Information Systems Risks and Risk Factors: Are They Mostly About Information Systems?

Abstract

This article is the second of two whose goal is to advance the discussion of IS risk by addressing limitations of the current IS risk literature. The first article [Alter and Sherer, 2004] presented a general, but broadly adaptable model of system-related risk that addressed the limited usefulness of existing IS risk models for business managers. In this article, we focus on organizing risk factors to make them more useful and meaningful for business managers. This article shows how the nine elements of the work system framework can be used to organize the hundreds of risk factors in the IS risk literature. It also shows that many of the most important and most commonly cited risk factors for IS in operation and IS projects are actually risk factors for work systems in general. Furthermore, risk factors initially associated with one type of system (e.g. ERP implementation) are often equally relevant at other levels (e.g., information systems projects or work systems in general). Over half of the risk factors in a representative sample of the IS risk literature are valid for work systems in general. This conclusion is a step toward useful risk diagnostic tools based on an organized set of risk factors that are meaningful to business managers and IT professionals.

Using Fuzzy Analytic Network Process to assess the risks in enterprise resource planning system implementation

“…In dimension A, A1: "lack of management support and assistance" was identified as one of the critical risk factors in the management and execution dimension [36,38]. In A2, "resignation of project personnel" is also a risk factor in this study.…”

“…In this study, ERP implementation risks were categorized according to the literature review and experts' opinions. Thus, a framework that is widely used in the literature by management and execution, software systems, users and technology planning functions [36,37] was identified and summarized the risk factors in ERP implementation as shown in Table 1. …”

“…While applying an ERP system, the firm's requirements and expectations must be considered. In other words, the software system should fit with the demands of the company [36]. In B2, "complexity of the interface" is a risk factor in applying an ERP system.…”

“…The adoption may cause trouble if planning is inadequate [38]. In B3, "automating existing redundant or non-value-added process in the new system" indicates that the ineffective redesign of the business process is often a risk factor in ERP utilization [36,37,39]. To achieve success in the implementation of ERP, the business process should be redesigned to fit the software.…”

“…In B4, "the ERP system does not provide information needed to do the project" is a risk factor if resources are not sufficient to support the work. In other words, insufficient information which includes insufficient information accessibility and presentation, may cause trouble in adopting an ERP system [36].…”