Information Risk Management: Aztek Corporation Outsourcing Report

This report provides an overview of information risk management, specifically focusing on the outsourcing of IT functionalities within Aztek Corporation, a financial services business in Australia. The report examines the benefits of outsourcing, such as cost savings and increased efficiency, while also addressing potential risks like data security breaches and the need for robust contractual agreements with third-party vendors. It explores current IT practices, security postures, and the threats and vulnerabilities associated with outsourcing IT services, including network and desktop management. The report also delves into data security concerns, offering insights into how Aztek can mitigate these risks. The analysis highlights the importance of control over offshore operations, negotiation of access privileges, and the need for a comprehensive approach to IT risk management in the context of outsourcing within the financial industry. The report concludes with a discussion on the benefits that Aztek can gain from outsourcing its IT functionalities.

Running head: INFORMATION RISK MANAGEMENT 1
Information risk management
Name:
Institution Affiliation:

INFORMATION RISK MANAGEMENT 2
Executive Summary
The information technology has become an important part of any organization in every industry
of the economy. In this report study it is based on the overview of outsourcing the major
information technology functionality particularly to the 3rd party in Aztek Corporation. This
entity is a business which operate in the financial service industry in Australia. The organization
intends to implement the project on outsourcing of the main information technology functionality
to the third party. Some of the IT functionality they intend to outsource are the network,
management of desktop or the application development to the third party. These aspects when
they outsource from the third party will help the organization to save on the cost of purchasing
their own and be able to compete efficiently with other organizations, along with the reduction of
operational costs. Moreover, this will allow the organization to operate successful when they
outsource their IT functionality to the 3rd party vendors. Aztek outsourcing on these
functionalities would help change on the cost which are varying to the fixed cost for the
operations and they would be able predict and run the organization smoothly. As much as
outsourcing may be beneficial to the organization they may encounter issues related to the
sharing of the data to the third party who might comprise or steal the data if proper mechanism
are not implemented. This usually happen since the vendor has an access to the clients data as
well as other sensitive information that could be related to the business operations.
It is also evident when an organization outsource such information to the third party there would
be issues of auditing aspect to the information security with the project of the outsourcing IT
functionality particularly in the operational procedures in the financial industry. Majority of the
business could fall to formulate an agreement of obligations with the 3rd party vendors during the
process of negotiation. In the event that the system cashes or the data is breached if there is no

INFORMATION RISK MANAGEMENT 3
agreement to address the same the vendors may not take responsibility of these shortcomings
rather than the company that had outsource their services. There is need for Aztek to therefore,
put their offshore operations in control to be able to address on some of these issues. Moreover,
there is need to negotiate about the access privileges. In this report therefore, will examine how
outsourcing of the information technology functionality would benefit Aztek, the current
exposure the company is facing, vulnerabilities, and threats of this project, the issue of the data
security and security issues relating to outsourcing. The report would also provide a brief
overview of the benefits that Aztek would benefit from when they outsource.
Index terms: IT functionality, desktop management.

INFORMATION RISK MANAGEMENT 4
Table of Contents
Introduction...............................................................................................................................................5
Review of the financial service industry..................................................................................................6
Current information technology practices and the security posture review in Aztek organization....8
Benefits and drawbacks associated to outsourcing...............................................................................11
The threats, vulnerabilities and the consequences of assessment.........................................................12
Threats of outsourcing the information technology services................................................................13
Vulnerabilities of outsourcing the information technology services....................................................14
Consequences of the assessment of outsourcing the information technology services........................15
Consequences...................................................................................................................................16
Consequences...................................................................................................................................16
Consequences...................................................................................................................................17
Consequences...................................................................................................................................18
Data security............................................................................................................................................18
Conclusion................................................................................................................................................19
References.................................................................................................................................................21

