DOI: 10.14457/tu.the.2019.192
title: Principles and practice fit in information technology risk management (ITRM): multi-case study research

description: The purpose of this dissertation is to investigate the current situation of the implementation of the information technology risk management comparing with the general risk management frameworks and principles. The objective of this study is to obtain the key success factors from the general risk management frameworks and principles, and case studies’ practice. Then, matching between the key success factors from two sources through the developed framework applying from task technology fit theory in terms of process structuring. This study is based on qualitative research by case study analysis. The developed conceptual framework is the principles and practice fit framework. The key success factors obtained from reviewing the general risk management frameworks and principles are understanding the organization’s context, three line of defense structure, team's expertise, training and culture, IT risk management process, and communication. The case study protocol is designed for case selection and data collection. The data are seven purposively selected case studies which are the mixed-size financial institutions in Thailand. Case profiles are narrated to show different aspects of chosen cases such as percentage of total asset comparing the market shares, technological-platform services, company status, three lines of defense structure, interviewee’s position and profile. The interview content of ITRM practice is collected by semi-structured interview. The reliability of this research is the triangulation of the general risk management frameworks and principles, the interviewees and the revision of ITRM experts. The content analysis method describes coding and content counting methods. The case study analysis result explains the real ITRM practice of the case studies which have the same and different practice the through the key success factors. The key success factors are ranked from the most counted content. The findings found that the most effective factors are Tools, Interdependence, and Expertise of the three lines of defense. The heart of the ITRM in the current situation is the interdependence of the three lines of defense structure. The problem now is the difficulty to find people in the three lines of defense especially the first and second lines of defense that have expertise in product and service lines and truly understand how to identify, to assess and to treat risks. Even though the solution is to find and to implement the efficient tools such as governance, risk management and compliance (GRC) tools, current tools have some problems which do not fit to the ITRM task. Other solutions suggested by the case studies are the ITRM process should be the end-to-end process, the authorized managements participate in risk identification process, the second line of defense mentors the first line of defense in risk assessment, historical and current data and information are useful to identify possible risks and to assess possible loss which impact to the organization, and organizing training or workshop help to communicate, to share knowledge and to increase expertise of people in the three lines of defense leading to the successful ITRM practice. The principles and practice fit framework is the theoretical contribution from this research. Even though the fit in terms of process structuring have been mentioned, there is no research study analyzing and synthesizing as this research does by the case study analysis. The proposed framework presents the other aspect of the task technology fit theory focusing on process structuring. Meanwhile, the technology is a part of process structuring. The factors that make the framework fit are our interest. The performance is not the emphasis in this research study but sharing stories from the case studies can also be a guide to achieve successful practical implementation. Therefore, the future research should include designs to test the performance of the ITRM process in the organization.