Risk Management Process Research Articles

Lawyers’ perspectives on how to manage the psychosocial risks they face in the legal assistance sector

A growing body of research reveals that the psychosocial risks faced by lawyers working in the legal assistance sector are not being adequately managed by employers, which is taking its toll on the on the mental wellbeing of lawyers. In this qualitative study, 16 lawyers from the sector in Australia describe measures that could be taken to manage these risks. This includes managing work loads/type/clarity/control, supporting isolated staff, creating supportive teams, training, supervision and mentoring, effective and supported managers, rewards and recognition, a safe physical environment, recruitment and retention, risk assessment and management processes, reporting mechanisms and adequate policies and procedures. Participants recommended preventative measures, suggestions solutions need to be tailored to lawyers and their work setting; and be actioned and modelled from the top of the organisation. The rich detail provided by participants offers employers in the sector a much needed list of strategies to implement.

Application of reinforcement learning for integrating project risk analysis and risk response planning: A case study on construction projects

Project Risk Management contains processes ranging from planning to control. It is applied to identify risks, analyze them, and design responses to change the occurrence rate and/or the effect of project risks. It is important for project managers to analyze the effects of the risks in projects and also consider project risks in their decisions. If project risks are not addressed during the risk management process, issues such as schedule delays, cost overruns, and even project failure may occur. This paper aims to introduce a Markov method to integrate project risk analysis and risk response planning. This method is applied to forecast the following status of the project when limited information about the project is available. Moreover, earned value management (EVM) methods were used to include various types of project risks through the project lifecycle. The model also offers the capability to choose the most effective risk response for managing project risks through the application of the Markov decision process (MDP). Eventually, we introduce a case study to demonstrate functionality and effectiveness of the presented approach. Solving the model allows for identifying the best set of risk response strategies tailored to each specific project state. The computational results illustrate that the current state of the project has a significant impact in the process of risk response planning. Since uncertainty is the inherent characteristic of projects, the use of the project’s current state is more reliable than the previous status of projects, and the Markov method is applied in this research because it uses the current state for its modelling. Using this method, managers can predict the future state of projects and find the best response in each status of projects.

HOW RISK MANAGEMENT CAN BE IMPLEMENTED IN NEW AGRO-PRODUCT DEVELOPMENT (NAPD)?: A SYSTEMATIC LITERATURE REVIEW

New product development is highly complex because it integrates technical challenges from both internal and external sources. The potential for uncertainty or failure exists at every step of the product development process. One of the important tools to minimize risks in product development is risk management in new product development. This paper aims to review some research literature on the concept, process, and category of risk management in new agro-product development. This research uses a literature review analysis to analyze the concept and process of risk management in new product development. The articles were selected from Emerald, Elsevier, Springer, MDPI, and Taylor & Francis databases. The findings of this study demonstrate the critical role of risk management in minimizing risks associated with new product development through the implementation of diverse strategies. Risk management involves identifying, analyzing, evaluating, and treating risks. A variety of internal and external factors influence risk in product development. Internal factors are design, production, financial, management (organizational), marketing, market, technology, and supplier risks. External factors include suppliers, customers, and retailers outside the company. Many businesses, including small and medium-sized enterprises (SMEs), have adopted risk management to prevent product failures and financial losses. This paper provides a research framework for applying risk management to new agroindustrial product development.

THE ROLE OF INTERNAL AUDIT FUNCTION IN ENHANCING RISK MANAGEMENT

This study explored the role of internal audit in enhancing risk management, focusing on banks. It aimed to assess internal audit effectiveness, monitoring processes, and risk management. The research posed questions on the effectiveness of internal audits and monitoring processes, and the extent of risk management's effectiveness using questionnaire as the survey instrument. Three hypotheses were tested using a questionnaire survey method. Findings revealed effective internal audit functions at First Bank at Okpara Avenue, in Enugu, with robust monitoring processes ensuring smooth business transactions. An effective risk management process was also identified, capable of detecting and preventing errors and fraud. The study evaluated the influence of these variables on Nigerian banks, employing the chi-square model. The result showed that the value of calculated X20.298 is greater than the critical value of X20.05 at a significant of 0.585. Therefore, we reject the null hypothesis and accept the alternative hypothesis. Thus, we accept that internal audit functions are effective in First Bank and are positive and significant. Results indicated that a well-managed internal audit environment contributes to risk management and fraud prevention, reducing fraud likelihood. Recommendations included ensuring proper management of the internal audit environment, reviewing customer and supplier complaints, and securing accurate financial records.