INFORMATION RISK MANAGEMENT 5
Introduction
The 21st Century has brought about all embracing convergence when of communication,
computing, knowledge as well as information. This will definitely change on the way individual
live, think and even work (Duhamel, Gutiérrez-Martínez, Macias-Figueroa, Luna-Reyes &
Picazo-Vela, 2017). The growth of the high speed networks, which has been coupled to the
decline in the cost of the computing power has made application undreamed in the past. The
changes which the new technologies have brought the financial sector an enormous in their
impact on the employees, as well as the customers (Gobble, 2013). The financial sector has been
gaining a competitive advantage due to the aspect of information technology advancement.
The information technology risk management has been a significant aspect when it comes to the
risk management within a business. The information technology can be able to manage on any
risk which has been associated to the information technology sector such as the desktop,
networking or even perhaps in the computing (Duhamel, Gutiérrez-Martínez, Macias-Figueroa,
Luna-Reyes & Picazo-Vela, 2017). The information technology has been incorporated in the
financial industry over the years. In this report it intends to evaluate the risk management process
which are associated to outsourcing of the key information technology functionalities that is
within Aztek Corporation. Outsourcing will enable them to continue to thrive in the financial
industry in Australia. The organization has a portfolio of various project which they will
implement with the view to automate on their system within their operations (Gobble, 2013).
Some of the outsourcing functionality which they intends to undertake are desktop management
or the application development to the 3rd party along with the networks.

INFORMATION RISK MANAGEMENT 6
Review of the financial service industry
Aztek organization is a well-known business that operate the financial industry in Australia. The
organization operates with other organization within the industry and sometimes they are
exposed to many risk which are within the sector. The organization ensures that their reputation
as well as integrity is maintained at all time within the various departments in the business
(Willcocks & Lacity, 2016). Over the years the organization has been encountering stiff
competition from the other financial firms which has made them lose a few clients to the
competitors. The stiff competition which has been exhibited within the business has made them
to change on their operating process. The information technology has been one of the vital
technologies in the financial industry which make the business to automate on their processes. In
the Australian sector it has encountered various information technology system to which have
aided in the delivery of the information, as well as management of the inventory (Willcocks &
Lacity, 2016). When Aztek organization outsource their critical information technology
functions it would help them in the establishment of the wide client base.
If Aztek organization adopt the information technology application in their business process they
would be able to improve on their services to the customer and meets on their every needs. There
are many corporations especially in the financial sector in Australia which have outsourced their
information technology functionality from the 3rd party (Willcocks & Lacity, 2016). This has
helped them to diversify on the processes in the business consequently high profit margins.
When a business achieves high profits they are able to reduce on their complexity level along
with the dependence to the interest which has accrued over the years from their operations.
There has been great success to the financial sector in Australia, and the key for their survival
has been the customer service. The loyalty of the customers has been determined through

INFORMATION RISK MANAGEMENT 7
convenient as well as innovative delivery of the personal services. When Aztek organization
adopt the IT functionality it would likely increase their values of the products from the savings
they have had to the fixed deposits (Willcocks & Lacity, 2016). Moreover, this would also result
to the improved annual product values to product which are of high value. The information
technology can make their services more flexible, which creates new business clientele.
When Aztek outsource on some of their business processes they will be able to provide
exceptional services especially introduction of e-payments methods which would enable them
retain their existing clientele and be able to gain a significant number also (Mehan, 2008). This is
a benefit to the organization since the clients usually want a one stop shop where they can access
all the services and make payment to their convenience or at their own comfort. Outsourcing of
the business functionality would lead to improvement of the quality of the services provided
which would likely lead to formulation of the service culture within the business (Mercuri &
Neumann, 2011). Moreover, it would contribute to achievement of the fast service delivery
particularly in the sections of documentations for instance in billing (Willcocks & Lacity, 2016).
The use of the information technology makes it possible to handle the queries of the customers
quickly. As much as outsourcing of the IT functionality in the business bring forth some
advantages there are also some challenges which it has brought. Some of the challenges is the
issue of standardization of the products due to the fact that there is high specialized system which
could lead to loss of vital information or even the system could be hacked and the system
retained from the servers. Information technology ensures that the processes within the business
can run without any interference which would enable the business to get high returns when they
deliver the services (Willcocks & Lacity, 2016). Additionally, it is also worth noting that
information technology in the financial sector has led to the development of the process which

