Process-based Risk Research Articles

A fuzzy logic evolution of the functional resonance analysis method (FRAM) to assess risk in ground operation

PurposeThe basis of safe flight is the management of risks. This paper aims to present a new process-based risk assessment model, with an approach to calculate the risk score.Design/methodology/approachSince thousands of minor changes occur within ground operations, it is difficult to calculate how much risk these variations will pose. This paper proposes a risk assessment model fed from analysis of ground operation processes using functional resonance analysis method (FRAM) and fuzzy logic.FindingsFRAM is used to detect variations in ground operation. Using the FRAM analysis, it has been revealed how much risk the process steps described in the procedures involve. The risk score was calculated by combining the probability value obtained from the airline’s database and the severity assessment of the expert group in fuzzy logic. The risk level can be monitored dynamically with the transfer of events in the airline’s database to the process-based risk assessment model.Originality/valueFRAM analysis, which is used to detect function variations before undesirable risk occurs, has brought a proactive approach to risk assessment. The process-based risk assessment model allows the creation of new safety parameter indicators to be followed to reduce the risk level of the function with a high-risk level. The proposed approach can be used for other operational areas in aviation as well.

Process-based risk measures and risk-averse control of discrete-time systems

For controlled discrete-time stochastic processes we introduce a new class of dynamic risk measures, which we call process-based. Their main feature is that they measure risk of processes that are functions of the history of a base process. We introduce a new concept of conditional stochastic time consistency and we derive the structure of process-based risk measures enjoying this property. We show that they can be equivalently represented by a collection of static law-invariant risk measures on the space of functions of the state of the base process. We apply this result to controlled Markov processes and we derive dynamic programming equations. We also derive dynamic programming equations for multistage stochastic programming with decision-dependent distributions.

A fuzzy-based model for risk assessment of routes in oil transportation

The transportation of oil is the final step that the oil is taken before it is distributed to consumer. Road transport is a type of oil transportation methods, and transfers between facilities of primary and secondary bases are carried out by tanker trucks. A particular advantage of tanker trucks is that they provide direct travel from the source to the destination. However, road transport involves possible hazards for population and environment. At this point, this study presents a fuzzy-based risk assessment model for the routes in an oil transportation company. Fuzzy analytic hierarchy process, which is a commonly used multi-criteria decision-making method, is applied in weighting nine criteria related to the road characteristics. Then, risk scores for eleven different routes which the tanker trucks of the company followed are determined by using a basic multi-criteria scoring method. Results of the case study emerge that the most important criterion is narrow road. The riskiest route for the company has been determined. In order to reduce risks to an acceptable level, a number of control measures are suggested such as to assign experienced drivers for this route, provide regular training for drivers, make regular vehicle maintenance and transport large quantities at one time as possible. To demonstrate validity, a comparison is also provided between the proposed approach and Pythagorean fuzzy analytic hierarchy process-based risk scoring model. In conclusion, this study contributes to the applicability of fuzzy analytic hierarchy process to assess riskiness for routes in oil transportation.

FMEA of manual and automated methods for commissioning a radiotherapy treatment planning system.

To evaluate the level of risk involved in treatment planning system (TPS) commissioning using a manual test procedure, and to compare the associated process-based risk to that of an automated commissioning process (ACP) by performing an in-depth failure modes and effects analysis (FMEA). The authors collaborated to determine the potential failure modes of the TPS commissioning process using (a) approaches involving manual data measurement, modeling, and validation tests and (b) an automated process utilizing application programming interface (API) scripting, preloaded, and premodeled standard radiation beam data, digital heterogeneous phantom, and an automated commissioning test suite (ACTS). The severity (S), occurrence (O), and detectability (D) were scored for each failure mode and the risk priority numbers (RPN) were derived based on TG-100 scale. Failure modes were then analyzed and ranked based on RPN. The total number of failure modes, RPN scores and the top 10 failure modes with highest risk were described and cross-compared between the two approaches. RPN reduction analysis is also presented and used as another quantifiable metric to evaluate the proposed approach. The FMEA of a MTP resulted in 47 failure modes with an RPNave of 161 and Save of 6.7. The highest risk process of "Measurement Equipment Selection" resulted in an RPNmax of 640. The FMEA of an ACP resulted in 36 failure modes with an RPNave of 73 and Save of 6.7. The highest risk process of "EPID Calibration" resulted in an RPNmax of 576. An FMEA of treatment planning commissioning tests using automation and standardization via API scripting, preloaded, and pre-modeled standard beam data, and digital phantoms suggests that errors and risks may be reduced through the use of an ACP.

