IT Risk Management

I bought a book couple days ago "IT Risk - turning business threat into
competitive advantage". Mainly it talks about how to manage IT Risk /
Risk Management on IT based on extensive survey-interview-research
performs by some of the professors in MIT. Interesting book, although a
little bit too technical and theoritical. Some of the interesting point
of view is regarding the classification on users needs (the term on this
books is 4A Framework) :

1. Availability - how to keep the systems (and their business processes)
running, and recover from interruptions.

2. Access - ensure appropriate access to data and systems so that the
right people have the access they need and the wrong people don't.

3. Accuracy - provide correct, timely and complete information that
meets the requirements of management, staff, customers, suppliers and
regulators.

4. Agility - possess the capability to change with managed cost and
speed

Interesting classification, although it's quite common but it give us a
framework to think. The book said that one among the 4 aspect must be
more important to your business compare to the other. For example for
banking perhaps accuracy is the first priority. This priority will give
you the focus required to managed the risk. Since if you want to managed
all together then your system will be too complex. Too complex that it's
really required - and complexity bring errors. Errors bring another
errors, and it will never stop until your company stop. Complexity also
bring cost, more complexity then you're required then more money then
you actually have to spend.

From this framework this book elaborate more about how we managed the
risk. If you want to know more, just read the book. George Westerman &
Richard Hunter is the writer, and Harvard Business Press is the
publisher. Have a nice reading then.....