RiskM: A multi-perspective modeling method for IT risk assessment

Information Systems Frontiers

Volumn 13, Issue 4, 2011, Pages 595-611

  Strecker, Stefan ^a   Heise, David ^a   Frank, Ulrich ^a  

^a UNIVERSITY OF DUISBURG ESSEN   (Germany)

Author keywords

Design science research; Enterprise modeling; IT risk assessment; Meta modeling

Indexed keywords

APPLICATION SCENARIO; CONCEPTUAL MODELING; DESIGN RATIONALE; DESIGN RESEARCH; DESIGN SCIENCE; ENTERPRISE MODELING; IT RISK ASSESSMENT; KEY SUCCESS FACTORS; META MODELING; METHOD EVALUATION; MODELING METHOD; MULTI-PERSPECTIVE; RISK ASSESSMENT METHODS; STAKEHOLDER INVOLVEMENT;

ABSTRACTING; DESIGN; RATING; RESEARCH;

RISK ASSESSMENT;

EID: 80054044473     PISSN: 13873326     EISSN: None     Source Type: Journal    
DOI: 10.1007/s10796-010-9235-3     Document Type: Article

References (52)

1. C Atkinson T Kuehne 2008 Reducing accidental complexity in domain models Software & Systems Modeling 7 3 345 359 10.1007/s10270-007-0061-0
2. K Bandyopadhyay PP Mykytyn K Mykytyn 1999 A framework for integrated risk management in information technology Management Decision 37 5 437 444 10.1108/00251749910274216
3. WJ Boczany 1983 Justifying Office Automation Journal of Systems Management 34 7 15 19
4. C Carnaghan 2006 Business process modeling approaches in the context of process level audit risk assessment: An analysis and comparison International Journal of Accounting Information Systems 7 2 170 204 10.1016/j.accinf.2005.10. 005 (Pubitemid 44004837)
5. V Chavez-Demoulin P Embrechts J Neslehova 2006 Quantitative models for operational risk: Extremes, dependence, and aggregation Journal of Banking & Finance 30 10 2636 2658
6. RT Clemen RL Winkler 1999 Combining Probability Distributions From Experts in Risk Analysis Risk Analysis 19 2 187 203 (Pubitemid 29374646)
7. Crouhy, M., Galai, D., & Mark, R. (2001). Risk management. New York: McGraw-Hill.
8. I Davies P Green M Rosemann M Indulska S Gallo 2006 How do practitioners use conceptual modeling in practice? Data & Knowledge Engineering 58 3 358 380 10.1016/j.datak.2005.07.007 (Pubitemid 43994225)
9. Frank, U. (1994). Multiperspektivische Unternehmensmodellierung: Theoretischer Hintergrund und Entwurf einer objektorientierten Entwicklungsumgebung. München: Oldenbourg.
10. Frank, U. (2006). Towards a Pluralistic Conception of Research Methods in Information Systems Research. Institute for Computer Science and Business Information Systems (ICB), Duisburg-Essen University. ICB Research Report 7.
11. Frank, U. (2008). The MEMO Meta Modelling Language (MML) and Language Architecture. Institute for Computer Science and Business Information Systems (ICB), Duisburg-Essen University. ICB Research Report 24.
12. U Frank C Lange 2007 E-MEMO: a method to support the development of customized electronic commerce systems Information Systems and E-Business Management 5 2 93 116 10.1007/s10257-006-0034-9
13. Frank, U. (1999). Conceptual Modelling as the Core of the Information Systems Discipline-Perspectives and Epistemological Challenges Proceedings of the Fifth Americas Conference on Information Systems (AMCIS 99), Milwaukee, WI. 695-697.
14. Frank, U. (2002). Multi-perspective enterprise modeling (MEMO): Conceptual framework and modeling languages Proceedings of the 35th Annual Hawaii International Conference on System Sciences (HICSS). Honululu, HI, 72-82.
