Private Risk Management Research Articles

Machine learning private equity returns

In this paper, we use two machine learning techniques to learn the aggregated return time series of complete private capital fund segments. First, we propose Stochastic Discount Factor (SDF) model combination to determine the public factor exposure of private equity. Here, we describe our theoretical motivation to favor model combination over model selection. This entails that we apply simple coefficient averaging to obtain multivariate SDF models that mimic the factor exposure of all major private capital fund types. As a second step, we suggest componentwise L2 boosting to estimate the error-term time series associated with our factor models. The simple addition of the public factor model returns and the error terms then yields the total return time series. These return time series can be applied for proper integrated public and private risk management or benchmarking.

Internet of Medical Things Security Frameworks for Risk Assessment and Management: A Scoping Review.

The massive expansion of the Internet of medical things (IoMT) technology brings many opportunities for improving healthcare. At the same time, their use increases security risks, brings security and privacy concerns, and threatens the functioning of healthcare facilities or healthcare provision. This scoping review aims to identify progress in designing risk assessment and management frameworks for IoMT security. The frameworks found are divided into two groups according to whether frameworks address the technological design of risk management or assess technological measures to ensure the security of the IoMT environment. Furthermore, the article intends to find out whether frameworks also include an assessment of organisational measures related to IoMT security. This review was prepared using PRISMA ScR guidelines. Relevant studies were searched in the citation databases Web of Science and Scopus. The search was limited to articles published in English between 2018 and 17 September 2023. The initial search yielded 1341 articles, of which 44 (3.3%) were included in the scoping review. A qualitative content analysis focused on selected security perspectives and progress in the given area was carried out. Thirty-two articles describe the design of risk assessment and management frameworks. Twelve articles describe the design of frameworks for assessing the security of IoMT devices and possibly offer a comparison of different IoMT alternatives. A description of the included articles was prepared from the selected security perspectives. The review shows the need to create comprehensive or holistic frameworks for operational security and privacy risk management at all layers of the IoMT architecture. It includes the design of specific technological solutions and frameworks for continuously assessing the overall level of information security and privacy of the IoMT environment. Unfortunately, none of the found frameworks offer an assessment of organizational measures even though the importance of the organization measures was highlighted in articles. Another area of interest for researchers could be the design of a general risk management database for IoMT, which would include potential IoMT-related risks connected to a particular device.

Reach for Rent: How Public Liquidity Affects Private Risk Management

Reach for Rent: How Public Liquidity Affects Private Risk Management

Generating evidence on privacy outcomes to inform privacy risk management: A way forward?

Effective and efficient privacy risk management (PRM) is a necessary condition to support digitalization in health care and secondary use of patient data in research. To reduce privacy risks, current PRM frameworks are rooted in an approach trying to reduce undesired technical/organizational outcomes such as broken encryption or unintentional data disclosure. Comparing this with risk management in preventive or therapeutic medicine, a key difference becomes apparent: in health-related risk management, medicine focuses on person-specific health outcomes, whereas PRM mostly targets more indirect, technical/organizational outcomes. In this paper, we illustrate and discuss how a PRM approach based on evidence of person-specific privacy outcomes might look using three consecutive steps: i) a specification of undesired person-specific privacy outcomes, ii) empirical assessments of their frequency and severity, and iii) empirical studies on how effectively the available PRM interventions reduce their frequency or severity. After an introduction of these three steps, we cover their status quo and outline open questions and PRM-specific challenges in need of further conceptual clarification and feasibility studies. Specific challenges of an outcome-oriented approach to PRM include the potential delays between concrete threats manifesting and the resulting person/group-specific privacy outcomes. Moreover, new ways of exploiting privacy-sensitive information to harm individuals could be developed in the future. The challenges described are of technical, legal, ethical, financial and resource-oriented nature. In health research, however, there is explicit discussion about how to overcome such challenges to make important outcome-based assessments as feasible as possible. This paper concludes that it might be the time to have this discussion in the PRM field as well.

