Semester 1 IT Risk Management: ABC Fitness Gym Case Study

Desklib provides solved assignments and past papers to help students succeed.

IT RISK MANAGEMENT ASSESSMENT ITEM 3

Executive Summary
ABC is Gym is from 1997 which needs some updation as the Gym not support some new
technologies which can make it possible to provide effective training with more satisfactory
performance. The owner of the gym plans many policies and offers foe the members which can
increase the business of the industry and improve productivity. The owner wants to implement
the IT system which can help the gym in many perspectives. The complete database can be
managed by providing automation in the process and the high level of maintenance is provided
for the costly machines. The IT system will help the Gym to optimized the performance of the
existing system and improve the data handling capacity. The Report contains the Risk
management plan and the methods used for reducing the risk related to the system implemented
in the Gym.

Table of Contents
Introduction......................................................................................................................................4
Risk Assessment..............................................................................................................................4
Issues Faced by the IT System.........................................................................................................5
Risk Mitigation................................................................................................................................6
Risk Management Approach...........................................................................................................7
Risk Protection Mechanism.............................................................................................................8
Identification of Gap........................................................................................................................9
Need for the Improvement...............................................................................................................9
Conclusion.....................................................................................................................................10

Introduction
The ABC Fitness Gym wan to implement the new IT system for increasing the performance and
providing more security for the existing system. The Owner of the gym wants that the system
must support automation technology so the upadtion in the database can be done automatically.
The system also has the capability to manage the scheduling of the machine’s maintenance and
other management of the members. The organization also wants to hire more instructors and
other staff. The IT system will protect the data of all members and the organizational data of the
gym. This system will help the instructors to assign a healthy diet to the members and provide
them other notification related to their training. The Organization also manages to update all the
software and hardware tools so the performance can be improved for the system. Better network
support is provided for the system components and high-speed internet connectivity for all
members. Real Time Monitoring is implemented for the gym so that continues updates are
provided and if any issue occurs then it can be handled accordingly. The report helps to
understand the risks and the solution required for reducing the Risk for a system.
Risk Assessment
The Risk for any system should be detected and should be managed accordingly so that the
system can survive (Aven, 2016). The risks are the possibility for any system where the system
can be failed to provide its basic functionalities due to any fault or any issue. The risk needs to be
reduced to remove so that the organization should not face a big loss. There are several steps
followed in an organization to identify and reduce the risk.
1. Identification - Identify the Risk and cause of the Risk so that the organization can pre-plan
for the risk which helps to prevent the risk at the time of occurrence. The Organization hires
experts for Risk identification of the risk. The Identification process help for decision making for
selecting the appropriate solution which can effectively resolve the issue.
2. Estimating the effect - This process involves the estimation of the members of the element
affected by the issue. The finding of the who is at the risk position or which part of the
organization will be affected. There are different parts in an organization which faces different
effect and understanding the effect can help to take the action for those parts which have to
survive form-critical effect.

3. Assessing the Risk - This part deal with the understanding of the risk effect and how much
harm it can cause the organization. Appropriate actions are taken for each risk. This part help to
handle the risk so that the loss can be minimized.
4. Record maintenance - The records are maintained based on the finding related to the specific
risk assessment. This part includes the type of risk faced by the organization and methods used
for preventing risk. These records are used for further research and decision making.
5. Reviewing the Risk Assessment - The final part is based on the review system where the risk
assessments are provided with the feedback and the review is based on how effectively work is
done. This helps to perform changes in the future if needed.
Issues Faced by the IT System
The IT system provided with different technologies and also the system is provided with network
connectivity with different other networks. The implementation of the IT system in ABC Gym
can generate several threats and issues which includes:
1. Security Issue – The Gym store details about different members and also there is
organizational data stored in the database which needs to be protected from the frauds and
hackers. The proper security should be managed otherwise the organization has to face a big loss
as the organization contains data of multiple members in the gym. Organizational data is also
stored.
2. Failure of Hardware and Software – Any organization or system has the biggest failure of
software and hardware failure which can lead to complete system failure. The machines are work
based on different hardware and software so, if they failed, then the whole working will be
stopped.
3. Malware and Viruses – The System can be attacked by different malware and harmful
viruses as the system is connected with the Internet. The internet contains different devices that
generate many harmful files. There also Hackers who can hack the system using different
hacking activities. The attacks like a phishing attack, SQL injection, etc. affect the system and its
performance.

