IT Risk Management: Analyzing Risks and Management for VIC Govt.

This report provides an in-depth analysis of IT risk management within the context of the VIC government. It begins with an executive summary outlining the importance of risk management in the face of increasing technological advancements and data volumes. The report then presents a diagram illustrating risk factors and management techniques, followed by an explanation of different levels of risk exposure. A key section compares deliberate and accidental threats, ranking them according to their potential impact. The challenges faced by the VIC government in internal and external risk management are explored, along with a distinction between risk and uncertainty. Finally, the report evaluates various risk management methods available to the government, concluding with the significance of robust risk management for safeguarding public information and organizational security. The report emphasizes the importance of proactive measures to mitigate threats and ensure the safety of sensitive data.

Running head: IT RISK MANAGEMENT
IT RISK MANAGEMENT
Name of the Student
Name of the University
Author note

1IT RISK MANAGEMENT
Executive summary
The main objective of this report is to discuss about the risk factors in an organisation dealing
with information technology. Due to the advancement of internet and technology several online
services and online features have been generated and the amount of information is also increased
in a huge amount. Several organisations deal with this information with several computing
system and servers. Many risks are associated with it and can make the system vulnerable for the
users. VIC government has created lots of rules and regulations which are important for the
organisational safety from the possible risk factors. It is concluded that risk management is an
important field for the security of the organisation dealing with public information.

2IT RISK MANAGEMENT
Table of Contents
Introduction......................................................................................................................................3
1. Diagram of risks and risk management of VIC government.......................................................4
2. Explanation of the diagram and identification of different levels of risk exposure....................5
3. Comparison between Deliberate and Accidental Threats and ranking of threats according to
the importance.................................................................................................................................7
4. Explanation of the challenges of VIC government regarding the internal and external risk
management.....................................................................................................................................8
5. Difference between Risk and Uncertainty...................................................................................9
6. Discussion and evaluation of several methods available to the VIC government for risk
management...................................................................................................................................10
Conclusion.....................................................................................................................................11
References......................................................................................................................................13

3IT RISK MANAGEMENT
Introduction
In modern era of internet and information technology the importance of information is
increasing day by day and the amount of risks are also increasing simultaneously. It is very
important to keep the safety of the information related to the information and the organisational
structure. Risks can be classified in many ways according to its nature type of occurrence. To
deal with various kinds of risks different methods are taken to secure the organisational set up.
There are also many differences between the risk and the uncertainties as both can damage the
organisational safety to a large extent (Becken & Hughey, 2013). VIC government has created a
lot of safety regulations which are useful to make the organisation free from risk factors. The
main reasons behind making the standards are to create a strong barrier to the organisational risk.
Risks can be economical, cyber and natural and all these types of risks require different types of
safety precautions (DeAngelo & Stulz, 2015). All the challenges faced by the VIC government
are also discussed in the report.
In this report all the risk factors which bring a bad impact to the organisational safety, are
discussed with proper diagram and also the risk management techniques are discussed. To make
sure about the security of the public data it is important to make the system more advanced in
terms of risk analysis and risk management. Risk management is a new field which is also very
important from the point of view of mitigating the threats and risks and also to overcome the risk
factors. Public data is important from the safety point of view and so risk management is also
important to make sure the security of the information of the system.

4IT RISK MANAGEMENT
1. Diagram of risks and risk management of VIC government
Figure: Risk factors and risk management regarding the VIC government regulation

5IT RISK MANAGEMENT
2. Explanation of the diagram and identification of different levels of risk exposure.
The above diagram gives an idea about the risk analysis and the risk management
technique used in several organizations dealing with information technology (Reason, 2016).
The risk identification and the risk management methods and regulations are discussed as per the
VIC government standards. Risk is considered as the factors which are responsible for making
the system vulnerable. The diagram explains all the aspects of the risk factors (Becken &
Hughey, 2013). It shows different types of risks with examples and also it determines the level of
the risk factors which signifies the possible vulnerabilities caused by a risk factor. The risk
factors can be classified in several ways. The first one is on the basis of the place of occurrence
of the risk factors. Some risks can occur inside organizations and some risks can occur outside of
the organizations. Those risks which take place outside the organization are called the external
risk factors and those risks factors which task place inside the organization are called the internal
risk factors (Bianco at al., 2017). Now the occurrence of the risk factors is also dependent upon
the reasons behind the risk factors. The risk factors can be present due t some natural reasons and
accidental reasons. The risk factors can also be present due to some intentional reasons made by
human practices (Ferguson et al., 2013). Those risks which are taken place due to the attack of
natural reasons are called accidental risks and those risks which are taken intentionally, are
called deliberate risk factors. Hacking, intrusion and damages due to viruses and malware are
called deliberate risk factors. This risk factor can be very harmful for the organizations (Davies,
2014). In case of internal risk factors there are different types of risk factors. Those risk factors
can be of logistic risk factors, corporate risk factors, risk factor related to property management,
housing risk factors and also the financial risk factors (Paton et al., 2014). All these risk factors
are generated due to the internal activities of the organisation. The main reasons behind the

