Luminiţa ION

The paper treats the foundations of IT risks, in the framework delimited and expressed by some specific business characteristics, as availability, access, accuracy and agility. This elements have different representations, depending of various levels of analyze; for example- business executives which attempt to determine the most important items and the relative risk tolerance across different units or processes, while operational managers examine how the weakness and vulnerability can be regarded and mitigated in real time. The multilayered approach offer some advantages, as: creating strong connections at different levels of organization to work better, allowing to managers at different levels to make decisions based on the overall risk view at their level of decision, creating the solid basis to set up risk policies and standards for every level of organization. A modern vision of IT risk in an information society implies making connections between IT risk and the risk governance process, in a general framework of IT governance. The authors propose some directions for executives and for operational managers to improve and to implement IT risk governance process and consequently, the adoption of a key practices in the field of I