Risks and Threats to an Organization

Information systems are subject to serious threats that can have adverse effects on organizational operations such as missions, functions, image, or reputation, organizational assets, individuals, other organizations, and the Nation by exploiting both known and unknown vulnerabilities to compromise the confidentiality, integrity, or availability of the information being processed, stored, or transmitted by those systems. Threats to information and information systems can include purposeful attacks, environmental disruptions, and human/machine errors and result in great harm to the national.

A risk is defined as the effect of uncertainty (either positive or negative) on business objectives. Risk management is the coordination of activities that direct and control the department with regard to risks. It is commonly accepted that risk management involves both the management of potentially adverse effects as well as the realisation of potential opportunities. In management responsibilities, risk management can be described as the collection of deliberate actions and activities that we carry out at all levels to identify, understand and manage risks to the achievement of our objectives.
Organizational risk can include many types of risk (e.g., program management risk, investment risk, budgetary risk, legal liability risk, safety risk, inventory risk, supply chain risk, and security risk). Security risk related to the operation and use of information systems is just one of many components of organizational risk that senior leaders/executives address as part of their ongoing risk management responsibilities. Effective risk management requires that organizations operate in highly complex, interconnected environments using state-of-the...

... middle of paper ...

...ty and capability of the department to effectively and efficiently manage risk.

The acceptance of risk must be escalated in accordance with the Risk Delegation levels as mandated by this policy. This is necessary to ensure that the person who may “accept” the risk on behalf of the organisation has sufficient experience and authority commensurate with the level of risk.

All staff and line managers are responsible for managing risk associated with the activities and functions under their control. Risk management processes should be integrated with normal planning processes and management activities.

In conclusion, in order to manage the risk in an organization, all the employees should take the responsible to avoid and manage the risk. There should have team work and cooperate each others in an organization to manage every level of risk in information system.