6IT RISK MANAGEMENT
internal risk factors are dependent on the organisational functionality and the motive of the
employees. There are also many factors like the organisational productivity and the type of
service which the organisation operates (Lawrence et al., 2015). It is important to identify the
risk factors which are generated from the organisation. It is also important to find out the reasons
behind the risk factors and also the motive of the employees for which some of the internal risk
factors are generated. The organisation should be stricter in making the organisational stability
and security for stronger bonding of the employees with the organisation. External risk factors
are also important and should be tackled with the help of stronger defence mechanism. The
external risk factors can be of several types. The external risk factors contain risks related to
natural disaster and unwanted technical problems like loss of internet and the loss of electricity.
Main issue related to the external risk is the threat of cyber attack. There are many cases found in
which hackers have stolen lots of data from the database of several organisations dealing with
information technology (Pritchard & PMP, 2014). The external risk factors contain funding,
regulatory investment, reputation, risk related to partnership and the environmental changes
which can make the functionality of the organisation damaged to different extent based on the
level of the risk factors. To overcome all the risk factors and threats the VIC government has
created a set of rules, protocols and regulations. Risk management is an important part of the
functions related to the precautions taken by the organisations (Lam, 2014). In risk management
the main thing is to determine the original problems related to the organisational risk factors and
to determine the required solution in order to overcome the risk factors.

7IT RISK MANAGEMENT
3. Comparison between Deliberate and Accidental Threats and ranking of threats
according to the importance
There are many differences between deliberate and accidental threats. In case of
accidental threats the reasons of the threat may be some natural causes and also the reasons
behind the accidental threats are uncontrollable (Heazle et al., 2013). The reasons behind the
deliberate threats are intentional. In case of the accidental threats no previous option can be taken
and also the main problem cannot be overcome. Natural risk factors like earthquake, storms and
other natural calamities can damage the organisational database to a greater extent. In case of
deliberate threat the risks are created deliberately by human being and also those are created to
steal the information from an organisation (Hopkin et al., 2017). The main factors which are
responsible for the organisational stability is that the security and reliability of the customers. If
the information is lost due to some security breach and data loss then the reliability of people
will be damaged to a greater extent.
There are also some similarities between the deliberate threat and the accidental threat.
The main similarity is that the accidental threat and deliberate threat both are harmful for the
organisation (Howard & Beasley, 2017). Both these threats lead to data loss and the vulnerability
of the system of the organisation.
Those threats which are very dangerous for the organisations are given highest priority
and thus the organisation also follows several methods for overcoming the risks (McNeil, Frey &
Embrechts, 2015). The main advantage of making the system safer is to increase the safety
methods to a greater extent. There are several kinds of risk factors which are given different level
of measures. In case of hacking and data loss the threats are given highest factor (Howes et al.,
2015). The main advantage of making the risk measures is to identify the risks and to take proper

8IT RISK MANAGEMENT
actions with respect to that. Other threats like natural calamities are also given high level as the
power and the data can be loosed any time which can also create data loss. Some hardware
damages are given medium priority with respect to the organisational safety.
4. Explanation of the challenges of VIC government regarding the internal and external
risk management
It is very important to create the sets of regulations for the organisational safety from the
possible risk factors. It is also very important for the VIC government to identify the risk factors
and the threats which can damage the organisational safety (Heazle et al., 2013). It is actually
very challenging for the VIC government to create a perfect set of standards and regulations
which can be helpful in making the organisational system and the database more secure. The
main thing is that the risk factors are not only occurred externally but also it occurs internally
and that is the main fact of tension in which the organisation faces lots of difficulties. Sometimes
the employees of an organisation do not follow the rules which are in fact important in case of
making the organisation more secure (Kettl, 2015). As a result the organisation can face lots of
difficulties regarding the challenges. The external risk factors can be more vulnerable in case of
making the system insecure with respect to the security features. The main reasons behind the
risk factors are to be identified properly. Without identifying the organisation’s issues related to
the risk factors, it is hard to define the problems associated with the risk factors. In case of
internal risk factors there are different types of risk factors. Those risk factors can be of logistic
risk factors, corporate risk factors, risk factor related to property management, housing risk
factors and also the financial risk factors. All these risk factors are generated due to the internal
activities of the organisation (Poniszewska-Marańda, 2014). The main reasons behind the
internal risk factors are dependent on the organisational functionality and the motive of the