15. Frank, U., Heise, D., Kattenstroth, H., & Schauer, H. (2008). Designing and Utilising Business Indicator Systems within Enterprise Models-Outline of a Method. In Loos P, Nüttgens M, Turowski K, Werth D, eds. Proceedings of the Modellierung betrieblicher Informationssysteme (MobIS 2008), Saarbruecken, Germany, Koellen:89-105.
16. Frank, U., Heise, D., Kattenstroth, H., Ferguson, D., Hadar, E., & Waschke, M. (2009). ITML: A Domain-Specific Modeling Language for Supporting Business Driven IT Management. In Rossi M, Gray J, Sprinkle J, Tolvanen J-P, eds. Proceedings of the 9th Workshop on Domain-Specific Modeling (DSM) at the International Conference on Object Oriented Programming, Systems, Languages and Applications (OOPSLA), Orlando, Florida, USA.
17. A Gemmer 1997 Risk Management: Moving Beyond Process Computer 30 5 33 43 10.1109/2.589908 (Pubitemid 127546510)
18. M Gerber R v Solms 2005 Management of risk in the information age Computers & Security 24 1 16 30 10.1016/j.cose.2004.11.002 (Pubitemid 40415397)
19. AJ Hatfield KW Hipel 2002 Risk and Systems Theory Risk Analysis 22 6 1043 1057 10.1111/1539-6924.00272 (Pubitemid 36034183)
20. FJ Heemstra RJ Kusters 1996 Dealing with risk: a practical approach Journal of Information Technology 11 333 346 10.1057/jit.1996.7
21. Kirchner, L. (2005). Cost Oriented Modelling of IT-Landscapes: Generic Language Concepts of a Domain Specific Language. In Desel J, Frank U, eds. Proceedings of the Proceedings of the Workshop on Enterprise Modelling and Information Systems Architectures (EMISA 2005), 166-179.
22. RL Kliem 2000 Risk Management for Business Process Reengineering Projects Information Systems Management 17 4 71 73 10.1201/1078/43193.17.4.20000901/ 31256.12
23. A Klinke O Renn 2002 A New Approach to Risk Evaluation and Management: Risk-Based, Precaution-Based, and Discourse-Based Strategies Risk Analysis 22 6 1071 1094 10.1111/1539-6924.00274 (Pubitemid 36034185)
24. Lankhorst, M. (2005). Enterprise Architecture at Work: Modelling, Communication and Analysis. Berlin: Springer.
25. KD Loch HH Carr ME Warketin 1992 Threats to Information Systems: Today's Reality, Yesterday's Understanding MIS Quarterly 16 2 173 186 10.2307/249574
26. Lu, R., Sadiq, S., & Governatori, G. (2008). Compliance Aware Business Process Design. In ter Hofstede AHM, Benatallah B, Paik H-Y, eds. Proceedings of the Business Process Management Workshops, Brisbane, Springer:120-131. (Pubitemid 351358247)
27. March, J. G., & Shapira, Z. (1987). Managerial perspectives on risk and risk taking. Management Science, 33(11), 1404-1418.
28. RE McGaughey Jr CA Synder HH Carr 1994 Implementing information technology for competitive advantage: Risk management issue Information & Management 26 5 273 280 10.1016/0378-7206(94)90066-3
29. Mun, J. (2004). Applied risk analysis: Moving beyond uncertainty in business. Hoboken: Wiley.
30. Neiger, D., Curilov, L., zur Muehlen, M., & Rosemann, M. (2006). Integrating Risks in Business Process Models with Value Focused Process Engineering Proceedings of the 2006 European Conference on Information Systems (ECIS 2006), Goteborg, Sweden, June 12-14, 2006.
31. Odell, J. (1998). Power Types. In J. Odell (Ed.), Advanced Object-Oriented Analysis and Design Using UML, (pp. 23-33). Cambridge: Cambridge University Press.
32. RK Rainer CA Synder HH Carr 1991 Risk Analysis for Information Technology Journal of Management Information Systems 8 1 129 147
33. Remenyi, D., Bannister, F., & Money, A. (2007). The Effective Measurement and Management of ICT Costs & Benefits. Oxford: Elsevier.
