OPERATIONAL RISK RATING OF TECHNOLOGY-BASED INITIATIVES

In previously published papers, analysis of the expected quality of products and services developed by Information Technology (IT) organizations showed that likelihood of experiencing problems provided a more accurate picture of an organization’s capability to develop and maintain software applications than solely measuring the degree to which best practices were implemented. Data collected with respect to the Capability Maturity Model Integration (CMMI®) and other models suggest practices are not all equal, given the context in which an organization operates. Some practices have high risk-mitigation potential, in the sense that they are better at preventing undesirable events from happening, and desirable events from not happening in this given context. It then becomes that much more important to identify which processes result in an optimal outcome for a given organization, taking various parameters into consideration, such as the business context in which the organization operates, the types of products that are being developed, resources available to the organization, and its culture. This paper explores the concept of operational risk rating in order to determine the capability of an organization to deliver its technology-based products and services, using existing models, possibly adapted to the organization, or new models specifically developed for the organization