INFORMATION RISK MANAGEMENT 8
are automated and they have incorporated high level of security. The information technology has
enabled the business to achieve value for the service they deliver to the clients (Nichols, 2014).
Outsourcing of the major information technology functionality such as networks, and the desktop
management would help in improving of the operational processes for instance development of
the services, integration of the major stakeholders and the process development.
Current information technology practices and the security posture review in Aztek
organization.
When Aztek outsources the information technology functionalities to their processes it help them
achieve numerous benefits considering the organization is one of the leading financial service
provider in Australia. Outsourcing of the IT functionality particularly from the 3rd party is vital
and this needs to be analyzed to be able to maintain security along with the operational processes
running smoothly (Willcocks & Lacity, 2016). Outsourcing IT functionality such as network
could help the business in their development of the network as well as an adaptive process of
communication that is within the workplace which would enable them to monitor of the
performance of each employee (Willcocks & Lacity, 2016). Networking technology would
enable the organization to implement system such as enterprise management planning which has
become a necessity to most of the organization to integrate to their business processes in various
department such as finance, and human resource (Willcocks & Lacity, 2016). The aspect of
outsourcing these functionality would enable the business to identify the best resources to
employ in the business such as skilled workforce, suppliers which would help them achieve
growth rate and be successful in the business (Kim, 2012). The business will be able to outsource
various functions such as shareholders, staff who will operate and maintain the system and
competent staff which will also connect to the management of the service providers (Jung, 2013).

INFORMATION RISK MANAGEMENT 9
In this perspective it would create a high resources which would increase the delivery of the
workflow and consequently high growth rate would be achieved.
Based Prado (2011) has highlighted that outsourcing of the information technology functionality
within the business process can be effective in the effective towards the delivery of quality
services which lead to growth within the business.
When Aztek implement this project of outsourcing the business process it could help solve some
of their current situations which they are encountering such as effective delivery of the services,
or even the management of the personnel (Tibble, 2012). Outsourcing information technology
especially from the third party vendors could be an effective way for an organization to increase
productivity along with profit since they would only pay for what they require most in the
business. The services which will be provided by the third party service provider would help
decrease on the operational cost of Aztek business which would enable them channel some of
their resources towards other sectors within the business which would consequently help increase
on the overall productivity (Tibble, 2012). Moreover, the professionals who will be deployed in
the management of the system would provide training to the employees of the organization on
how their system run, therefore, the cost associated to training of the workers is reduced
significantly. Moreover, the service provider would maintain the security which is essential to
the systems which the organization has implemented (Willcocks & Lacity, 2016). When Aztek
implement this project it will help them in the monitoring of their costs in an improved
perspective. Moreover, the usage of the technology in the business has been found to lower on
the cost of delivery of the services. Aztek adopting the information technology processes could
lower on the labor required in the provision of the services (Willcocks & Lacity, 2016). The
information technology can help in better decision making within a business since the

INFORMATION RISK MANAGEMENT 10
organization is able to analyze their trends and be able to identify the patterns that will be
instrumental in making of those decision. Outsourcing approaches would be important to most of
the processes in the business from the aspect of leveraging on every possibility of gaining
enormously in the operations. Therefore, outsourcing would be vital and it is would provide
strategic benefit inclined to the operations of Aztek (Lacity & Willcocks, 2000). The
organization would be able to outsource on some of their process which were not performing
effectively and this would allow them reap long term benefit in the delivery of the services.
The 3rd party vendor would help maintain the security in the system since in the obligatory
agreement this is one of the requirement which they provide. When an organization outsource
information functionality they will maintain information technology. The providers could aid in
the transformation of the current IT system for the business which uses the valuable assets in
order to tighten on their security (Lacity & Willcocks, 2000). The significant aspect which is
associated with the information technology functionality particularly in the financial industry is
to save workforce long term process of evaluation. The aspect of outsourcing has gone beyond
the initial cost cutting in order to improve the parts of their business. The financial organization
want to concentrate their efforts on what has made them grow in the first place (Magelssen,
Sanchez & Damanpour, 2015). Outsourcing would help to undertake more tactical components
in the business to be able to determine the demand in the market, figuring of the sales strategy or
even determing the best routine for the services and products which are provided to the
consumers.

