Abstract:

The measurement of IT risk is one of the least studied areas in the IS risk literature. IS research that apply financial economics models in the broader context of examining the IT risk-return relationship and IT risk management invariably identifies risk measurement as a primary limitation. The present thesis investigates a new approach for closing this critical gap. Building upon a process-theoretic view of how IT value is generated, we propose a generalized framework comprising three elements. One is a multifactor return generating process (RGP) model defining a linear relationship between IT investment returns and the unexpected behavior (realizations) of multiple risk factors. Another element is an operational, prediction-oriented version of the RGP model defining IT return as a linear function of risk premiums associated with risk factors. The last element is a four-step methodology for estimating and validating the risk pricing parameters associated with each risk factor based on the former two elements. Our framework builds on recent theoretical and empirical developments in financial economics research according to which the principles of arbitrage pricing theory (APT) extend to the operationalization of the multifactor RGP in pricing IT investment risk factors. Moreover, observing that relevant data on IT risks and IT returns may come from diverse sources, each having its own unique characteristics, we show how to instantiate our framework in two different empirical contexts. In the first context, focusing on pricing software development risk factors, we apply the principles of APT by using a reference software cost estimation model, to which agents are assumed to subscribe, to substitute for the role of a 'market' in governing the extra cost a software project incurs due to exposure to multiple risk factors. In the second context, focusing on pricing customer adoption risk, market data generated using an event study enable application of the APT model in the context of a single-factor RGP conditioned on firm-specific events targeted by the event study. These two empirical studies effectively demonstrate the viability of applying our proposed risk pricing framework to the IT investment context.