Adapted Loss Database – A New Approach to Assess IT Risk in Automated Business Processes

Service-oriented architectures (SOA) provide companies with dynamic IT infrastructures to adapt business processes flexibly to new requirements. However, the success of SOA will also depend on the ability to manage risk resulting from frequent and context-specific changes of IT support for automated business processes. Assessing this IT risk is challenging, since frequently changing relations between the causes of risk and their effects on business processes turns established methods for assessing risk into a game of hazard. Following a design science approach, this contribution proposes a novel approach for taking changes of cause-effect relations into consideration. Based on a backward-directed recalculation of historical loss data, a risk-adjusted loss database is generated that can provide a more realistic basis for assessing IT risk