ICT and Risk Management
Domain 14: ICT and Risk Management. Tests how information and communication technology supports business functions, the risks it creates, and the standard risk-management process.
ICT in business
Hardware, software, networks and the internet support record-keeping (spreadsheets, accounting packages), point-of-sale and stock systems, mobile banking and mobile money, e-commerce and m-commerce, social media marketing, email and cloud storage. Benefits: speed, accuracy, wider market reach, better data for decisions and lower communication cost. Costs and risks: purchase and training, dependence on electricity and connectivity, cybercrime such as phishing and ransomware, data loss, and legal duties under Namibia's data protection legislation to handle personal information lawfully and securely.
Risk management process
Identify risks, assess them (likelihood x impact), treat them, then monitor and review. Treatments: avoid (stop the activity), reduce (controls, training, maintenance), transfer (insurance, contracts) and accept (small, cheap risks). Risk types: strategic, operational, financial, legal and compliance, reputational, environmental. Controls: daily banking, two signatories, segregation of duties, off-site backups, passwords with two-factor authentication and service contracts for key equipment.
Worked example
Risk register for a small bakery. Oven breakdown: likelihood 3 x impact 4 = 12 (high), so take a service contract and a standby arrangement with a neighbouring bakery (reduce and transfer). Cash theft: likelihood 4 x impact 2 = 8, so bank daily, use two signatories and count the till (reduce). Flood damage: likelihood 1 x impact 5 = 5, so insure (transfer). Reasoning: the score sets priority, and the plan records who acts and by when; incidents then update the scores.
Traps
- Describing insurance as removing risk; it transfers financial loss only.
- Confusing risk avoidance with risk reduction.
- No data backup, or backups kept beside the computer.
- Assuming ICT always cuts costs, ignoring training, downtime and cyber risk.