Aligning Private Climate Risk Management to Paris Climate Goals: An Australian Perspective

Climate change is now clearly recognised as a source of financial risk for private sector actors. In Anglo-American jurisdictions like Australia, corporate law and prudential regulatory frameworks contain obligations to identify, disclose and manage material financial risks that can be applied to climate-related risks. These legal frameworks have served as a foundation for the emergence of a range of private regulatory initiatives which seek to develop and apply best practice standards for climate risk disclosure and management, and which involve a range of different actors in driving the uptake of, and seeking to enforce, these standards. This paper explores the body of emerging private climate risk regulation, focusing particularly on the central organising theme of these initiatives: aligning private climate risk management to the climate mitigation goals of the international Paris Agreement. It outlines the way in which Paris-alignment and net-zero emissions are emerging as new norms guiding private sector approaches to climate change and explores how this interacts with and builds on essentially climate-neutral, risk-based corporate law and prudential regulatory frameworks. While there is considerable potential in Australia for Paris-aligned private risk management to contribute meaningfully to achieving international climate mitigation goals, there are also well-founded concerns about the effectiveness of these private measures that require further investigation.

Home quarantined: Privacy at risk in technologically-oriented learning amidst COVID-19 pandemic

<p><span>The COVID-19 triggers technologically-oriented learning and is critical in ensuring that education continues after schools close physically. The internet has a plethora of learning opportunities but may invite privacy risks to users. Using descriptive-comparative research design, the study determined the contents and artifacts exchanged in online portals, the extent of use of social media sites, teaching-learning platforms, and educational websites. The sample was 341 college students of a family-owned private higher education institution. Finally, the difference in online privacy risk management practices was determined when grouped by selected demographic variables. Using means, t-test, and ANOVA, findings from an online survey showed that personal information is shared the most in online portals. For online learning, students heavily relied on Facebook, Microsoft Teams, and Google. To protect their privacy, respondents from all classes follow online management practices. Generally, the respondents' good affordances and decorum in the online media imply that they have good behavior and value creation. Still, a comprehensive strategy to safeguard data among learners in the utilization of online productivity platforms is a must.</span></p>

Cybersecurity and the new firm: surviving online threats

PurposeNascent firms and startups are often subject to challenges that their more mature counterparts can avoid. While cybersecurity is an issue that all firms contend with, it is especially challenging for new entrepreneurial ventures who lack the resources and capabilities of established firms. The purpose of this paper is to seek to delve deeper into the cybersecurity and risk management needs of small firms and startups.Design/methodology/approachExtant literature and available tools are explored to develop a usable framework applicable to small firms and new entrepreneurial ventures.FindingsThe liabilities of newness and smallness make entrepreneurial ventures a unique context in which to study the significance of cybersecurity and data privacy risk management. The authors offer an overview of issues and potential solutions relevant to entrepreneurial ventures.Research limitations/implicationsWhile offering practical insights, the work is a theoretical framework. The framework will enable researchers to develop more nuanced theory when it comes to cybersecurity and data privacy risk management.Practical implicationsThe framework illustrates four distinct contexts for cybersecurity and risk management when it comes to the needs of small firms and startups. Adoption levels are explained, and small business operators and entrepreneurs can thus use the framework to determine the most appropriate approach for their enterprise.Originality/valueThe authors develop a framework illustrating adoption of different security and risk management practices by entrepreneurial ventures based on their specific needs and context. The authors thus offer practical solutions for startups and nascent firms regarding cybersecurity and privacy management.

Towards Design and Development of a Data Security and Privacy Risk Management Framework for WBAN Based Healthcare Applications

Assuring security and privacy of data is a key challenge for organizations when developing WBAN applications. The reasons for this challenge include (i) developers have limited knowledge of market-specific regulatory requirements and security standards, and (ii) there are a vast number of security controls with insufficient implementation detail. To address these challenges, we have developed a WBAN data security and privacy risk management framework. The goal of this paper is trifold. First, we present the methodology used to develop the framework. The framework was developed by considering recommendations from legislation and standards. Second, we present the findings from an initial validation of the framework’s usability and effectiveness of the security and privacy controls. Finally, we present an updated version of the framework and explain how it addresses the aforementioned challenges.

Automated Cyber and Privacy Risk Management Toolkit.

