat bertahan dan memenangkan kompetisi. Selain itu, pandemi COVID-19 termasuk dalam kasus luar biasa yang belum pernah terjadi dalam kurun waktu ratusan tahun, sehingga secara teknis risiko dari pandemi ini termasuk dalam risiko yang tidak terpikirkan sebelumnya oleh perusahaan. Tujuan penelitian ini untuk mengidentifikasi kondisi implementasi manajamen dan ancaman risiko terhadap proses bisnis pada sebuah perusahaan <em>startup </em>terutama di masa pandemi. Penelitian ini menggunakan metode kualitatif dengan mengacu pada COBIT® 2019 fokus domain DSS04 <em>Manage Continuity </em>dengan melakukan observasi awal terhadap kondisi perusahaan dan wawancara terhadap pemangku kepentingan perusahaan. Hasil penelitian menunjukkan bahwa perusahaan telah melakukan penyesuaian terhadap kebutuhan bisnis selama masa pandemi COVID-19 untuk memastikan keberlangsungan bisnis. Namun dalam pelaksanaannya belum ada pengukuran <em>risk management</em> untuk mengontrol apakah manajemen risiko yang dijalankan sudah tepat, sehingga diperlukan penerapan COBIT® 2019 dalam tata kelola bisnis perusahaan.</p><p> </p><p><em><strong>Abstract</strong></em></p><p><em>The development of information technology (IT) based startups is increasing nowadays. To support the company's business success, IT has risks arising from various circumstances, especially in the era of the COVID-19 pandemic. One alternative that can be used to manage and ensure a conducive and credible business is proper risk management. This is because risk management is important for businesses in increasing profits and maintaining business continuity, especially in the conditions of the COVID-19 pandemic. There is a lot of discussion about IT risk management in general, but research on risk management in dealing with the pandemic needs to be considered. This is because during this pandemic, IT is one of the keys for businesses to survive and win the competition. In addition, the COVID-19 pandemic is included in an extraordinary case that has not occurred in hundreds of years, so that technically the risks from this pandemic are included in risks that were not thought of before by the company. The purpose of this study is to identify the conditions of management implementation and risk threats to business processes at a company startup, especially during the pandemic. This study uses a qualitative method with reference to COBIT® 2019 focused on the DSS04 Manage Continuity domain by conducting initial observations of the company's condition and interviews with company stakeholders. The results show that the company has made adjustments to business needs during the COVID-19 pandemic to ensure business continuity. However, in practice there is no risk management measurement to control whether the risk management is carried out properly, so it is necessary to implement COBIT® 2019 in corporate business governance.</em></p><p><em><strong><br /></strong></em></p>

scholarly journals IT RISK IDENTIFICATION PROCESS ANALYSIS / IT RIZIKOS IDENTIFIKAVIMO PROCESO ANALIZĖ

2013 ◽  
Vol 5 (1) ◽  
pp. 46-52
Author(s):  
Rasma Janeliūnienė ◽  
Vida Davidavičienė
Keyword(s):  
Risk Management ◽  
Business Processes ◽  
Process Analysis ◽  
Risk Identification ◽  
Business Success ◽  
Success Factor ◽  
It Risk Management ◽  
Risk Management Process ◽  
Process Risk ◽  
It Risk

Business processes and business success that depends on information technology (IT) is now closely associated with IT risks, which is influenced by growing IT risk management and control needs. It is vitally important to identify, analyse and reduce systemic risk in order to avoid undesirable consequences, such as information loss, data leaks or damage. A critical success factor in this situation is the systematic and continuous IT risk management. This paper aims to analyse one part of the IT risk management process –risk identification. The article invoked the methods of literature analysis, synthesis, comparison, and generalization.Article in Lithuanian Santrauka Išaugusi verslo procesų, kartu ir verslo sėkmės, priklausomybė nuo informacinių technologijų (IT) šiuo metu yra glaudžiai susijusi su IT rizika. Tai daro įtaką augančiam IT rizikos valdymo ir kontrolės poreikiui. Nepaneigtina tai, kad identifikuota, išanalizuota ir sumažinta sistemos rizika leidžia išvengti nepageidaujamų pasekmių, tokių kaip informacijos praradimas, nutekėjimas ar duomenų sugadinimas. Pagrindinis sėkmės veiksnys siekiant užtikrinti organizacijos sėkmę valdant IT yra sistemingas ir tęstinis IT rizikos valdymas. Straipsnyje keliamas tikslas išanalizuoti vieną iš IT rizikos valdymo proceso etapų – rizikų identifikavimą. Straipsnyje pasitelkiami tokie metodai, kaip mokslinės literatūros analizė, sisteminimas, apibendrinimas.

