Methodological model based on risk it as a strategy for organizational risk management

Abstract

The risk is the combination of the probability of a calamity occurring and also the result of it when it happens. It has influence on the objectives that the organization has set because it can divert them from what was planned to positive or negative. Risk and opportunities coexist, so the management of both is a key strategic activity for the success of the organization. Then, risk management is the process of identifying and applying control measures to counteract risky events and therefore protect the organization’s assets through approved and coordinated activities that lead the company to meet the proposed goals. This paper proposes a guide for risk management based on the ISACA RISK IT tool, a tool applied globally. To fulfill the purpose, a specific methodology was developed, based on RISK IT. Within the proposed methodological guide, there are the areas of governing risk, evaluating and responding to it, and nine processes that range from managing risk, collecting data, analyzing them, providing a response through controls, and recommending strategies to communicate and express them in a way that become part of the organizational risk culture.