Which model is used to develop risk profiles for a firm's information system projects and assets?

The selection of portfolio analysis as the correct answer is rooted in its comprehensive approach to evaluating and managing a firm's information system projects and assets. In a portfolio analysis, organizations assess and prioritize their various projects and investments in terms of risk, return, and strategic alignment. This process allows firms to identify which projects are likely to succeed, which are too risky, and how resources can be allocated effectively based on a thorough understanding of the risks involved.

By employing portfolio analysis, firms can develop risk profiles that help in making informed decisions regarding which projects to pursue or terminate. This approach considers both current and future projects and their interrelationships, enabling a holistic view of the organization’s strategic objectives and operational capabilities. Additionally, it allows for the monitoring of ongoing projects to ensure they align with the risk appetite and strategic goals of the firm.

Other methods, such as scoring models or critical success factors (CSF), may also assist in risk assessment but are typically more specific in their focus. For example, scoring models are designed to evaluate particular aspects of projects against predefined criteria, while CSFs concentrate on the essential areas that must be managed effectively for a project to succeed. However, these methods do not provide the broad analytical framework offered by portfolio analysis, which explicitly caters to developing