INFORMATION RISK MANAGEMENT 11
Benefits and drawbacks associated to outsourcing
In the current business world, there are more organization which are starting to look at different
processes of outsourcing which is more than the simple accounting organization do to the books.
Some of the benefits are outlined as below;
Benefits: Improved profits margins:
Due to the phases of outsourcing it is not driven by the aspect of cost which is the cost of doing
it, but rather the benefits which are associated to outsourcing. When an organization outsource it
is able to work at the high level of the efficiency, helps in the elimination of the redundancy as
well as lower on the cost which are associated with doing the business.
There is improvement of the services: When Aztek offload some of their tactical responsibilities
they will focus better towards the improvement as well as continual innovations of the services
they deliver (Lacity & Willcocks, 2000).
There is improved inventory: When a third party vendor manages Aztek functionalities, some of
the process such as purchasing, payments, forecasting of the inventory as well as the supply
partner activities can speed up, which makes sure that the demand and the inventory can match
consistently, which helps to put of the services provided in the hands of the consumers even
faster than they used to previously deliver.
There is improvement in the logistics: Through leveraging on the management tools, the third
party vendors will be able to automate on the workflow of Aztek as well as the business rules to
help get their services to the clients more securely, reliably, cost effectively and much quickly
(Lacity & Willcocks, 2000). If this organization partners with the trusted and a knowledgeable

INFORMATION RISK MANAGEMENT 12
third party vendor they will be able to become more efficient and free up some time to enable
them to be innovative as well as deliver of the services to their clients.
Drawbacks of outsourcing IT functionality.
One of the disadvantage is risk exposing of the confidential data: when an organization
outsources some of their information functionalities they will involve in the risk especially if
they are exposing their data to the third party.
Another disadvantage is that of synchronizing of the deliverables: In the event that one does not
choose the right vendor for outsourcing, there are some common problem which may occur such
as stretching of the delivery time frames, as well as sub-standard quality output (Willcocks &
Cullen, 2013).
Another issue could be hidden costs: Although outsourcing of the IT functionalities could be cost
effective for Aztek Company there may be some hidden costs which are involved especially
during the signing of the contract especially if they have been signed across the international
boundaries (Magelssen, Sanchez & Damanpour, 2015).
Another issue is the lack of customer focus: this could occur when the outsourced vendor may be
providing services to various organization (Shah & Clarke, 2009). In such a situation they may
lack the complete focus to the tasks of the organization which they undertake.
The threats, vulnerabilities and the consequences of assessment.
Outsourcing has been a strategy that an organization contracts to their major functions to the
specialized as well as efficient service providers who can ultimately become a valued asset to the
business (Shah & Clarke, 2009). The development of this innovation has led to huge impacts to
the process of the interaction within the financial industry (Magelssen, Sanchez & Damanpour,

INFORMATION RISK MANAGEMENT 13
2015). Many business within the financial industry including Aztek have encountered many
shortcomings when it comes to the innovations and adopting the technologies in different parts
of their business. Nonetheless, it is also evident to note that information technology has brought
many opportunities especially to the financial industry and it has been helping them to be able to
expand on their services.
Threats of outsourcing the information technology services
The security threats usually affect the business in the financial industry such as Aztek by some of
the risks and vulnerabilities which the business could encounter. Aztek can improve on their
effectiveness of the security of the information technology system through implementation of
various mechanism which are aimed to test, monitor and control the risk which could arise from
the business (Magelssen, Sanchez & Damanpour, 2015). Outsourcing of the information
technology functionality could bring forth many benefits, but it can also cause a lot of risk to
such business which is involved in sensitive data of the customer. Some of the threats which the
organization may encounter would be:
One is the issue of the data confidentiality: Data confidentiality is an important aspect to any
business and it regards to the protection of the confidential or sensitive data from access of
individuals who are not authorized (Gobble, 2013). Aztek organization could face this threat
when they fail to protect their information or even when they loss the data. Moreover, through
outsourcing the information of the business is exposed to third party especially when they
incorporate on their system to the business (Schwalbe, 2014). There may be rogue employees
who would want to sell this information to the competitors which leads to the external attacks.
There is the issue of the system integrity: This relates to the reliability, accuracy as well as the
completeness of the data that the system in the organization are processing, transmitting and