9IT RISK MANAGEMENT
employees. There are also many factors like the organisational productivity and the type of
service which the organisation operates. It is important to identify the risk factors which are
generated from the organisation. It is also important to find out the reasons behind the risk
factors and also the motive of the employees for which some of the internal risk factors are
generated (Reason, 2016). The organisation should be stricter in making the organisational
stability and security for stronger bonding of the employees with the organisation. External risk
factors are also important and should be tackled with the help of stronger defence mechanism.
The external risk factors can be of several types (McNeil, Frey & Embrechts, 2015). The external
risk factors contain risks related to natural disaster and unwanted technical problems like loss of
internet and the loss of electricity. Main issue related to the external risk is the threat of cyber
attack (Tadeusiewicz & Horzyk, 2014). There are many cases found in which hackers have
stolen lots of data from the database of several organisations dealing with information
technology.
5. Difference between Risk and Uncertainty
There are several differences between the risk and uncertainty. The primary difference
between the risk and uncertainty is that the risk can be determined previously by several factors
but the uncertainty cannot be identified (Kettl et al., 2015). Risk can also be overcome by taking
several measures but uncertainties can never be overcome as the time and place of uncertainty
are not known to the organisations. Sometimes the uncertainty can create a lot of threat to the
main system than that of the risk factors. Uncertainties can come at any time and in form of any
level. Another disadvantage in case of uncertainty is that the level of impact cannot be
determined by any analysis regarding the uncertainties (Brindley, 2017). In VIC government
regulations mainly the standards and protocols are created according to the risk management. In

10IT RISK MANAGEMENT
that case the organisations must take several precautions to overcome the damages related to the
uncertainties also.
6. Discussion and evaluation of several methods available to the VIC government for risk
management
VIC government has created sets of rules and regulations which are important in case of
making the organisation more secured. It is already discussed about the risks and the threats
which can be harmful for the organisations. The Victorian Protective Data Security framework is
the main feature of the regulations which has provided precautions and standard protocols
against all the possible risk factors which can be dangerous in terms of making the organisations
more secure (Bianco et al., 2017). The primary step of making the organisation more advanced in
security is to create the acts and protocols regarding the public information safety and the
protective data security. In this case the main features are designed in such a way so that the laws
and the regulations can be implemented in a proper way (Cole et L., 2013). The main standards
follow some methods to overcome the organisational structure which are important in case of
making the organisations more secure and strong (Chance & Brooks, 2015). These standards are
created in order to save the four domains which are information, ICT, personnel and the physical
security from various risk factors. Every standard contain four protocols which are also
implemented with continuous modifications for better response. According to the VIC
government standards the information should be taken care of with better responsibility than the
official assets. Information security and the ICT security should be given highest priority. There
is also a assurance model in the VIC governments sets of standards. This implies the
conformation of the security by reflecting to the organisation and the governments. Several
importances are given to risk management and the information value. Continuous improvement

11IT RISK MANAGEMENT
is an important feature of the VIC government which tells about four key factors and those are
plan, do, check and act (Aldunce et al., 2015). With the help of these four factors the risk
analysis and management can be more effective in terms of making the system more secure.
Conclusion
From the above discussion it is concluded that the risk factors are very important to be
analyzed in a correct manner so that the organizations are more advanced with respect to the
safety and the security. There are different types of risks and every type of risk has different type
of safety level on the basis of the amount of damage it can send to the organization. Risks can be
internal or external depending upon the individual or group who are accessing the organizations
database. There are also different types of risks like accidental risk and the deliberate risks. The
main advantages regarding the accidental and the deliberate risk is that the organization has
many chances to recognize the background of the risks so that different measures can be taken.
From the VIC government rules and regulations it is also cleared that the standards and the
regulations given by the VIC government should be followed with respect to the organizational
safety measures. Risk management is a new field which is also very important from the point of
view of mitigating the threats and risks and also to overcome the risk factors. Public data is
important from the safety point of view and so risk management is also important to make sure
the security of the information of the system.

