An approach to simultaneously assess operational risk and maturity levels in information technology management

The development of information technology (IT) has had a considerable effect on organizational management and success. Due to the widespread use of IT, the risk of error increases, which can significantly affect organizations. In order to reduce the impact of these errors, organizational maturity and risk should be calculated. The aim of this paper is to investigate the operational risk and maturity level of IT in an anonymized financial institution, based on the American Productivity and Quality Center benchmark and control objectives for information and related technologies. To this end, the operational risk and maturity levels of 34 IT service management processes were investigated by collecting required data from electronic forms as well as through expert opinions. Results were obtained at three levels: the assessment of the operational risk and maturity level (level one), the domains (level two) and the processes (level three) of the IT organization. The findings showed that the organization had a maturity level of 1.11 (indicating ad hoc and disorganized processes) and therefore there was a 47.9% chance of operational risk to IT management goals. The results can help managers allocate limited resources to activities, optimize the use of capital, reduce administrative costs and use IT effectively for growth and development.