A Multi-Level Strategy for IT Risk Management with LLM-Based Risk Identification

Аңдатпа

Digital transformation has expanded the range of risks facing IT projects worldwide, yet fragmented, non-integrated adoption of governance and risk standards such as ISO 31000, PMBOK 7, COBIT 2019 and NIST SP 800-30 leaves a structural gap between corporate governance and day-to-day project risk control, a gap that is especially acute for small and medium teams in emerging markets such as Kazakhstan. This study develops and empirically validates a Multi-Level Integrated Risk Architecture (MIAR) that embeds strategic, tactical and operational risk controls into the IT project lifecycle; introduces a normalized Risk Exposure Reduction Index (RERI) with criticality weighting and cost/timing correction factors estimated with bootstrap confidence intervals; and implements IT Risk Analyzer, a multi-tenant web service that uses a large language model (Claude API) with chain-of-thought and few-shot prompting to automatically extract structured risk registers from technical-specification text. The AI module was evaluated against expert-built ground truth, cross-verified with the NIST SP 800-30, OWASP Top 10 and PMBOK 7 catalogues, on five real technical specifications, and the complete strategy was validated through a nine-month quasi-experiment on a government digital-forensics IT project (budget ≈186 million KZT). The AI module reached precision 78.2%, recall 86.4% and F1 81.9%. Applying MIAR to the case project reduced weighted risk exposure by RERI_base = 0.641 (95% CI [0.563, 0.719]) and RERI_ext = 0.743, reached a Risk Management Index of 90%, and produced an estimated methodology ROI of 601%, corresponding to approximately 43.5 million KZT in avoided expected losses. These results indicate that combining an integrated multi-standard governance architecture with LLM-assisted risk identification yields measurable, reproducible reductions in risk exposure and provides a deployable instrument for resource-constrained IT teams and public-sector projects.