Don't leave risk management to chance

In July this year an article in Butler Group Review looked at IT risk management and the steps that need to be carried out in order to understand the risks that individual IT departments face. Once these initial steps have been completed and there is an ongoing process of risk assessment in the IT department, one can then consider the factors that can be used to assess how well these specific risks are being managed.

In this article I propose a set of key risk indicators under the headings of availability, compliance, confidentiality, effectiveness, efficiency, and integrity. Risk management is an ongoing process, not something that can be addressed once and then forgotten, and these factors will help the IT department understand how successfully it is managing the risks under its control.

The availability of IT systems and equipment is an area of risk and therefore something that can be measured to assess the management of these risks. The availability of systems and equipment covers use by staff, plus third-party users including customers, suppliers, and partners.

Help desk calls can be used for measurement in a number of areas, the first one being the number of calls raised. A large volume of calls in itself will indicate problems — perhaps the organisation's corporate email system has failed, or a new system has been installed without all users being appropriately trained. Furthermore, when considering the volume of calls, response times and resolution times can also be assessed. Most help desk software covers these areas, and the resultant metrics should provide a measure of whether the overall service is improving or getting worse in reliability, responsiveness and time to fix.

The number of help desk calls can also be cross-referenced to user response times for individual applications that are provided and supported by the IT department. This is not only going to be the actual fact — e.g. does the application/service conform to any Service Level Agreement (SLA) — but also how the service is perceived by the end users. An SLA might...