INFORMATION RISK MANAGEMENT 14
storing in their servers (Gobble, 2013). The information should be accurate so that when the
customers view it they would satisfied but when there is outsourcing of the IT functionality there
is likelihood that it may be misrepresented which become a threat to the business.
Another issue is the availability of the system: individuals who access the system which be in
view that the system is of high standards and it maintains confidence to them whereby there is an
online framework to which they are able to rate on its functionality (Prado, 2011). In the event
that the organization is not sure of the eminent quality it thrives from it is could be a security
threat since it may be prone to attacks.
Another aspect is the protection of the customer through ensuring that the clients are protected
well especially by monitoring of the sensitive information of the customers. Aztek organization
may face a threat especially when the data of the clients has been exposed through hacking or
even an attack to the system (Oshri, Henfridsson & Kotlarsky, 2017). This could cause
prominent issue especially when these individuals sues the company for exposing their
information; the image of the company could also be destroyed.
Vulnerabilities of outsourcing the information technology services.
The financial organization some time they may be subjected to the dangers of breach in the
security in their system which could cost them a lot especially if the sensitive data of the client
has been exposed (Rivard & Aubert, 2015). In the case of Aztek Corporation they will
implement system for the management of these vulnerabilities and other risks that would pose
the danger to the business (Oshri, Henfridsson & Kotlarsky, 2017). However, when there is the
issue of information risk it could have devastating effect to the organization. The possible
exploitation could be as a result of the cybercriminals, use of the information technologies which
are outdated and insufficient use of the information technology resources.

INFORMATION RISK MANAGEMENT 15
Consequences of the assessment of outsourcing the information technology services
There are numerous risk which Aztek Corporation may encounter from the implementation of
the project of outsourcing of the information technology functionalities (Oshri, Henfridsson &
Kotlarsky, 2017). To be able to have a process which is effective the organization needs to
follow the following risk procedure for the management;
The assessment of the risk that is likely be encountered by Aztek in the anticipation of the
project is given on the sale of one to eight (Schiesser, 2010). One to two is the lowest level of the
risk, three to five the medium level and six and eight the highest risks. The risk of the
organization are highlighted as below;
1. Data confidentiality.
Probability of risk occurrence Very high
Effect Very high
Vulnerabilities
 There could be insufficient standards
to implement the outsourcing IT
functionality.
 Poor role of divisions and adoption
 Difficulties to measure set obligation
for set obligations
 The ownership of resources become
hard to decide.

INFORMATION RISK MANAGEMENT 16
Consequences  Loss of customer trust.
 There may be loss of the customer
data.
 Poor delivery of service.
Risk High
2. Issue of the system integrity
The analysis of this threat issue is examined as follows.
issue of the system integrity medium
Impact medium
Vulnerabilities
 The system may lack the confidence
of the public
Consequences  There may be lack of trust from
the clients.
 There may be possible loss of the
data of the staff.
 There could be lower levels of
service delivery.
Risk High
3. Issue is the availability of the system

INFORMATION RISK MANAGEMENT 17
Probability of risk occurrence Medium
Impact Very high
Vulnerabilities
The system may not provide confidence to the
customers and employee.
Consequences There could be a possible loss of the data.
Risk Medium
3. Protection of the customers.
This issues has been analyzed as follows;
Probability of risk occurring Low
Impact Very high
Vulnerabilities
 Organization may not change their
reputation if it is ruined.
 There could be possible loss of
data if the information of the
clients has been compromised.

INFORMATION RISK MANAGEMENT 18
Consequences  The customer losses data in case
their data is breached.
 There could be bad image of the
organization.
 There could be poor level of
service delivery.
Risk High
Data security
The security issues which are associated with the outsourcing of the information technology
functionalities are as follows;
One of the issue is that the third party to which the services which are outsourced with have an
access to the data for Aztek: When Aztek outsources on their Information functionality, they will
need to provide access to their data to the service provider (Oshri, Henfridsson & Kotlarsky,
2017). This could pose a security risk since the provider may not know the information which is
sensitive in nature.
Data destruction as well as retention: This is one of the major concern to which the financial
institution faces when they outsource some of their functionalities from the third party vendor
(Oshri, Henfridsson & Kotlarsky, 2017). Some of the third party in their agreement to provide
the service it may not incorporate the aspect of what will occur in the event get lost, or on the
retention issue.
Another issue is the sharing of the resources of the computers to the third party: Aztek should
grant permission to the service provider to be able to access their information. These individuals