Corporate Hereditary Succession Risk Management

The relevance of the study lies in the presence of problems related to hereditary transfer of business, especially in conditions of economic turbulence in the Russia, which, together with the loss of enterprises, can lead to the loss of accumulated knowledge and created technologies, which will put the Russian economy at a disadvantage compared to international competitors. In addition, this topic has not been sufficiently studied from the perspective of enterprise risk management. In the study, the factors of successful hereditary succession are divided into internal and external ones. External factors include a perfect regulatory framework and availability of necessary socio-economic infrastructure; internal factors include adherence to the principles of corporate governance G20/OECD, formation of a systematic approach to the transfer of the company to heirs, including development of their competencies, compliance with the legislative norms of the Russian Federation and formation of official succession plans. The purpose of the study is to develop a risk management mechanism for the hereditary succession of a corporation. Materials and methods. In the course of the research, the following methods were used: analysis of Russian and foreign scientific sources and business Internet resources, the case method, the «bow tie» risk management method (GOST R ISO/IEC 31010-2011), the scoring method based on the interpretation of scientific publications. Results. An event of hereditary succession, having a dual nature, like any risk, can affect the financial performance of the company, the image of the company in the eyes of the consumer (risks in brand management) and other aspects of the company's activities, that is why careful preparation and selection of the most favorable moment at the stage of the company's life cycle, for example, during its economic growth are necessary. The practical experience described in the article has shown that the absence of a regulated process for transferring business ownership leads to significant losses: closure of enterprises, financial damage to the company and heirs, complete loss of business, a decrease in market share, etc. An impulse mechanism for preventing the risk of hereditary succession has been identified in studying the experience of Chinese companies, which is implemented through one-time events, such as charitable donations to strengthen reputation. A systemic mechanism for preventing the risk of hereditary succession was identified from the experience of Auchan company, in which both the organizational structure and a set of measures were aimed at increasing the stability of the company in transferring business to heirs. It is proposed to introduce a hereditary succession risk management mechanism at the enterprise based on GOST R ISO/IEC 31010-2011. The use of the risk analysis method («bow tie») made it possible to systematize the causes, consequences and to offer a set of preventive (drawing up a legally formalized inheritance plan, training the heir in management skills, appointing intermediaries in conflict resolution, assessing market changes and adapting to them) and mitigating (creating a reserve fund in case of crisis situations, maintaining stable relationships with partners and clients, support for employees during the transition period, legal support) measures to prevent the risk of hereditary succession. The mechanism represents a cyclical sequence of stages aimed at continuous improvement of the risk management process during business transfer. The interdisciplinary approach at each stage is carried out with the help of a team of specialists, the contribution of each of whom is evaluated on a 10-point scale. Conclusions. The proposed mechanism can be adapted for various industries and types of family business and will help to mitigate the risks of hereditary succession, preserve the stability of enterprises and the Russian economy as a whole.

Повышение эффективности стратегии управления рисками в бизнес-планировании

In today’s dynamic and competitive market, risk management is becoming an integral part of business planning. The relevance of this topic is due to the need to develop and implement new methods and approaches to risk management that help organizations adapt to rapidly changing conditions and ensure the sustainability of their business models. This work is a study that examines modern approaches and tools for optimizing risk management processes in the context of business planning. The novelty of the work lies in presenting an integration vision of ways to improve the effectiveness of risk management strategies in business planning. The proposed recommendations make it possible to make an informed choice of a risk management strategy, effectively implement alternative risk management strategies, and successfully switch between them depending on changing conditions.

The Application of Transgenic Technology

With the rapid development of biotechnology, transgenic technology has been widely used around the world, especially in agriculture and medical fields showing great potential. However, the safety of Gmos has always been a focus of concern for the public, scientists and policymakers. By analyzing the basic principles and application examples of transgenic technology, this paper evaluates the ecological and environmental risks and food safety issues that may be brought about by genetically modified organisms. In particular, data tables show the potential impacts of GM crops on ecosystems and their assessment of food safety. The study notes that while GM technology has the advantage of improving crop yield and stress resistance, its safety assessment requires a more rigorous scientific approach and a transparent risk management process. In recent years, relevant technologies have been gradually applied in the fields of research on gene function, production of animal bioreactors and construction of human disease animal models, etc., making the research of livestock gene function more efficient. This paper aims to provide a scientific basis for developing more rational regulatory policies, and suggests that future studies focus more on long-term effects and public acceptance.

