IT risk management gets more complex everyday. It used to be that the major risk factors were security and disaster recovery. But today IT risk management includes such things as runaway projects, global sourcing, regulatory compliance (Sarbanes-Oxley, privacy, trans-border data flow, export control, financial disclosure, certifications, etc.), business continuity, fraud detection, and protection of intellectual property. The list seems endless and growing.

The sources of risk are proliferating as well. Natural disasters such as fires, floods, earthquakes, hurricanes, and cyclones have always been a risk for IT. To that list of natural risks we also have an ever-growing inventory of man-made risks. At the top of the list is global terrorism. In addition, viruses, worms, Trojan horses, phishing, spyware, identify theft, etc. are making the IT job more difficult everyday.

To add some perspective to risk management, I find it useful to think about enterprise risk management in a few broad categories:

• Information security
• Regulatory compliance
• Business continuity and disaster recovery
• Project and program management
• Vendor management and global sourcing
• Training and awareness