Generalized risk assessment index for information systems auditing

This paper introduces a comprehensive index for the assessment of information risks in IT auditing. Although there have been numerous attempts to create risk measurement indices in the past, these have been concentrating on the more precise estimation of threats and vulnerabilities. The approach in this case is new: the interactions of the individual risk factors are taken into account. A numerical index has been created that calculates the simultaneous effects of the risks identified using the COBIT methodology. The functioning of the index has been verified with statistical analysis. The use of the index allows the enhancement of management decisions on IT-related asset allocation