The Maturity Model of Risk Management for IT-Entities

Abstract

The article considers the author's model for the maturity of risk management systems for entities involved in developing computer software and providing consulting services in this area. The key aspects of its development were the results of an analysis of popular maturity models such as RM Maturity Model, The Management of Risk Maturity Model, RMM, and RM3, based on which requirements were formulated for a domestic RMS model applicable to the IT-field. It was determined that the RMS maturity model should be accompanied by reduced material damage and harm to stakeholders, increased maturity levels, and compliance with national risk management standards. In addition, specialists responsible for managing risks must meet professional standards, and evaluation of the criteria for the developed model allowed us to determine that it meets all requirements, indicating its potential effectiveness in mitigating risks. Depending on its development, an entity can be assigned to one of three levels of maturity – «Low», «Medium», or «High». If an entity has a «Low» level of RMS, it is characterized by a high frequency of materialized risks leading to large amounts of damage, both to itself and to interested parties. An entity with a «Medium» level has an acceptable number of risks leading to «controlled» amounts of damage. At the «High» level, the entity does not experience events that could negatively affect IT-product creation during IT-project implementation (sprint, lifecycle phase, contract, etc.).