4. Processing Error and Human Errors – The can be possibilities when users failed to perform
the correct processing steps and create error while working with the IT system. Human error can
cause different issues or changes in the complete data. In Gym, if the worn entry is inserted for
any member then the problem can occur which needs to resolve with the help of higher
authorities.
5. Internal or External Fraud – The IT system can be damaged by the fraud people which can
be internal or external. There are some possibilities that the member of the organization exposed
the sensitive data of the organization.
6. Market Value Loss – The System can face a problem where the value of an organization can
be decreased in the market. This can be happened due to different reasons such as rumors,
unappropriated and unwanted misshaping, Health issues, bad service, etc. The name and fame
need to be maintained in a market that motivates the people involved in the organization.
7. Natural Disasters – The Natural disaster is the activity which is caused by nature and can
result in loss of high financial properties. This type of threat is out of control but can be handled
with smart decisions.
Risk Mitigation
The Risk for any IT system depends upon the many factors among which there are several
factors that can be controlled for reducing the risk. There are several tools available for reducing
the effect of risk. The organization needs to prevent all the issues generated which affect the
system and its working. The Risk Assessment Framework is implemented in the system where
all the risks are pre-analyzed so that it can be resolved before occurring (Rouse, 2019). There are
different university and organization presented their research for reducing the Risk in an
organization such as Operationally Critical Threat, Asset, and Vulnerability Evaluation
(OCTAVE), Control Objectives for Information and Related Technology (COBIT), etc. There
are some Risk Mitigation strategies which is divided into four parts:
Risk Acceptance Strategy - The risk acceptance strategy helps the organization to accept all the
risks and the effect caused by the risk. This strategy is suitable for those organization which does
not focus on the Risk involved in the system (Herrera, 2019). This is less expensive so small

organization uses this method. This can be used for the Gym while accepting the risk related to
the system.
Risk Avoidance Strategy - The Risk Avoidance process is suitable for the medium-range
organization which does not consider the methods for resolving the elements or part which cause
the risk. Risk Avoidance will avoid the big risk which causes serious risk in the system. The
Gym can use those methods which will avoid the risk or the parts which cause the issues.
Risk Limitation Strategy - These are the mainly used strategies that help the organization to
limit in the different areas so that the company does not face any issues related to the IT system
and its performance. The Boundary is set up for the system that will restrict the complete system
for implementing those elements which will cause issues. This strategy is a combination of Risk
Avoidance and Risk Acceptance.
Risk Transference Strategy - The Transference means to transfer something to something. For
the risk in the organization, the risk is transfer to other forms or in the control of others who can
effectively handle it. There are different risk handlers available that handle the risk on the basis
of their level and charges accordingly.
Risk Management Approach
The Risk Management approach can be divided into two parts Quantitative and Quality Risk
Management approach.
Quantitative Risk Management - The Quantitative risk management approach helps the system
to improve the performance of the system on the basis of the objective. The objective of the
system which is mainly affected by the risk is taken into consideration so it can be resolved at the
early stage. The probability distributions are sued for reducing the impact (Bansal, 2019). This
approach is rarely used as it does not have an effective impact on the risk included in the system.
Qualitative Risk Management - Qualitative risk management is used for the identification of
the risk in the system which helps for future analysis. The main focus is to remove the risk in a
system by using the inputs form stake holders. The prioritization of the risk is done so that the
more critical risk can be managed first. This approach is used in most of the Projects.

Risk Protection Mechanism
The risk in any organization can be controlled using different mechanisms and these mechanisms
can be based on Culture, People or Technology.
Risk Protection Mechanisms based on Culture - The organization faces different issues which
include some cultural aspects. The Organization must focus on the different mechanisms which
provide protection over the risk related to the culture. This protection mechanisms also focus on
the detail information related to the risk. The proper understanding of the risk is provided which
helps to predict the effect of any issue. The risk related to those issues can be identified using
different tools. The Risk Protection mechanism based on culture help to provide the appropriate
knowledge for the risk and improving the skills. This mechanism resolves the issue at the basic
level and provides accurate decision making. This Mechanism can improve the understanding of
the risk involved in the Gym industry. There are different issues included in the gym which can
affect the health of the members and reputation of the gym. For better understanding, the
organization can hire experts for reducing the risk in an organization.
Risk Protection Mechanism-based in People - There are different risks related to the people
involved in the system. The gym contains different people such as Instructors, staff, and
members. The gym contains sensitive data and information related to all the people involved so
these data can be misused by any fraud. The fraud can any people involve in the organization.
For issues like this, the organization must implement the Protection mechanism based on the
people. This can be done by selecting a trustworthy person or interview the person accurately.
The Gym industry must hire those people who have a good background and should check all the
information related to them. There should be proper security for protecting the sensitive data
from members or any hackers.
Risk Protection Mechanism based on Technology - Technology is the main concern for the IT
system in an organization. The risk protection mechanisms based on technology will help the
system to improve the performance of whole system. The system manages all the issues related
to the technology implemented in the organization. The ABC Gym uses different machines that
are controlled by the automated system. The risk-based on the technology of the IT system needs
to be maintained otherwise the working of the organization can face serious issues. The

