Figure 1 Sources and Types of IT Risk

1. Figure 1Sources and Types of IT Risk External Threats Legal & Regulatory Natural Disasters Value Stream Participants Technology and Technology Vendors Competitors Illegal Acts Outsiders Criminals Terrorists Pranksters Insiders Employees Investment Risks Operational Risks IT Operations Internal Controls System Development System Architecture Data Internal Threats

2. Table 1Sources and Consequences of IT Risk

3. Table 2The Evolving Nature of Operational Risks

4. Table 3Primary Areas of Operational Risk

5. Table 4U.S. IT Regulatory Examples

6. Table 5Investment Risk: The Threat of Depressed Benefit Flows

7. Table 6Investment Risk: The Threat of Increased Cost Flows

8. Table 7Investment Risk: The Threat of Inadequate Internal Controls

9. Table 8IT Risk Exposure from Outsourcing

10. Figure 2Risk Assessment Matrix High Probability of a Risk Event Occurring Medium Low Low Medium High Expected Loss If a Risk Event Occurs

11. Figure 3Effective Risk Management Cost of Risk Prevention/Mitigation Cost Sweet Spot Expected loss in the Absence of Risk Prevention/Mitigation Risk

12. Table 9Illustrative IT Project Portfolio Management Category Structure

13. Table 10Uncertainty-Reducing Options for Project Managers

14. Table 11Coors’ POS Application Suite:Assessing Operational Risk Exposure