IT Governance and IT Risk Management Principles and Methods for Supporting 'Always-On' Enterprise Information Systems

2010 ◽  
pp. 1-16 ◽  
Author(s):  
Mario Spremic
Keyword(s):  
Risk Management ◽  
Information Systems ◽  
Business Processes ◽  
It Governance ◽  
Enterprise Information ◽  
Enterprise Information Systems ◽  
It Risk Management ◽  
It Audit ◽  
Business Requirements ◽  
It Risk

Most organizations in all sectors of industry, commerce, and government are fundamentally dependent on their information systems (IS) and would quickly cease to function should the technology (preferably information technology–IT) that underpins their activities ever come to halt. The development and governance of proper IT infrastructure may have enormous implications for the operation, structure, and strategy of organizations. IT and IS may contribute towards efficiency, productivity, and competitiveness improvements of both interorganizational and intraorganizational systems. On the other hand, successful organizations manage IT function in much the same way that they manage their other strategic functions and processes. This, in particular, means that they understand and manage risks associated with growing IT opportunities, as well as critical dependence of many business processes on IT and vice-versa. IT risk management issues are not only marginal or ‘technical’ problems but become more and more a ‘business problem.’ Therefore, in this chapter, a corporate IT risk management model is proposed and contemporary frameworks of IT governance and IT audit explained. Also, it is depicted how to model information systems and supporting IT procedures to meet ‘always-on’ requirements that comes from the business. In fact, a number of IT metrics proposed in the chapter support the alignment of IT Governance activities with business requirements towards IT.

scholarly journals IT risk management disclosure in the integrated reports of the top 40 listed companies on the JSE limited

2017 ◽  
Vol 7 (3) ◽  
pp. 27-34
Author(s):  
Ben Marx ◽  
Covanni Du Preez
Keyword(s):  
Information Technology ◽  
Risk Management ◽  
Stock Exchange ◽  
Listed Companies ◽  
It Risk Management ◽  
Annual Basis ◽  
Johannesburg Stock Exchange ◽  
Increase Productivity ◽  
Top 40 ◽  
It Risk

Information Technology (IT) has become an integral part of virtually all modern day organisations. The advent of IT has given rise to numerous benefits which increase productivity and efficiency in the workplace, however, IT also brings with it significant risks that can have an impact on an organisation’s ability to function as a going concern. Organisations, especially those listed on the Johannesburg Stock Exchange (JSE), are required to submit an Integrated Report (IR) on an annual basis in which they indicate how they used the resources at their disposal to create value for the organisation and its stakeholders during the year under review. The IR is also a forward-looking document, as opposed to the traditional, backward-looking reports. The purpose of this paper is to determine to what extent IT Risk and IT Risk Management are disclosed in the IR’s of the Top 40 Listed Companies on the JSE. It further aims to determine whether IT Risks are included as material risk in the entity’s risk statements of the Integrated Report, and whether proper explanations are provided on how the materiality of the risks are determined and dealt with. This is done by means of an empirical study consisting of a content analysis of the IRs of the Top 40 listed companies on the JSE. The results of the analysis indicates that more than half of the companies included IT risk as part of their material risks and outlined appropriate and detailed processes that were followed by the company to manage those IT risks. The findings of the study accordingly support the need for communicating significant risks and the management thereof to stakeholders as part of the integrated nature of governance of entities. However, it is disconcerting that some companies are not doing this, and accordingly are not realising the need for communicating significant matters to their stakeholders and the value that informative and credible reporting will bring to an entity’s Integrated Report.

IT Governance and IT Risk Management Principles and Methods for Supporting ’Always-On’ Enterprise Information Systems

2010 ◽  
pp. 1849-1864
Author(s):  
Mario Spremic
Keyword(s):  
Risk Management ◽  
Information Systems ◽  
Business Processes ◽  
It Governance ◽  
Enterprise Information ◽  
Enterprise Information Systems ◽  
It Risk Management ◽  
It Audit ◽  
Business Requirements ◽  
It Risk

