Introduction 

The aim of the report is to provide a risk management details for the organisation Global IT Solutions. In the following sections of the report, there are information about the organisational background, business case, risk identification, risk evaluation, risk analysis, overall risk management proposal, list of risk management documents and reflection of the business. 

Organizational Background 

Global IT solution is a large IT solution provider with the HQ in the Sydney, Australia. The organisation has business units at many other locations within the Australia. There are 5 business units and more than 1000 employees working at those business units. Most of them are IT developers. The organisation provides IT services like software development, consultancy services to small to large enterprises from other industries across the globe. They are reputable in their domain and offers quality services to the clients. Security and privacy are two important requirements for the business. They need to keep sensitive data of their customers for delivering them with the IT services. So, the organisation keeps those information safely (Gibson 2010). 

The organisation has its own cloud computing infrastructure and allows employees BYOD or Bring Your Own Devices at offices. Some of its employees are remote workers. There is a VPN connecting the business units and the remote employees. The private cloud is deployed over the VPN and it allows access to the sensitive and protected company information, client and project details etc. There are the CTO of Chief Technical Officer. Then there are two levels of IT managers. The sensor IT managers are responsible in making strategic decisions,  participation in administrative decision making, communicating between the lower level of IT managers and the CTO. The CTO communicates with the CEO and board of directors. The lower level of management is responsible at operational decision making and communicating with the IT team leaders and the upper level of management. The team leaders communicates with the IT developers and IT staffs. They convey the messages and instructions from the upper levels to the staffs at the lower levels. The IT staffs and developers work under the IT team leaders. When a project comes and it is a large project, it is first allocated to a lower level of IT manager, the IT manager then appoints different team leaders and distributes the tasks of the project. The team leaders then gets their project team mates and it is their job to get the tasks done by the IT staffs and the IT developers. 

The hierarchy given above shows the structure of the organisation. 

Coming to the technological infrastructure, the organisation has support for cutting edge technologies. It has its own data center and some of the data centers subscribed from cloud service vendors. All applications and services are deployed for the clients on the cloud computing infrastructure. There are dedicated PaaS platforms and servers for the application development tasks. 

Information security is an important domain in the business. So, there is a project team formed for the risk analysis of the business from the perspective of information security. The investigation outcomes will be used in an information security audit in the following phases of the project.  

Scope of the Project 

The scope of the project is limited within the IT department of the organisation. It will cover the business operations of the IT department headed by the CTO. And it is focused on the information security infrastructure for the business. The project will assess different aspect of the organisation and its technical infrastructure to gauge the extent of information security solutions deployed in the business. It will help to understand where the business is and what the security loopholes are that are needed to be corrected and to correct the information security issues (Kouns & Minoli 2011). 

Other business operations not related to the IT operations and IT department are out of the scope of the business, so, the report won’t be focused on the profitability of the business and other administrative aspects. 

Objectives 

The primary objectives of the project are, 

• Conducting a detailed risk analysis process for the business covering the IT operations and related operations that can cause some information security issues
• Developing a detailed risk analysis report that will help in information security audit in future. 
• Delivering a long term risk management proposal for the management. Based on the document the policies and procedures may be updated to keep it aligned with the risk management processes. 

Business Case

Feasibility Study 

The feasibility study covers the scope, effort, time and economic feasibility of the project. The schedule of the project is given below. 

Organizational Feasibility 

The senior management is not directly involved in the project. But they have high level of interest and influence on the project. They will be in communication with the project manager and the risk analyst. The lower level of management is directly participating in the project. The success or failure of the project is significantly dependent on the risk analyst (Kouns & Minoli 2011). 

The project will he carried out with the help of in-house staffs, so they all will have commitment to the project. It is also their part of the job. The people who will work in the information security risk analysis project, will not be allocated to other projects of the organization and the clients. The administration needs the project to be carried out with utmost dedication and commitment. 

The project also needs contributions from other stakeholders who are the employees of the organization and from different departments. The administration has instructed all employees to help the project whenever needed. 

Hence, the project has good score for the organizational feasibility. So, it can be undertaken from the organizational point of view. 

Economic Feasibility 

The cost of the project has been calculated as, 

So, the total cost of the project has been calculated as $108,920.00. The project cost will be borne by the project sponsor that is the Global IT Solution. They are the project sponsor and the project owner. 

The final calculation of the project budget is, 

The benefits from the project are, 

The Global IT solution is ready to fund the project. Hence, the project is economically feasible. 

Technical Feasibility 

It is the process of validating the assumptions made on the technological requirements, design, and architecture of the project (Loosemore et al. 2012). The details of the technical feasibility of the project are summarized in the following table. 

So, the project has passed the technical feasibility checklist. It is ready to be undertaken. 

Terms of Reference for the Proposal 

The risk management process will follow a structured approach. The steps are given and described below. 

• At first, there will be the feasibility study. It will help to understand whether, it is feasible to undertake the project or not. Once. The feasibility study is completed successfully, then the project initiation document will be created. The project initiation document must be signed off to kick-start the project (Jordan 2013). 
• Once the project is started, the project manager will be selected and the project team will be created by the project manager and for assisting the project manager.
• Then the risk management architecture will be selected and the risk management planning will be done accordingly. 
• When the risk management architecture is selected, then the risk identification, analysis, and evaluation will be done. 
• Once the risk management project is finished, then the detailed proposal for the risk management process. The proposal will be submitted directly to the system owner and sponsor of the project. 
• Once the proposal is submitted, the company can work on updating their current policies, procedures and business operations to match with the proposal. However, the implementation of the proposal is out of the scope of the report and the project. 