34. Rogers, S., Lukens, S., Lin, S., & Jon, E. (2008). Balancing Risk and Performance with an Integrated Finance Organization (The Global CFO Study 2008). Somers: IBM Global Business Services.
35. Sadiq, S., Governatori, G., & Namiri, K. (2007). Modeling Control Objectives for Business Process Compliance. In Alonso G, Dadam P, Rosemann M, eds. Business Process Management, Springer:149-164.
36. H Salmela 2008 Analysing business losses caused by information systems risk: a business process analysis approach Journal of Information Technology 23 3 185 202 10.1057/palgrave.jit.2000122
37. Sayer, P., & Wailgum, T. (2008). What You Can Learn about Risk Management from Société Générale. http://www.cio.com/article/336816/What-You-Can-Learn-about-Risk-Management-from- Societe-Generale. Accessed Jan 21, 2009.
38. Schaefer, G. (1988). Functional Analysis of Office Requirements: A Multiperspective Approach. Chichester: Wiley.
39. Scheer, A.-W. (1992). Architecture of Integrated Information Systems: Foundations of Enterprise Modelling. Berlin: Springer.
40. Scheer, A.-W. (1999). ARIS-Business Process Frameworks (3rd ed.). Berlin: Springer.
41. Scheer, A.-W. (2000). ARIS-Business Process Modeling (3rd ed.). Berlin: Springer.
42. Schelp, J., & Winter, R. (2006). Method Engineering: Lessons Learned from Reference Modeling. In Chatterjee S, Hevner A, eds. Proceedings of the First International Conference on Design Science Research in Information Systems and Technology (DESRIST'06), Claremont, CA, 555-575.
43. Sienou, A., Lamine, E., Karduck, P. A., & Pingaud, H. (2007). Conceptual model of risk: towards a risk modeling language. In Weske M, Hacid M-S, Godart C, eds. Proceedings of the Web Information Systems Engineering-WISE 2007 Workshop, Montpellier, France, June 17, 2008, Springer:118-129.
44. Sienou, A., Lamine, E., & Pingaud, H. (2008). A Method for Integrated Management of Process-risk. In Sadiq S, Indulska M, zur Muehlen M, Franch X, Hunt E, Coletta R, eds. Proceedings of the 1st International Workshop on Governance, Risk and Compliance-Applications in Information Systems (GRCIS'08) held in conjunction with the CAiSE'08 Conference, Montpellier, France, June 17, 2008.
45. P Verschuren R Hartog 2005 Evaluation in Design-Oriented Research Quality & Quantity 39 6 733 762 10.1007/s11135-005-3150-6 (Pubitemid 41426168)
46. Y Wand R Weber 2002 Research Commentary: Information Systems and Conceptual Modeling-A Research Agenda Information Systems Research 13 4 363 376 10.1287/isre.13.4.363.69 (Pubitemid 36039702)
47. Y Wand DE Monarchi J Parsons CC Woo 1995 Theoretical foundations for conceptual modelling in information systems development Decision Support Systems 15 4 285 304 10.1016/0167-9236(94)00043-6
48. S Ward C Chapman 2003 Transforming project risk management into project uncertainty management International Journal of Project Management 21 2 97 105 10.1016/S0263-7863(01)00080-1 (Pubitemid 36036624)
49. Weill, P., & Ross, J. W. (2004). IT Governance: How Top Performers Manage IT Decision Rights for Superior Results. Harvard Business School Press
50. Westerman, G., & Hunter, R. (2007). IT Risk: Turning Business Threats into Competitive Advantage. Cambridge: Harvard Business School Press.
51. L Willcocks H Margetts 1994 Risk assessment and information systems European Journal of Information Systems 3 2 127 138 10.1057/ejis.1994.13
52. zur Muehlen, M., & Rosemann, M. (2005). Integrating Risks in Business Process Models Proceedings of the 16th Australasian Conference on Information Systems (ACIS 2005), Sydney, 62-72.