Integrating Risk Representation at Strategic Level for IT Service Governance: A Comprehensive Framework

Organizations tend to set and pursuit objectives against an environment which faces levels of uncertainty. The effect of these uncertainties on objectives can be positive (opportunity risk) or/and negative (hazard risk). With every decision made by people within a company, risks are created, modified, updated or deleted. Therefore, the way these decisions are made in terms of change management strategy as well as the information they are based on, influence how objectives are achieved and requirements fulfilled. Despite the importance of risk definition and risk taking at all organizational levels, organizations mostly consider risk at the management and operational levels. Risks nevertheless also need to be considered at the strategic (governance) level because they constitute what hampers an organization to achieve its strategy. This paper focuses on risk at the strategic level and for this purpose it enriches the Model Driven IT Governance (MoDrIGo) framework; the enriched framework allows to evaluate the alignment of business IT services with strategic objectives while balancing this alignment/support with the potential risk at governance level. All in all, the framework is applicable in broader governance scenarios. The relevance of MoDrIGo as starting point to build a risk-aware governance framework (compared to other similar methods) is mainly because of its service-orientation and its focus on software development issues. The enhanced framework thus provides a high-level risk overview that helps organizations to successfully perceive, detect and treat risks when pursuing their objectives.