A process-based dependency risk analysis methodology for critical infrastructures

This paper applies research in dependency modelling to a process-based risk assessment methodology suitable for critical infrastructures. The proposed methodology dynamically assesses the evolution of cascading failures over time between assets involved in a business process of an infrastructure. This approach can be applied by a CI operator/owner to explore how a failure in a single component (asset) affects the other assets and relevant business processes. It could also be applied in an analysis that includes multiple CI operators in the same supply chain to explore the dependencies between their assets and explore how these affect the provision of key societal services. The paper presents a proof-of-concept tool, based on business-process risk assessment and graph modelling, and a realistic case example of a rail scheduling process. The approach allows risk assessors and decision makers to analyse and identify critical dependency chains and it can reveal underestimated risks due to dependencies.

A process-based dependency risk analysis methodology for critical infrastructures

This paper applies research in dependency modelling to a process-based risk assessment methodology suitable for critical infrastructures. The proposed methodology dynamically assesses the evolution of cascading failures over time between assets involved in a business process of an infrastructure. This approach can be applied by a CI operator/owner to explore how a failure in a single component (asset) affects the other assets and relevant business processes. It could also be applied in an analysis that includes multiple CI operators in the same supply chain to explore the dependencies between their assets and explore how these affect the provision of key societal services. The paper presents a proof-of-concept tool, based on business-process risk assessment and graph modelling, and a realistic case example of a rail scheduling process. The approach allows risk assessors and decision makers to analyse and identify critical dependency chains and it can reveal underestimated risks due to dependencies.

Process-oriented risk assessment methodology for manufacturing process evaluation

A process-oriented quantitative risk assessment methodology is proposed to evaluate risk associated with processes using modelling, simulation and decision-making approaches. For this purpose, risks involved in a process and the corresponding risk factors are identified through an objective-oriented risk identification approach. The identified risks are first analysed qualitatively in the failure mode effect and critical analysis process and then evaluated quantitatively in a simulation environment employing a process-based risk measurement model. To ease the decision-making process in case of multiple but heterogeneous risk measures, a global risk indicator is developed using the normalisation and aggregation techniques of the decision theory. Using the proposed methodology as a decision-making tool, alternative manufacturing scenarios (i.e. manufacturing process plans) are developed and ranked on the basis of desirability. Although the methodology is illustrated with a case study issued from the part manufacturing, it is also applicable to a wide range of other processes.

Dynamic process-based risk assessment of debris flow on a local scale

After the Wenchuan earthquake in China, debris flows have been more frequent. Multiple debris flows commonly occur in earthquake-affected areas during heavy rainfall, often causing losses of lives and property. We analyzed the dynamic movement of debris flows and proposed a quantitative method of debris flow hazard assessment, based on kinetic energy. Validated using field study of an actual debris flow disaster, these analyzes help determine the type, quantity, distribution, economic worth, and susceptibility of elements at risk. We established a method to determine vulnerability of elements at risk and we propose a systematic and quantitative method for local risk analysis of debris flows. We applied the proposed method to a debris flow in Qipan gully, which caused serious damages for Duwen Highway and Qipan settlements of Sichuan Province in 2013. With the support of a debris-flow movement numerical simulation, remote sensing, and GIS techniques, the proposed method analyzed disaster effects and divided the hazardous areas into three risk zones. Calculated risk zones coincided with the actual distribution and severity of damage of the event, suggesting that the risk assessment generated by the proposed method is consistent with results from the actual disaster.

Research on the process-based risk evaluation method of groundwater pollution for contaminated site

A universal method to evaluate groundwater pollution risk with the site scale has not been established. The groundwater pollution risk is commonly evaluated by overlaying the results of groundwater vulnerability and pollution sources, but this method is inapplicable for contaminated sites. Considering the current supervision demands of groundwater pollution in China, this paper suggests a risk evaluation method for contaminated sites. The present and forecasted groundwater pollutant concentrations and the variation trend of groundwater quality were used to get the risk classes of groundwater pollution. Chromium is one of the most common groundwater contaminants found at industrially contaminated sites. A chromium residue disposal site in Baotou, China was selected as the study area. The groundwater flow model and solute transport model were constructed by MODFLOW and MT3DMS. Based on the simulation results of the numerical model, the groundwater pollution risk of the contaminated site was divided into four classes, and the regulation measures of groundwater pollution were suggested. This study could provide guidance for the environmental supervision and management of contaminated sites.

