An IT Risk Management Framework for provincial business entities : a case study for Limpopo Economic Development Agency, Limpopo Province, South Africa

This study focused on a lack of an Information Technology Risk Management (ITRM) framework tailored for provincial business entities to assist with the management of IT risks. The research was aimed at developing a tailored IT risk management framework that would assist provincial business entities with an effective ITRM process. This was achieved through identifying factors that constitute an ITRM framework, determining the current IT risk management methods used in provincial business entities and assessing the IT risk culture. This research study was conducted at the Limpopo Economic Development Agency (LEDA), which is a provincial business entity in the Limpopo province. The objectives of the study were accomplished using a design science research approach which involved the creation of an artefact and design theory as a means to improve the current state of practice as well as existing research knowledge about provincial business entities and their management of IT risks. The Nelson Mandela University Design Science Methodology Framework (NMU-DSFM) was identified as the methodology to be followed to devise the contribution in the form of an artefact. It was found that the organisation does not have a positive IT risk culture. From the study of the data analysis performed, it was evident that provincial business entities have challenges associated with adequately identifying IT risks. The findings highlighted that for the proper management of risks, risk governance should be effective by ensuring that the board of directors takes the responsibility of IT risk management, and the essentials of risk governance were discussed at length. The research output for this study was a framework. The adoption of this framework may positively contribute to strengthening governance of IT risk management in the provincial business entities. Best practices were highlighted for ease of reference to determine what is required and how to implement this regarding IT risk management