Don't leave risk management to chance

...deal of information collected when assessing these various metrics, and it is important that any measurement of responsiveness takes into account the fact that some individuals will try to circumvent the system wherever possible in order to achieve the key performance indicators that he/she (or the department) is measured on.

Confidentiality is a further area of interest for metrics for the IT department to assess how it is managing any risk. Earlier this year it was alleged that an Indian call centre worker sold UK bank account details to a UK journalist. Thus, the confidentiality of information is vital to all organisations, whether operating solely in one country or utilising offshore services. Attempts to use Web email addresses, e.g. Hotmail or Yahoo, when the corporate email system is fully functional, is a good indication that someone is doing something that they do not want to use the corporate e-mail system for. Following on from this, the unmonitored use of photocopiers can also indicate that an individual is copying confidential organisation information for use outside the company.

Staff monitoring, although understandably unpopular, can also help identify confidentiality issues. There are, of course, laws surrounding this area, but factors such as employees working unscheduled hours at their own discretion, not taking their full entitlement of annual leave, or looking at recruitment Web sites, could present a concern over the confidentiality of organisation information. It is also important to regularly test the awareness of acceptable use policies for email and the Internet amongst employees, to ensure that they are aware of what they can and cannot use company systems for.

The effectiveness of IT can also be used to measure the management of risk in the IT department. A classic example of this is the timeliness of business cycles when compared to IT project cycles — a mismatch, e.g. a project crossing a business cycle, risks being scrapped because the business is taking a different direction or requirements change rapidly. Being aware of business cycles — e.g. around the end of the financial year, when new targets and objectives are set — can help ensure that any IT projects underway around this time can increase their chances of success.

In an IT project requirements management is an ongoing task, and this can be used to assess the management of project risk. The more changes there are, the less chance the project has of being successful — see the business/IT project cycles described already. Changes need to be fed through to developers/testers in a timely manner, as well as feedback from end-users being communicated. Continuing this theme, Project Portfolio Management helps to monitor project delivery and how it matches business need.

Also in the area of effectiveness, politics...