An Analytic Hierarchy Process-Based Risk Assessment Method for Wireless Networks

This paper presents a wireless risk assessment method to help an administrator manage wireless network security. The assessment method consists of a risk model and an assessment measure. The risk model is in charge of modeling the wireless network risk. Security requirements, wireless attacks, and system configurations are considered in the model. The assessment measure is an algorithm which determines the risk value of the wireless network according to the risk model. Our risk model is developed upon an extended analytic hierarchy process, which contains the 4 layers: the risk layer, the requirement layer, the attack layer, and the configuration layer. The separate layers of the risk model are helpful in dealing with the dynamics of a wireless network because only the related layers are introduced to the assessment measure when changes of the network are detected. Based on the risk model per device, our assessment measure evaluates the wireless network risk in consideration of the relations between devices, attacks, and configurations. Hence, our risk assessment method, composed of the risk model and the assessment measure, can determine the wireless network risk efficiently while considering the dependencies in the wireless network. Two examples are introduced in this paper to examine the feasibility of our method. In the first example, we demonstrate that the risk values derived by our method meet the ground truth by performing practical experiments. The second example shows that our method can evaluate the risk of a changing wireless network with efficiency, and can distinguish disparities in different wireless networks.

Preface to the special issue on business process management

It is our pleasure to present the special issue of Information Systems and e-Business on Business Process Management. This issue incorporates three select papers that originated from the BPM track of the European Conference on Information Systems 2008. Since then, the papers have gone through several rounds of review and revision, and represent a cross-section of research in the BPM area that touches, in particular, upon managerial and strategic issues. The first paper entitled ‘‘Toward a theory of managing creativity-intensive processes: a creative industries study’’ by Stefan Seidel addresses the application of Business Process Management principles in settings where the creativity of process participants is more highly prized than the performance of highly structured and repetitive operations. Seidel studies processes in the film and visual effects industry and identifies several categories of uncertainty and risk that seem to characterize processes in these settings. His findings provide a foundation for further studies of processes in creative industries as well as processes where client involvement highly dictates the necessary steps and acceptable outcomes. The second paper entitled ‘‘Formalizing process-based risk with Value-Focused Process Engineering’’ by Kristian Rotaru, Carla Wilkin, Leonid Churilov, Dina Neiger and Andrzej Ceglowski proposes a formal notation for the representation of process risk in goal-oriented processes. Drawing from the concept of value-focused process engineering, the authors extend the well-known Event-driven Process Chain modeling notation with constructs to capture risk objectives, adverse events, risk

A Business Process-Based Risk Evaluation Framework

To present the essence of information system risk evaluation and improve the effect of evaluation, the paper puts forward a business process-based information system risk evaluation after analyzing the current risk evaluation methods. The framework begins with the description of business process in perspective of information security and then analyzes and assesses the business activities. The risk-control evaluation of business activities is brought forward and the optional security control measures are comprehensively evaluated so as to ensure security of business activities. The framework focuses on business process activities so that information system assets, their vulnerabilities and threats are associated and evaluation of isolated and meaningless assets is avoided.

Operational Risk Management in Social Services Contracting

Governments are increasingly contracting with not-for-profit providers to deliver on policy objectives. These organisations are perceived to be cost-effective, flexible and close to their communities. Yet contracting out raises financial, service and reputational risks. Public sector funders receive a plethora of advice on how to balance their operational risks when contracting; however not-for-profit organisations state that funders’ tight control limits their autonomy and effectiveness. This research, into how funders assess and manage risk, links public sector risk management to a dichotomous risk theory. While some funders practised process-based risk management, others practice performance-based risk management. Central government advice, organisational culture, and experiences are the main contingent factors that appear to influence a funders’ risk management choices. As a dynamic model, these factors have their strongest affect when there is a risk failure, or when the factors combine so that public funders recognise their interdependence with private not-for-profit providers.

Formalizing process-based risk with Value-Focused Process Engineering

Following calls to advance the integration of risk and business process modeling paradigms, this paper formalizes the process of incorporating risk into business process models through the principles of Value-Focused Process Engineering (VFPE). In doing so, the paper aims to extend the existing VFPE modeling notation to reflect a set of necessary constructs required to adequately represent risk in goal-oriented business-process models. The extended set of constructs is proposed to support a formal systems view of process-based risk. Process-based risk is formalized on the one hand, as a product of complex interactions between activity-based elements, and on the other hand, as a natural component of the value creation mechanism of an elementary function or a complex process. The proposed risk-aware VFPE formalism also formulates rules for decomposing risk in process models according to the organizational values, thereby enabling better risk visibility, reducing process complexity, and ensuring continuity of business processes.

Security incident response: rethinking risk management

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes a standard of care for healthcare data security, outlining a set of technical, physical, and administrative security practices intended to protect electronic patient data. The regulation requires organizations to conduct information-security risk assessments to ensure that their security programs effectively mitigate their risks. Because the regulation does not mandate a specific technique, many variants of risk assessments have been employed to satisfy the requirement. This paper examines limitations in process-based risk assessments used by many healthcare organizations to comply with the HIPAA risk assessment requirement. It specifically focuses on the following three limitations: (1) lack of detailed operational context, (2) limited analysis of combinatorial effects of risk conditions, and (3) the tendency for local optimization of risk mitigation efforts.