An Integrated Risk Management Framework

Abstract

Organizational risk management should not only rely on protecting data and information but also on protecting knowledge which is underdeveloped in many cases or measures are applied in an uncoordinated, dispersed way. Therefore, we propose a consistent top-down translation from the organizational risk management goals to implemented controls to overcome these shortcomings. Our approach adopted from the domain of IT security management allows to measure how well knowledge protection is actually pursued in organizations. This affects organizations' abilities to prove compliance to risk management standards, laws, guidelines, or frameworks and creates transparency throughout the whole knowledge protection processes. After introducing our integrated risk management framework, we demonstrate how the technical part of the framework can be implemented by using process mining in a case study of an Italian aerospace company.