Project Team 

The project will be carried out by an internal project team having ten employees. One lower level IT manager has been appointed as the project manager. He has some background in information system security and have experienced in carrying out such projects for the customers. He is also a part of the information security testing filed that is responsible for checking the information security implementations for the clients (Loosemore et al. 2012). 

The roles and responsibilities of the project team members are given below. 

Risk Management Architecture 

The risk management architecture supports and makes the risk management strategies and policies operational. An organization like the Global IT Solution needs a complete holistic and situational awareness of risks across the processes, operations, and transactions related to the business. As data is an important asset for such organization, so the risk management is seen as a big picture related to the context of the performance and strategies of the organization. 

Modern businesses like the Global IT Solution is a dynamic, distributed, and disrupted business that needs the organization to take some strategic approach towards the risk management architecture. It defines how the processes, technologies and information are being structured to make the risk management process more efficient, agile, and effective across the organization and the related entities. There are three domains of risk management architecture. Those are, 

1. Risk management process architecture 
2. Risk management information architecture 
3. Risk management technology architecture 

The risk management processes can be considered as the subset of the many other business processes. These processes are used to monitor and change the risk environments. The risk environments are ever changing. The risk management process architecture contains some structural design of processes. A process consists of input, output, and many other data processing activities. The architecture also contains various inventories to describe the risk management processes, the interactions and components for each process, and how various processes work together with other processes of the organization (Kouns & Minoli 2011). 

The five common and important processes of the risk management process architecture are, 

• Risk identification process 

Risk identification process is a collection of many processes sharing the common aim to automate a standard and an objective to take appropriate approach to identify the risks related to a project or an organization. To identify risks, it needs to gain understanding of the environment and surroundings that are internal to a business. On the other hand, the external risks are identified by considering the domain in which the business is operating, the business strategies and an understanding of the objectives, short and long terms goals of the business and so on. 

Risk monitoring is an ongoing process. It is used for monitoring risks, business environments, regulatory and so on. One of the purpose of the risk identification process is to uncover the opportunities and the impact of the same on the business processes. There are various external factors that can affect a business and its external set-up. Examples of such risks are, risks related to economic, geo-political, environmental and regulatory (Jordan 2013). Such internal and external risks may lead to failure of an organization. Other potential risks are related to pricing, industry standards, industry development, disruptions, natural disasters, and the availability of commodity and so on. 

The order of the domains of the risk management architecture is very critical. The required information are often determined by the underlying business operations and processes. The types of information required are determined by those processes. It also defines how the information are gathered, used and reported (Loosemore et al. 2012). The combination of information and process architecture defines the requirements of the organization for the technology architecture. Many organizations make mistake by focusing on the technology architecture first and then the process and the information architecture. It leads to selection of a technology for the risk management rather than finding out the best suitable technology that matches with the information and process architecture. 

Risks Identification 

Following risks have been identified for the Global IT Solution are summarised in the following table. The positive risks are the opportunities and the negative risks are the threats. 

Risk Analysis 

The details of the risk analysis have been summarised in the following table. 

Risk Evaluation 

Risk evaluation, and risk treatment details are summarised in the following table. 

Risk Management Proposal 

• Risk assessment 

Once the risks are identified, then it becomes easier to find out the reasons behind the occurrence of the risks and how the risks are affecting the business objectives. There are various techniques like risk analysis, heat map based analysis to identify the possible outcomes of the risks and the impacts from those outcomes. 

• Risk treatment 

Once the risk assessment is completed, then the range of risks, the possible outcomes, the possible reasons etc. are understood. Then the organization must make decisions on how to handle the risks to minimize the effects of the risks. It also requires understanding and identification of the residual risks and how to minimize the harm from the residual risks. These risks are inherent (Wheeler 2011). 

There are various risk treatment available. For example, risk transfer, risk avoidance, and risk mitigation. The goal of any risk treatment is to minimize the value of the risk treatment and the impact of the risks and must help the business to increase the risk tolerance level. 

• Risk monitoring 

An array of processes are there to monitor the performance of the risk treatment process and the overall progress of the risk management process. These are ongoing processes. 

• Risk communication and attentions 

These are also ongoing processes for management, communication, and interactions to the risk owners during the risk management lifecycle. Periodically, many risk conditions get triggered. The process is focused on understanding the triggers and act accordingly. 

List of Risk Management Documents 

• Risk register 
• Risk management proposal 
• Risk management plan 

Reflection 

The report contains the details of an effective risk management process for the Global IT Solution business. It gives a holistic awareness about the business risks. The defined list of risks across the business have been structured in the form of a risk register. It is a live document and updated time to time. It gives accountability of the risks to the business. The information technology architecture helps to monitor, communicate and manage the risks. The report will help to develop a risk culture and policy during the implementation of the risk management proposal. Once it is implemented, it needs to be revised time to time to keep it up-to-date and must be followed. The key risk indicators or the KRIs of the business are to ensure the implementation of suitable risk management policy, the risk appetite of the organisation, tolerance and capacity.  It will also help the business to make risk-intelligent business decisions. When the risk management strategies are integrated with business strategies, then it becomes an integral part of the responsibilities of the business. The risk assessment planning have been carried out for the strategic decision making by the business.  Risk ownership and accountability helps in the establishment of the risk management plan. Each risk must be handled at the process level. All risks must be communicated with the stakeholders. The archived records of the business shows the success of risk management against the risk tolerance and appetite.