Addressing cyber and privacy risks has never been more critical for organisations. While a number of risk assessment methodologies and software tools are available, it is most often the case that one must, at least, integrate them into a holistic approach that combines several appropriate risk sources as input to risk mitigation tools. In addition, cyber risk assessment primarily investigates cyber risks as the consequence of vulnerabilities and threats that threaten assets of the investigated infrastructure. In fact, cyber risk assessment is decoupled from privacy impact assessment, which aims to detect privacy-specific threats and assess the degree of compliance with data protection legislation. Furthermore, a Privacy Impact Assessment (PIA) is conducted in a proactive manner during the design phase of a system, combining processing activities and their inter-dependencies with assets, vulnerabilities, real-time threats and Personally Identifiable Information (PII) that may occur during the dynamic life-cycle of systems. In this paper, we propose a cyber and privacy risk management toolkit, called AMBIENT (Automated Cyber and Privacy Risk Management Toolkit) that addresses the above challenges by implementing and integrating three distinct software tools. AMBIENT not only assesses cyber and privacy risks in a thorough and automated manner but it also offers decision-support capabilities, to recommend optimal safeguards using the well-known repository of the Center for Internet Security (CIS) Controls. To the best of our knowledge, AMBIENT is the first toolkit in the academic literature that brings together the aforementioned capabilities. To demonstrate its use, we have created a case scenario based on information about cyber attacks we have received from a healthcare organisation, as a reference sector that faces critical cyber and privacy threats.

Beyond Risk Shifting: The Knowledge‐Transferring Role of Audit Liability Insurers*

ABSTRACTRegulators and researchers tend to focus primarily on the risk‐shifting benefits of audit liability insurance. We obtain field data from the US audit insurance industry (16 interviews and 83 survey responses) to examine whether insurers also possess characteristics favorable to transferring their private risk management knowledge to the audit firms they insure. Possessing such characteristics would enable insurers to use their relative knowledge advantage to provide a benefit to audit firms beyond risk shifting. Thus, examining this issue helps broaden our understanding of insurers' role in auditing. We examine our data through the lens of the knowledge transfer theory and find evidence that audit liability insurers have the motivation and capacity to accumulate and transfer risk management knowledge to the audit firms they insure. We find that audit firms, particularly the small resource‐constrained firms (i.e., non–Big 4 and non‐second‐tier), rely on and benefit from their insurers' risk management knowledge. We also find that insurers transfer such knowledge through multiple mechanisms, including free consultative services, policy premium incentives, and continuing professional education classes. Our results highlight the important role of audit insurers as transferors of risk management knowledge to audit firms. Broadly, our results extend knowledge transfer theory and suggest areas for future research in US and international contexts.

Designing privacy-friendly data repositories: a framework for a blockchain that follows the GDPR

PurposeThe paper posits that a solution for businesses to use privacy-friendly data repositories for its customers’ data is to change from the traditional centralized repository to a trusted, decentralized data repository. Blockchain is a technology that provides such a data repository. However, the European Union’s General Data Protection Regulation (GDPR) assumed a centralized data repository, and it is commonly argued that blockchain technology is not usable. This paper aims to posit a framework for adopting a blockchain that follows the GDPR.Design/methodology/approachThe paper uses the Levy and Ellis’ narrative review of literature methodology, which is based on constructivist theory posited by Lincoln and Guba. Using five information systems and computer science databases, the researchers searched for studies using the keywords GDPR and blockchain, using a forward and backward search technique. The search identified a corpus of 416 candidate studies, from which the researchers applied pre-established criteria to select 39 studies. The researchers mined this corpus for concepts, which they clustered into themes. Using the accepted computer science practice of privacy by design, the researchers combined the clustered themes into the paper’s posited framework.FindingsThe paper posits a framework that provides architectural tactics for designing a blockchain that follows GDPR to enhance privacy. The framework explicitly addresses the challenges of GDPR compliance using the unimagined decentralized storage of personal data. The framework addresses the blockchain–GDPR tension by establishing trust between a business and its customers vis-à-vis storing customers’ data. The trust is established through blockchain’s capability of providing the customer with private keys and control over their data, e.g. processing and access.Research limitations/implicationsThe paper provides a framework that demonstrates that blockchain technology can be designed for use in GDPR compliant solutions. In using the framework, a blockchain-based solution provides the ability to audit and monitor privacy measures, demonstrates a legal justification for processing activities, incorporates a data privacy policy, provides a map for data processing and ensures security and privacy awareness among all actors. The research is limited to a focus on blockchain–GDPR compliance; however, future research is needed to investigate the use of the framework in specific domains.Practical implicationsThe paper posits a framework that identifies the strategies and tactics necessary for GDPR compliance. Practitioners need to compliment the framework with rigorous privacy risk management, i.e. conducting a privacy risk analysis, identifying strategies and tactics to address such risks and preparing a privacy impact assessment that enhances accountability and transparency of a blockchain.Originality/valueWith the increasingly strategic use of data by businesses and the contravening growth of data privacy regulation, alternative technologies could provide businesses with a means to nurture trust with its customers regarding collected data. However, it is commonly assumed that the decentralized approach of blockchain technology cannot be applied to this business need. This paper posits a framework that enables a blockchain to be designed that follows the GDPR; thereby, providing an alternative for businesses to collect customers’ data while ensuring the customers’ trust.

