Factors Comprising Effective Risk Communication, Decision-Making, and Measurement of IT and IA Risk

This article focuses on factors that comprise effective risk communication, decision-making, and measurement of information technology (IT)/ information assurance (IA) risk. A review of the extant literature provided the basis for the formulation of research questions. The sample population consisted of senior IT/IA practitioners from Florida chapters of information security professional organizations. Results of this study found that decision making, and measurement are all factors in effective risk communication of IT/IA risk to non-IT personnel. This research has implications for both IT/IA practitioners and recipients of risk communication through the identification of factors which influence IT/IA professionals in how and why IT/IA risk communication take place, and consequently, how to simplify and improve its effectiveness.