Most organizations in all sectors of industry, commerce, and government are fundamentally dependent on their information systems (IS) and would quickly cease to function should the technology (preferably information technology–IT) that underpins their activities ever come to halt. The development and governance of proper IT infrastructure may have enormous implications for the operation, structure, and strategy of organizations. IT and IS may contribute towards efficiency, productivity, and competitiveness improvements of both interorganizational and intraorganizational systems. On the other hand, successful organizations manage IT function in much the same way that they manage their other strategic functions and processes. This, in particular, means that they understand and manage risks associated with growing IT opportunities, as well as critical dependence of many business processes on IT and vice-versa. IT risk management issues are not only marginal or ‘technical’ problems but become more and more a ‘business problem.’ Therefore, in this chapter, a corporate IT risk management model is proposed and contemporary frameworks of IT governance and IT audit explained. Also, it is depicted how to model information systems and supporting IT procedures to meet ‘always-on’ requirements that comes from the business. In fact, a number of IT metrics proposed in the chapter support the alignment of IT Governance activities with business requirements towards IT.

RISK MANAGEMENT ANALYSIS OF BUS TRANSPORTATION APPLICATION USING COBIT 4.1

JURTEKSI ◽  
2021 ◽  
Vol 7 (2) ◽  
pp. 203-212
Author(s):  
Resad Setyadi ◽  
Handy Nur Prabowo
Keyword(s):  
Information Technology ◽  
Risk Management ◽  
Management Approach ◽  
Transportation Services ◽  
It Risk Management ◽  
Application Service ◽  
Control Objective ◽  
Level 2 ◽  
It Risk ◽  
Bus Transportation

Abstract: The role of information technology in transportation increases, namely in enjoying transportation services. One way to provide the best service for a transportation company to customers is to provide a bus booking application service. One of the companies that offer service applications is a bus transportation application located in Yogyakarta. Because the application system is considered necessary, stakeholders need IT risk management for the bus booking application. The purpose of this research is to analyze the risk management of the bus transportation application. In measuring IT risk management, the author uses the Control Objective for information and Related Technology (COBIT) 4.1 domain Plan and Organize (PO) framework, especially PO9 (Assess and Manage IT risk). The analysis results show that if the bus transportation application is at level 2 in maturity level. It means that the company knows that there are problems that need resolving. Standard risk management in bus transportation applications tends to provide failed access in the progress of its service. The problem is solving individually and not yet at the integrated completion stage. In general, the application management approach needs to improve better management in the field of information technology.            Keywords: COBIT; plan and organize; risk management  Abstrak: Peran teknologi informasi dalam meningkatnya angkutan yaitu dalam menikmati layanan angkutan. Salah satu cara untuk memberikan layanan terbaik bagi perusahaan angkutan kepada pelanggan adalah dengan menyediakan layanan aplikasi pemesanan bus. Salah satu perusahaan yang menawarkan aplikasi jasa adalah aplikasi angkutan bus yang berlokasi di Yogyakarta. Karena sistem aplikasi dirasa perlu, maka stakeholders membutuhkan manajemen risiko TI untuk aplikasi pemesanan bus tersebut. Tujuan dari penelitian ini adalah menganalisis manajemen risiko pada aplikasi angkutan bus. Dalam mengukur manajemen risiko TI, penulis menggunakan framework Control Objective for Information and Related Technology (COBIT) 4.1 domain Plan and Organize (PO), khususnya PO9 (Assessment and Manage IT risk). Hasil analisis menunjukkan bahwa penerapan angkutan bus berada pada level 2 pada tingkat kematangan. Artinya perusahaan mengetahui bahwa ada masalah yang perlu diselesaikan. Manajemen resiko standar dalam aplikasi transportasi bus cenderung memberikan akses yang gagal dalam kemajuan layanannya. Masalahnya diselesaikan secara individu dan belum pada tahap penyelesaian terintegrasi. Secara umum, pendekatan manajemen aplikasi perlu meningkatkan manajemen yang lebih baik di bidang teknologi informasi. Kata kunci: COBIT; plan and organize; risk management

Board and Management-Level Factors Affecting the Maturity of IT Risk Management Practices

2018 ◽  
Vol 33 (3) ◽  
pp. 117-135
Author(s):  
Nishani Edirisinghe Vincent ◽  
Julia L. Higgs ◽  
Robert E. Pinsker
Keyword(s):  
Risk Management ◽  
Internal Control ◽  
Management Practices ◽  
Factors Affecting ◽  
Management Level ◽  
It Risk Management ◽  
Top Managers ◽  
Risk Oversight ◽  
The Impact ◽  
It Risk

