A risk mitigation decision framework for information technology organizations

Information technology (IT) organizations are faced with various risks such as strategic, operational and technical risks. These risks should be identified, measured and mitigated. Risk mitigation gives an opportunity to IT practitioners and management to compute risks and develop suitable strategies to treat the risk. Risk mitigation in organizations provides a disciplinary environment for decision making to measure and treat potential risk continuously. Existing model and frameworks provides inadequate support to practitioners in making risk decision pertaining risk mitigation. This is due to the fact that existing models or frameworks lacks the capabilities to support practitioners. In order to address this challenge, this research identifies the processes and components of risk mitigation in organization’s and proposes a framework of risk decision for mitigating both technical and operational risk using software agents and knowledge mapping as techniques. Qualitative research was adopted using interview to collect data. A pilot study was carried out to validate the instrument. The case study was later carried out to verify the risk mitigation process and components. Lastly the framework was evaluated using iterative triangulation.