IS Risks and Operational Risk Management in Banks

Size: px

Start display at page:

Download "IS Risks and Operational Risk Management in Banks"

Archibald Nicholson
10 years ago
Views:

1 Reihe: Wirtschaftsinformatik Band 47 Herausgegeben von Prof, (em.) Dr. Dietrich Seibt, Koln, Prof. Dr. Hans-Georg Kemper, Stuttgart, Prof. Dr. Georg Herzwurm, Stuttgart, Prof. Dr. Dirk Stelzer, llmenau, und Prof. Dr. Detlef Schoder, Koln Dr. Elke Wolf IS Risks and Operational Risk Management in Banks Mit einem Geleitwort von Prof, (em.) Dr. Dietrich Seibt, Universitat zu Koln

Dr. Dirk Stelzer, llmenau, und Prof. Dr. Detlef Schoder, Koln Dr.

2 1 The problem of risk management for information systems in the banking industry Business drivers for operational risk management Research questions Objectives Relevance for the research field of information systems Structure of the thesis 22 2 Core concepts and review of current research - IS risks in the context of banks' business processes Business processes of banks under changing conditions Business processes of banks Risk, IS risks, and operational risk The concept of risk IS risks and operational risks Risk management Origins and definition of risk management Risk management in the context of bank management Legal foundations of banks' risk management Banks' risk management Risk management in the context of information systems The risk management process Review of current research Project management research Outsourcing research System development research Security research Closer review of a selected approach Basic research theses Three key perspectives of investigation Exploring the field - Mobile banking Methodological aspects of key perspective 1 - Risk management profiles of existing approaches 135

1 Business processes of banks under changing conditions 27 2.1.1 Business processes of banks 27 2.2 Risk, IS risks, and operational risk 44 2.2.1 The concept of risk 44 2.2.2 IS risks and operational risks 50 2.

3 3.2.1 Selection of approaches for the analysis Development of a set of analysis criteria Methodological aspects of key perspective 2 - Current risk management procedures and tools Ontological and epistemological perspective Selection of participants Data types and assessment of data Operationalisation and design of a measurement instrument Operationalisation Interview design Interview guidelines Administration of the research study A personal cover letter Timeliness and continuity Information and expertise Data collection Methodological aspects of key perspective 3 - Requirements specifications 197 Results of the study - The demand for new developments in the field of IS risk management Key perspective 1 - Risk management profiles of existing approaches Analysis of approaches from the IS discipline System development and software improvement Security Project management Controlling of information systems Deliverables of KP1: Analysis instrument and risk management profiles Key perspective 2 - Current risk management procedures and tools Data analysis Univariate analysis for investigating the research theses Bivariate analysis for investigating the research theses Research thesis KP2-T1: IS risks, system risks, and operational risks Research thesis KP2-T2: Outsourcing and IS risk management Research thesis KP2-T3: Organisational aspects of operational risk management Research thesis KP2-T4: The risk management process Research thesis KP2-T5: Current use of software tools Research thesis KP2-T6: IS risk management and supervisory recommendations 259

3.4 Operationalisation and design of a measurement instrument 164 3.3.4.1 Operationalisation 164 3.3.4.2 Interview design 165 3.3.4.3 Interview guidelines 170 3.3.5 Administration of the research study 172 3.

4 4.3 Key perspective 3 - Requirement specifications for future developments Research thesis KP3-T1: IS risks and the changing banking business Research thesis KP3-T2:Difficulties with identifying and assessing operational risks Research thesis KP3-T3: Contribution of existing IS approaches to IS risk management Research thesis KP3-T4: Requirements for IS risk management and changing business conditions Research thesis KP3-T5: Demand for a software tool Research thesis KP3-T6: Preference for software tools to support IS risk management Research thesis KP3-T7: Relationship between different risk categories for expected loss and estimated probability of occurrence (Question 1.3) Research thesis KP3-T8: Relationship between risk categories and system life cycle (Question 1.5) Research thesis KP3-T9: Relationship between expected loss and probability of occurrence, on the one hand, and the importance of a risk category, on the other (Questions 1.3 and 1.5) Research thesis KP3-T10: Relationship between various influence factors on IS risks (Question 1.7) Research thesis KP3-T11: Relationship between difficulties and requirements, on the one hand, and applied methods, on the other (Questions 3.3, 3.4, and 4.4) Research thesis KP3-T12: Relationship between difficulties of identifying and assessing risks, on the one hand, and the evaluation of existing approaches, on the other (Questions 3.4 and 4.1) Deliverables of KP3: Requirements specifications Revision of the research theses 306 Interpretation of the results - Suggestions for new developments and future research Suggestions for new developments Suggestion 1: Checking for sufficient comprehensiveness, life cycle coverage, and IS risk sensitivity Suggestion 2: Improving the common understanding of operational risks Suggestion 3: Linking operational risk management as a formal requirement with actual IS risk management activities323

3.6 Research thesis KP3-T6: Preference for software tools to support IS risk management 277 4.3.7 Research thesis KP3-T7: Relationship between different risk categories for expected loss and estimated probability of occurrence (Question 1.

5 5.1.4 Suggestion 4: Reducing rivalry between business lines and corresponding biases Suggestion 5: Compensating a small amount of available data Suggestion 6: Broadening the focus on risk categories Suggestion 7: Incorporating a business process focus Suggestion 8: Towards a better consideration of complexity Suggestion 9: Recognising the relevance of communication structures and dynamics Suggestion 10: Addressing the quantification problem of IS risks as operational risks Suggestion 11: Choice of time intervals for assessment and monitoring Suggestion 12: Selection of key indicators Areas of future research Conclusions 355 Bibliography 358 Appendix 417 A MSIS 2000 Curriculum 419 B Guidelines for 22 telephone interviews of an exploratory study on mobile banking 425 C Results of the exploratory study on mobile banking 429 D Overview of various process models 435 E PMBOK guide and ISO F Top 100 German banks addressed for the research study 451 G Guidelines for 43 face-to-face interviews of the study 467 H Synopsis of risk management tools 481 I Descriptive statistical results Question Question Question Question Question Question

1.10 Suggestion 10: Addressing the quantification problem of IS risks as operational risks 339 5.1.11 Suggestion 11: Choice of time intervals for assessment and monitoring 342 5.1.12 Suggestion 12: Selection of key indicators 344 5.

6 1.7 Question Question Question J Multivariate analysis 561 K Statistical inference analysis 581 K.I Hypothesis KP3-T9 581 K.2 Hypothesis KP3-T K.3 Hypothesis KP3-T K.4 Hypothesis KP3-T K.5 Multivariate analysis statistics 633

581 K.I Hypothesis KP3-T9 581 K.2 Hypothesis KP3-T10 596 K.

Erich R. Utz. Modelling and Measurement Methods of Operational Risk in Banking. Herbert Utz Verlag München

Erich R. Utz. Modelling and Measurement Methods of Operational Risk in Banking. Herbert Utz Verlag München Erich R. Utz Modelling and Measurement Methods of Operational Risk in Banking Herbert Utz Verlag München Schriftenreihe für angewandtes Management herausgegeben von Prof. Dr. Dr. Christian Werner, Fachhochschule