machines also store the data related to all members and the data which is important for the
organization.
Identification of Gap
The implementation of the IT system will improve many parts of the Gym industry and increase
the performance of the system. The organization uses different machinery tools with the software
support that will help the gym to provide effective services for the customers. The old system
doesn’t have such support for providing automation in the working. The new machines are
introduced which make it easy to improve the health condition of the members. The Staff also
server the customers and manages the database. The System has the capability for managing the
data related to the new members. The New IT system has many good features but this system
also generates some issue which can affect the working of the system. The Security of the
database needs to be maintained at a high level as the system can be hacked which will result in
serious loss. The organization must support the privacy of the user details and information
related to their health. There are some changes need to be maintained with the new system. There
should be proper updation about the condition of the software and hardware of the system. With
time, new technologies are introduced and there are many more yet to come. The system must
capable to support new changes in the future. The IT system must support new technologies for
upgrading the system. There are many other features can be provided to the system that will help
to provide a better understanding of the gym. For this, gym also provides tour for new members
before joining so they can see what are the facilities provided by the gym. The Gym contains two
types pf machine one is used for growing muscles which is called Weight Machines and another
type is used for reducing the fat and burning calories which is called Cardiovascular Machines.
These machines need different setup. The Cardiovascular machine work on the Integrated Circuit
System which needs a specific software tool that controls the functionality of the machine. IT
system has the management of risk related to the software or Circuit failure.
Need for the Improvement
The Improvement of the IT system will improve the managing power for the industry and will
help to provide effective service to the users. The Improvement in the IT system will make it
possible to manage all the issues related to system performance and system failure. The System
based on the IT technology will reduce the cost of process handling but there ill be a requirement

for maintaining the system and elements related to it. If the error occurs in the machine or
software, then this can affect the health of people using those machines. Accuracy is important
for these machines. If system is not updated according to the requirements, then dissatisfaction
can occur between the members of the Gym. The data stored for the organization must be
provided with a high level of security otherwise the data can be hacked or misused. Automation
helps to reduce the burden of data usage but also increase the insecurity over the sensitive data.
Improving security will help to protect the data from unauthorized access. Real-time monitoring
is also needed to provide so that any misshaping can be tracked easily and proper decision
making can be performed.
Conclusion
The ABC Gym provided a high level of service for all its members. The different levels of
members are provided with different offers. The effective health training and a healthy diet are
provided for the members so that they can transform their bodies. The Implementation of IT
system increases the working of the Gym. The staff manage all the operations in effective
manner and provide effective solutions. The decision making is performed for handling the risk
in an organization. The different risk related to the IT system is understood in the proposed
report which needs improvement at some level. The system provides optimization in all parts of
Gym but still can be improve ate the level of security and management. The Gap between
different aspects of the IT system is also included in the report whit the understanding he causes
of issues. Risk Management importance is discussed and what are the steps required for process
of risk management. The future work will be based on improving the security aspect and
providing more secure connectivity with the network. The must continue monitoring of the
system. The Optimization for internet connectivity should increase the satisfaction of the
members. The better service should be provided with more efficiency.

References
Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their
foundation. European Journal of Operational Research, 253(1), 1-13.
Bansal, S. (2019). Difference between quantitative and qualitative risk analysis. Retrieved 19
September 2019, from https://www.izenbridge.com/blog/differentiating-quantitative-risk-
analysis-and-qualitative-risk-analysis/
Herrera, M. (2019). Four Types of Risk Mitigation and BCM Governance, Risk and Compliance.
Retrieved 19 September 2019, from https://www.mha-it.com/2013/05/17/four-types-of-risk-
mitigation/
Rouse, M. (2019). What is risk mitigation? - Definition from WhatIs.com. Retrieved 19
September 2019, from https://searchdisasterrecovery.techtarget.com/definition/risk-mitigation