Risk Management Tools for Sustainable Agriculture: A Model for Calculating the Average Price for the Season in Revenue Insurance for Citrus Fruit

Risk management in agriculture is at the heart of major reforms in many OECD countries and European agricultural policies. Price risks, which are generally not insurable per se, have been covered by the Common Agricultural Policy (CAP), which has been shaped as a system of protection against market shocks and an instrument for income stabilization. However, there is an increasing propensity to combine the use of public and private risk management tools as well. In Spain, revenue insurance has not yet developed in the same way as other risk coverage insurance, although it is an upcoming target of agricultural insurance policies with the aim of ensuring income stability for agricultural producers. This paper presents the results of the methodology used to draw up a composition index or model of the average price for the season or representative market field price to be used for revenue insurance purposes in citrus fruit. High explanatory power regression models and the analytic hierarchy process (AHP) were used. The results show that the average price for the season obtained reliably represents the market field prices in the country’s various producer areas.

Regulating Algorithmic Insurance

This article addresses emerging gaps in consumer protection. Insurers, like companies in other industries, are revolutionizing their practices with artificial intelligence and big data. Insurers are finding new ways to price risks and policies, tailor coverage, offer advice to purchasers, identify fraud, and sequence the payment of claims. These changes have subverted consumer protections built into current regulatory regimes and regulators are struggling to adapt. This is not a niche problem. Insurance is a vital part of the United States economy, raking in over 1.2 trillion dollars in premiums a year; employing more than 2.5 million people; and undergirding transactions as simple as home purchases and as complex as corporate mergers and acquisitions, the multi-trillion-dollar tort system, and a vast system of private risk management and loss avoidance advice. Despite playing these critical roles, the insurance market is surprisingly inefficient. Deep information asymmetries make it difficult for consumers to evaluate the quality of policies and carriers, for insurers to price risks properly, and make it possible for both sides to act opportunistically. What’s more, behavioral barriers hamper purchasers, who often buy too little or the wrong insurance. And, in some markets, private insurers might not be willing to supply enough insurance because the underlying risks cannot be adequately spread. Insurance regulation is a necessary part of solving these complex market failures. Most of the previous legal scholarship about algorithmic justice has been in the context of information platforms, criminal justice, and employment discrimination. This article connects to those discussions and expands them in the specific context of insurance. It does so by providing a taxonomy of the changes in the insurance industry, the potential danger to consumers as a result of those changes, the reasons for regulation, and the ways that regulators must adapt to protect individual consumers and the insurance market.

보건의료 빅데이터의 윤리적 활용을 위한 방안모색: 동의가 아닌 합의 모델로의 전환*,**

The purpose of this paper is to examine how biomedical big data might be used in an ethically appropriate way. Biomedical big data is currently expected to create tremendous economic value as well as social value. For this reason there is an active debate among biomedical ethicists about which model of consent is most appropriate and efficient in this context. At first glance, the model of dynamic consent seems to be both justifiable and feasible, not only because it is based on the spirit of informed consent, but also because it allows for an additional process of consent through on-line platforms. However, it is doubtful that this model could be used in the context of biomedical big data since it is vulnerable to privacy protection and insensitive to ownership issues. Therefore, I argue that the most appropriate model of consent is an agreement model, which can reflect a fair distribution of the benefits from the use of biomedical big data and the privacy risk management. This agreement model not only promotes the autonomy of information givers, but also facilitates the long-term sustainable use of biomedical big data.

Much Ado About Nothing? Macro-Prudential Ideas and the Post-Crisis Regulation of Shadow Banking

Post-crisis, macro-prudential ideas have challenged the epistemic authority of private risk management technologies, declaring them to be pro-cyclical contributors to systemic risk. This discursive challenge has been most critical of the shadow banking system, where private risk management instruments are central. This challenge, however, has not been translated into regulatory tools which reflect these convictions. This paper studies this process of discursive challenge to (failed) regulatory intervention for the case of the repo-market, the heart of the current shadow banking system. It traces regulatory efforts on the global and EU level from regulatory statements to (lack of) action, documenting both the persistent articulation of macro-prudential ideas challenging private risk-management systems and timid to no regulatory intervention. It links this hiatus to international coordination problems, the need for macro-prudential action to span regulatory communities, involving banking and financial market authorities and disagreements between micro- and macro-prudentially oriented regulators. The lack of evidence and the difficulty to generate it are identified as major impediments for regulatory consensus, further aggravated by ambiguities about the goals of anti-cyclical regulation. Beyond governance problems and the persistent appeal of private risk-management systems, the paper thus points to difficulties operationalizing macro-prudential ideas as a major explanatory factor.

