The goal activities planned may be jeopardised before

the goal activities planned may be ‘jeopardised’ before that phase. Thus, the control of
goal setting activities planned is a ‘premature’ stage, which provides though more
valuable information at the time needed.
In terms of Internet banking security, Omega-Bank was the only case study among the
three to consider the security applications in relation to Internet banking as an
additional step at the goal initiation phase. As one IT member said: “ Internet banking
security applications consume much of our time and it should be established a co-
department, in the future, which will focus only on that aspect of security ”. However
the three case studies make use of checklists which prioritize Internet banking security
15

risks in terms of their likelihood ratio and impact. An example of such checklist was
provided by Alpha-Bank and it is presented in Appendix 1. This checklist, in which
new risk factors are identified and their impact to the organization evaluated, consists
of five main clusters.
The evaluation phase was also a significant stage of the overall goal setting process in
the context of security risk management within all of the three IT groups. In the case
of Omega-Bank, the IT group considered an additional activities step, that of security
policies and procedures, based on which the IT group investigates whether there is a
need to change any particular aspect. The difference in the case of Omega-Bank, as
compared to the case of Alpha-Bank and Delta-Bank, is that the IT group makes a
more frequent evaluation of the security policies and procedures after the
implementation of security projects.
However goal setting within all of the three case studies was a significant and
consistent part of the overall organizations’ business activities plan and development.
The procedures according to which the IT groups in the three case studies set goals,
exhibited similar patterns, albeit with few minor differences in the implementation
process, in terms of stage prioritisation.
4.2 Risk Communication in the Context of Goal Setting
Goal setting in the three case studies was an integral part of the organizations’ overall
business activities plan. From the interviews in Delta Bank, the issue of risk
communication was believed to have an effect on the level of goal setting to the
degree that one IT member was capable of understanding the goal to be achieved.
That is, the capability of each IT member to understand the IT group goals that had to
be achieved in the context of Internet banking security, so that the communication of
messages with other group members would take place effectively.
However, the differences of the business scope within different banking units had an
ultimate effect upon the IT group’s Internet banking security activities plan since the
business units did not seek always to ‘communicate’. One such reason was that since
most interactions between users and security mechanisms take place in a socio-
16