Please use this identifier to cite or link to this item:
Type: Journal article
Title: Applying the Australian and New Zealand risk management standard to information systems in SMES
Author: Davidson, R.
Lambert, S.
Citation: Australasian Journal of Information Systems, 2004; 12(1):4-17
Publisher: University of Canberra
Issue Date: 2004
ISSN: 1449-8618
Statement of
Robyn A. Davidson and Susan C. Lambert
Abstract: This paper advocates the use of the Australia/New Zealand Risk Management Standard (SA/SNZ, 1999) in conjunction with of a modified version of Birch and McEvoy’s (1992) Structured Risk Analysis for Information Systems (SRA-IS) to identify information systems security risks in SMEs. The use of Internet based commerce by SMEs exposes them to information systems security risks that they are ill equipped to recognise let alone mitigate. Unlike the identification of some business risks, identification of risks associated with information systems requires certain technical expertise. The structure of the existing information system must be understood and modelled before risks can be identified and it is acknowledged that the required technical expertise may not be present in SMEs, thus the involvement of information systems consultants may be necessary. Once the information system has been modelled little information systems expertise is required to complete the analysis, keeping consultant involvement to a minimum and maximising owner/manager involvement.
RMID: 0020094165
Description (link):
Appears in Collections:Business School publications

Files in This Item:
There are no files associated with this item.

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.