Livestock Disease Management for Trading Across Different Regulatory Regimes

The maintenance of livestock health depends on the combined actions of many different actors, both within and across different regulatory frameworks. Prior work recognised that private risk management choices have the ability to reduce the spread of infection to trading partners. We evaluate the efficiency of farmers’ alternative biosecurity choices in terms of their own-benefits from unilateral strategies and quantify the impact they may have in filtering the disease externality of trade. We use bovine viral diarrhoea (BVD) in England and Scotland as a case study, since this provides an example of a situation where contrasting strategies for BVD management occur between selling and purchasing farms. We use an agent-based bioeconomic model to assess the payoff dependence of farmers connected by trade but using different BVD management strategies. We compare three disease management actions: test-cull, test-cull with vaccination and vaccination alone. For a two-farm trading situation, all actions carried out by the selling farm provide substantial benefits to the purchasing farm in terms of disease avoided, with the greatest benefit resulting from test-culling with vaccination on the selling farm. Likewise, unilateral disease strategies by purchasers can be effective in reducing disease risks created through trade. We conclude that regulation needs to balance the trade-off between private gains from those bearing the disease management costs and the positive spillover effects on others.

Modeling Privacy Leakage Risks in Large-Scale Social Networks

The current culture that encourages online dating, and interaction makes large-scale social network users vulnerable to miscellaneous personal identifiable information leakage. To this end, we take a first step toward modeling privacy leakages in large-scale social networks from both technical and economic perspectives.From a technical perspective, we use Markov chain to propose a dynamic attack-defense tree-based model, which is temporal-aware, to characterize an attack effort made by an attacker and a corresponding countermeasure responded by a social network security defender. From an economic perspective, we use static game theory to analyze the ultimate strategies taken by the attacker and the defender, where both rational participants tend to maximize their utilities, with respect to their attack/defense costs. To validate the proposed approach, we perform extensive experimental evaluations on three real-world data sets, triggered by the survey of over 300 volunteers involved, which illuminates the privacy risk management of contemporary social network service providers.

Economic Incentives for Managing Filterable Biological Pollution Risks from Trade.

Infectious livestock disease problems are "biological pollution" problems. Prior work on biological pollution problems generally examines the efficient allocation of prevention and control efforts, but does not identify the specific externalities underpinning the design of efficiency-enhancing policy instruments. Prior analyses also focus on problems where those being damaged do not contribute to externalities. We examine a problem where the initial biological introduction harms the importer and then others are harmed by spread from this importer. Here, the externality is the spread of infection beyond the initial importer. This externality is influenced by the importer's private risk management choices, which provide impure public goods that reduce disease spillovers to others-making disease spread a "filterable externality." We derive efficient policy incentives to internalize filterable disease externalities given uncertainties about introduction and spread. We find efficiency requires incentivizing an importer's trade choices along with self-protection and abatement efforts, in contrast to prior work that targets trade alone. Perhaps surprisingly, we find these incentives increase with importers' private risk management incentives and with their ability to directly protect others. In cases where importers can spread infection to each other, we find filterable externalities may lead to multiple Nash equilibria.

Skin in the game: comparing the private and public regulation of isotretinoin

AbstractThis paper engages in a comparative-institutional analysis of the private and public risk-management programs of the drug isotretinoin, which are designed to prevent the undesired effects isotretinoin has on fetal development. This case study sheds light on the comparative effectiveness of private and public regulation in the pharmaceutical and healthcare markets. A range of evidence indicates that the private risk management program successful in reducing pregnancies and educating patients about the harmful effects isotretinoin can have on a fetus. These findings challenge a consensus found in the medical literature that the private program needed to be supplanted and contain implications for future risk-management policy in healthcare.

The Extended Model of the Effects of Privacy-Related Factors on the Intention of Facebook Continued Use : Moderating Effects of Online Privacy Risk Management Strategies

The Extended Model of the Effects of Privacy-Related Factors on the Intention of Facebook Continued Use : Moderating Effects of Online Privacy Risk Management Strategies