ABSTRACT The Securities and Exchange Commission's 2009 enhanced proxy disclosure requirements and the updated Committee of Sponsoring Organizations' (COSO) Internal Control Framework have caused organizations to increase their focus on risk management and consider the impact of information technology (IT) in enterprise risk management. Our study examines whether board involvement, board expertise, and top management's risk culture affect the maturity of IT risk management practices (maturity) in firms. We find that board involvement positively influences maturity while top managers' risk-taking behavior is associated with lower maturity. Even though board expertise influences maturity, board involvement is more important in explaining maturity. Maturity is higher in firms where risk oversight lies with a board-level, rather than a management, committee. However, the maturity of ITRM practices does not differ among firms whether risk oversight lies with the overall board, or any other board committee. The findings contribute to an under-researched area in IT governance.

A Step-by-Step Procedural Methodology for Improving an Organization's IT Risk Management System

2018 ◽  
pp. 236-257
Author(s):  
Shanmugapriya Loganathan
Keyword(s):  
Risk Management ◽  
Data Security ◽  
Vital Role ◽  
Transfer System ◽  
Business Systems ◽  
It Risk Management ◽  
It Organization ◽  
Security Network ◽  
Business Cost ◽  
It Risk

Risks in IT are described as a form of threat in context with data security, network transfer, system scheduled processes, critical applications, and business procedures. IT risk management is broadly defined as the process of managing IT risks, and must be executed on a regular basis. It is neither a product nor a purchase, but a policy of an organization implements to protect its business systems. Managing IT risk plays a vital role in administering any business in today's world. Irrespective of the business, deep knowledge of IT risk leads to increased data security, reduced business cost, and greater compliance. This chapter deals with methodologies to improve risk management in an IT organization, their impact, and some examples.

Information Technology Business Continuity

2011 ◽  
pp. 2010-2015
Author(s):  
Vincenzo Morabito ◽  
Gianluigi Viscusi
Keyword(s):  
Information Technology ◽  
Information Systems ◽  
Strategic Management ◽  
Competitive Advantage ◽  
Business Processes ◽  
It Management ◽  
Business Continuity ◽  
Data Quality Management ◽  
Time To Market ◽  
Strategic Value

Continuity could be and should be strategic for the business competitive advantage. Besides natural disaster, from blackout to tsunami, businesses face in daily activities critical challenges in IT management for assuring business continuity; for example, business continuity management results must be strategic, because of the infrastructural, organizational, and information systems changes that are required to assure compliance with regulatory norms (see, e.g., the impact of Basel II norms in financial sector), or must have and maintain a time-to-market advantage (disasters can facilitate competitors in a first mover perspective). Nevertheless, business continuity is at present often synonymous with risk management at the IT level, disaster recovery at the hardware level, or in the best case?at the data management level?with data quality management. These perspectives fail to unveil the strategic value of IT business continuity as a framework assuring alignment of strategy, organization, and systems, allowing a competitive advantage in a dynamic competitive environment. Moreover, even when business continuity, under these perspectives, has become one of the most important issues in IT management, there still appears to be some discrepancy as to the formal definitions of what precisely constitutes a disaster, and there are difficulties in assessing the size of claims in the crises and disaster areas. Taking these issues into account, we propose: (a) an analysis of the different facets of the concept of business continuity, and (b) an integrated framework for strategic management of IT business continuity. To these ends, we move from the finance sector?a sector in which the development of information technology (IT) and information systems (IS) have had a key impact upon competitiveness. Indeed, banking industry IT and IS are considered “production,” not “support” technologies. The evolution of IT and IS has challenged the traditional ways of conducting business within the finance sector. These changes have largely represented improvements to business processes and efficiency but are not without their flaws, in as much as business disruption can occur due to IT and IS sources. The greater complexity of new IT and IS operating environments requires that organizations continually reassess how best they may face changes and exploit these later for organizational advantage. As such, IT and IS have supported massive changes in the ways in which business is conducted with consumers at the retail level. Innovations in direct banking would have been unthinkable without appropriate IS, and merger and acquisition (M&A) initiatives represent the ideal domain to show what value can lead strategic management of IT business continuity. Taking these issues into account, we point out the relevance of continuity for maintaining customers, and time-to-market in complex and evolutionary competitive environments. Due the relevance of IT to maintain a valueadded continuity, our contribution aims to clarify the concept of IT business continuity, providing a framework, exploiting the different facets that it encompasses, and showing the strategic implications to the field of IS&T.

Sign in / Sign up

Export Citation Format

Share Document