IT operational risk assessment and control model based on Bayesian Network

Banks have become so dependent on IT that even a relatively short loss of the availability of a critical system or the breakdown of network can lead to a total failure of the business. The most important role of IT is to guarantee the operational continuity of business process. Therefore, IT Risk management efforts need to be seen from business operational continuity perspective. This paper presents a causal model with Bayesian Network (BN), which enables the assessment and the proactive control of IT operational risks. It establishes the cause-and-result relationship between the IT vulnerability, threat and business process malfunctions, so that business risk management can be traced back to IT roots, which can improve the pertinence of the control mechanisms. The causal model can be augmented by control decision, and the control effectiveness can be calculated with economic loss through comparison between prior and posterior control. This model can be applied to risk management practice of banking industry.