Identifying factors affecting Information Technology Risk Management With emphasis on AI

The aim of this research was to identify and structure the key factors of InformationTechnology (IT) risk management in large companies, focusing on the role andintegration of Artificial Intelligence (AI). Given the increasing complexity of the ITrisk landscape in large companies and the limitations of traditional approaches,leveraging Artificial Intelligence has become a necessity. Using a qualitativeapproach and Thematic Analysis, this study conducted in-depth interviews with ۱۲prominent experts in relevant fields within large Iranian companies. Data werecollected through semi-structured interviews and analyzed using NVivo software,leading to the identification of ۶ final themes (factors). Subsequently, to understandthe structural and hierarchical relationships among these factors, InterpretiveStructural Modeling (ISM) and Fuzzy DEMATEL methods were employed, basedon the judgments of the same experts. The Thematic Analysis findings identifiedsix key factors: AI-based IT Risk Management Processes, AI Capabilities andApplications, Enablers for AI Implementation, Challenges and Barriers to AIImplementation, AI Governance, Ethics, and Regulations, and Inherent AI Risks.ISM and Fuzzy DEMATEL analyses revealed that Inherent AI Risks are at thefoundational and root level (Level ۱), Challenges and Enablers are at theintermediate level (Level ۲), Governance and Capabilities are at a higher level(Level ۳), and AI-based IT Risk Management Processes are at the highest level,representing the model’s output (Level ۴). The main conclusion of the research isthat the AI-based IT risk management model in large companies has a multilayeredstructure, and understanding the hierarchical relationships among the sixidentified factors is crucial for its effective design and implementation. This modelemphasizes the importance of managing risks arising from AI itself as aprerequisite, and focusing on enablers, challenges, governance, and capabilities toachieve improved IT risk management processes.

کلیدواژه ها:

Artificial Intelligence ، Information Technology Risk Management ، Large Companies ، Thematic Analysis ، Interpretive Structural Modeling ، Fuzzy DEMATEL.