INFORMATION RISK MANAGEMENT 19
gain entry to the system of the organization to be able to implement on this new system
(Pfleeger, 2003). This could pose a security concern if there are rogue employees within the
organization or if the information is not handled well.
Based on the views in regards to the risks which have been accessed in the research, it is possible
to highlight that if Aztek has wide knowledge of the possible risk which may impact on the
organization in relation to data security, and the migration of the vital information technology
services as well as applications, this organization should be able to fully implement this project
(Pfleeger, 2003). The service provider of the IT functionality it intends to outsource should offer
a good framework model of the services. This will help in the reduction of the risk are associated
to the breach of data or the loss.
Conclusion
Aztek they would likely encounter efficient as well as reliable management solutions when they
implement this project to their organization of outsourcing key IT functionalities. The business
has a high chance when it comes to achieving their objectives as well as expounding on their
services. This research report has been able to analyze information in regards to the IT
functionality of the financial service industry. Further, it has been able to highlights on the
current practices which are implemented in Aztek and the impact it would bring to the business.
The last part of the report has highlighted on the threats, vulnerabilities as well as the
consequences assessment which has been done on the effect of implementing of the project.
There is issue of data security which has also been raised and how the organization intends to
implement their mechanisms to curb any breach of the information. It is therefore, evident, from
the research that information technology could play a major part in the businesses particularly in

INFORMATION RISK MANAGEMENT 20
the financial industry as well as other sectors. However, there are risks which could impact the
business and they need to be safeguarded at all cost.
References
Duhamel, F., Gutiérrez-Martínez, I., Macias-Figueroa, J. E., Luna-Reyes, L. F., & Picazo-Vela,
S. (2017, June). Best Practices in the Management of IT Outsourcing in the Public Sector.
In Proceedings of the 18th Annual International Conference on Digital Government
Research (pp. 596-597). ACM.
Gobble, M. M. (2013). Outsourcing innovation. Research-Technology Management, 56(4), 64-
67.
Jung, H. (2013). Future information communication technology and applications. Dordrecht:
Springer.
Kim, H. (2012). Advances in technology and management. Berlin: Springer.
Lacity, M. C., & Willcocks, L. (2000). Global information technology outsourcing: In search of
business advantage. John Wiley & Sons, Inc..
Magelssen, C., Sanchez, F., & Damanpour, F. (2015, January). Learning from Outsourcing: The
Effects of Outsourcing Strategy on Organizational Efficiency. In Academy of
Management Proceedings (Vol. 2015, No. 1, p. 17468). Academy of Management.
Mehan, J. (2008). CyberWar, CyberTerror, CyberCrime. Ely: IT Governance Pub.

INFORMATION RISK MANAGEMENT 21
Mercuri, R., & Neumann, P. (2011). Inside risks: system integrity revisited. Commun.
ACM, 44(1), 160.
Mosca, J. B., & Bordelon, G. R. (2017). Human Resource Managers Detect Management &
Legal Disadvantages to Outsourcing. Business, Management and Economics Research,
3(2), 8-17.
Nichols, A. (2014). A guide to effective internal management system audits. Ely,
Cambridgeshire, UK: IT Governance Pub.
Oshri, I., Henfridsson, O., & Kotlarsky, J. (2017). Re-representation as work design in
outsourcing. MIS Quarterly.
Pfleeger, C. (2003). Security in computing (3rd ed.). Upper Saddle River, NJ: Prentice Hall PTR.
Prado, E. (2011). Risk analysis in outsourcing of information technology and
communication. JISTEM, 8(3), 605-618.
Rivard, S., & Aubert, B. A. (2015). Information technology outsourcing. Routledge.
Schiesser, R. (2010). IT systems management. Upper Saddle River, NJ: Prentice Hall.
Gobble, M. M. (2013). Outsourcing innovation. Research-Technology Management, 56(4), 64-
67.
Schwalbe, K. (2014). Information technology project management. Boston, MA: Course
Technology.
Shah, M., & Clarke, S. (2009). E-banking management. Hershey, PA: Information Science
Reference.
Tibble, I. (2012). Security de-engineering. Boca Raton, FL: CRC Press.
Willcocks, L., & Cullen, S. (2013). Intelligent IT outsourcing. Routledge.