12IT RISK MANAGEMENT
References
Aldunce, P., Beilin, R., Howden, M., & Handmer, J. (2015). Resilience for disaster risk
management in a changing climate: Practitioners’ frames and practices. Global
Environmental Change, 30, 1-11.
American Diabetes Association. (2016). 8. Cardiovascular disease and risk management.
Diabetes care, 39(Supplement 1), S60-S71.
Becken, S., & Hughey, K. F. (2013). Linking tourism into emergency management structures to
enhance disaster risk reduction. Tourism Management, 36, 77-85.
Bianco, R. J., Arnoux, P. J., Wagnac, E., Mac-Thiong, J. M., & Aubin, C. É. (2017). Minimizing
pedicle screw pullout risks: a detailed biomechanical analysis of screw design and
placement. Clinical spine surgery, 30(3), E226-E232.
Brindley, C. (Ed.). (2017). Supply chain risk. Taylor & Francis.
Chance, D. M., & Brooks, R. (2015). Introduction to derivatives and risk management. Cengage
Learning.
Cole, S., Giné, X., Tobacman, J., Topalova, P., Townsend, R., & Vickery, J. (2013). Barriers to
household risk management: Evidence from India. American Economic Journal: Applied
Economics, 5(1), 104-135.
Davies, J. C. (2014). Comparing environmental risks: tools for setting government priorities.
Routledge.

13IT RISK MANAGEMENT
DeAngelo, H., & Stulz, R. M. (2015). Liquid-claim production, risk management, and bank
capital structure: Why high leverage is optimal for banks. Journal of Financial
Economics, 116(2), 219-236.
Ferguson, B. C., Brown, R. R., Frantzeskaki, N., de Haan, F. J., & Deletic, A. (2013). The
enabling institutional context for integrated water management: Lessons from Melbourne.
Water research, 47(20), 7300-7314.
Glendon, A. I., Clarke, S., & McKenna, E. (2016). Human safety and risk management. Crc
Press.
Heazle, M., Tangney, P., Burton, P., Howes, M., Grant-Smith, D., Reis, K., & Bosomworth, K.
(2013). Mainstreaming climate change adaptation: An incremental approach to disaster
risk management in Australia. Environmental Science & Policy, 33, 162-170.
Holt, T. J., Smirnova, O., Chua, Y. T., & Copes, H. (2015). Examining the risk reduction
strategies of actors in online criminal markets. Global Crime, 16(2), 81-103.
Hopkin, P. (2017). Fundamentals of risk management: understanding, evaluating and
implementing effective risk management. Kogan Page Publishers.
Howard, D. L., & Beasley, L. M. (2017). Pregnant with a perforated levonorgestrel intrauterine
system and visible threads at the cervical os. BMJ Case Reports, 2017, bcr-2017.
Howes, M., Tangney, P., Reis, K., Grant-Smith, D., Heazle, M., Bosomworth, K., & Burton, P.
(2015). Towards networked governance: improving interagency communication and
collaboration for disaster risk management and climate change adaptation in Australia.
Journal of Environmental Planning and Management, 58(5), 757-776.

14IT RISK MANAGEMENT
Kettl, D. F. (2015). The job of government: Interweaving public functions and private hands.
Public Administration Review, 75(2), 219-229.
Lam, J. (2014). Enterprise risk management: from incentives to controls. John Wiley & Sons.
Lawrence, J., Sullivan, F., Lash, A., Ide, G., Cameron, C., & McGlinchey, L. (2015). Adapting
to changing climate risk by local government in New Zealand: institutional practice
barriers and enablers. Local Environment, 20(3), 298-320.
McNeil, A. J., Frey, R., & Embrechts, P. (2015). Quantitative risk management: Concepts,
techniques and tools. Princeton university press.
Paton, D., Johnston, D., Mamula-Seadon, L., & Kenney, C. M. (2014). Recovery and
development: perspectives from New Zealand and Australia. In Disaster and
development (pp. 255-272). Springer International Publishing.
Poniszewska-Marańda, A. (2014). Selected aspects of security mechanisms for cloud
computing–current solutions and development perspectives.
Pritchard, C. L., & PMP, P. R. (2014). Risk management: concepts and guidance. CRC Press.
Reason, J. (2016). Managing the risks of organizational accidents. Routledge.
Tadeusiewicz, R., & Horzyk, A. (2014, November). Man-Machine Interaction Improvement by
Means of Automatic Human Personality Identification. In IFIP International Conference
on Computer Information Systems and Industrial Management (pp. 278-289). Springer,
Berlin, Heidelberg.