RISK MANAGEMENT AS A DETERMINING FACTOR IN THE EFFECTIVENESS OF INNOVATION MANAGEMENT

Innovations are a key factor in competitiveness but are accompanied by risks such as technological failures and unpredictable market reactions. Effective risk management helps organizations minimize threats, stimulate creativity, and maintain long-term success by ensuring a balance between innovation and risk. This study analyzes the relationship between risk management and innovation management effectiveness. By evaluating how organizations can balance innovative efforts with the need for risk management, the paper emphasizes the importance of implementing risk management strategies to enhance innovation outcomes. Special attention is given to how risk management helps companies make strategic decisions, build an innovation culture, and effectively cope with challenges in competitive and market instability conditions. Risk management in the context of innovation plays a crucial role in the successful implementation of innovation projects. Innovations, by nature, are associated with uncertainty and risks that can significantly affect their success. The risk management process includes identifying, assessing, mitigating, and monitoring various types of risks—technological, financial, market, and organizational. This process helps organizations not only minimize potential threats but also effectively leverage opportunities arising from these risks. The article discusses key stages of risk management and how they can be integrated into innovation processes to ensure the successful implementation of projects and achieve long-term growth and competitive advantages.

Risk management in Moroccan public hospitals: a literature review.

The objective of this review is to provide a comprehensive analysis of risk management practices in the healthcare sector, with a particular focus on identifying challenges and strategies in Moroccan hospitals. A literature search was carried out on several academic search engines using search terms reflecting the relationship between risk management and public hospitals in Morocco. The Moroccan public hospital is confronted with several disjunctions, which can be sources of multiple risks. This influences the quality of care provided to patients and can sometimes threaten their vital prognosis. The risk management process can help health professionals, researchers and risk managers to be agile and identify and anticipate risks in order to avoid serious accidents that can affect the whole organization, especially after the pandemic lived experiences (COVID-19). Protecting human life in an environment where risks are omnipresent is a dilemma that every hospital organization must confront. So, risk management in the hospital is not a simple process, given the interaction of several components and the sensitivity of the field. Risk management in this establishment must be rigorous because every error can cost human life. In this sense, the analysis of risk management processes in Moroccan hospitals, based on what really exists, enables the identification of shortcomings in order to master the risk management system and thus protect goods and services as well as human life, which is the ultimate goal of the hospital organization's existence.

Differentiating “must–have” and “should–have” supply chain capabilities for enhanced performance: a necessary conditions analysis

Purpose This study aims to identify the “should have” and “must have” capabilities required to boost a supply chain’s robustness and operational performance. Research on supply chain capabilities and their impact has long been central to the supply chain discipline. However, empirical studies continue to report mixed results regarding the relationship between integration and performance or agility and robustness. Using a novel methodological approach, this study explores how supply chain integration, agility and supply chain risk management activities influence the operational performance and robustness of supply chains. Design/methodology/approach Data was collected through surveys and analyzed using SmartPLS 4 and necessary condition analysis (NCA). This combined approach shifts focus from average trends to identifying the required levels of capabilities, offering insights into the necessity logic of supply chain strategies. Findings The study reveals that supply chain risk management and internal integration significantly influence operational performance and robustness. It also supports agility as a precursor to enhancing supply chain robustness, aligning with contemporary theoretical perspectives. Practical implications The findings suggest the importance of integrating risk management and internal processes to enhance supply chain performance and robustness. Additionally, agility emerges as a critical strategy in navigating disruptions, emphasizing the need to prioritize it in supply chain management. Originality/value By adopting a holistic approach grounded in dynamic capability theory, this study contributes to understanding the interplay of supply chain strategies amid unprecedented challenges. The combined use of SmartPLS 4 and NCA offers a novel perspective, shedding light on the necessary logic of supply chain capabilities.

Assessment of the adequacy of minimum guarantee sums in mandatory medical malpractice insurance in Poland in relation to claims for annuities by injured patients

This article examines the adequacy of minimum guarantee sums in compulsory insurance for entities providing medical services in Poland, within the framework of risk management principles and objectives. The authors refer to the principles and functions of the risk management process and the perspectives of various stakeholders. Value of risk is analysed in relation to annuities claimed for bodily injury, using the maximum probable loss approach in cases of serious injury resulting in the loss of the ability to work and lead an independent life at a young age—key components of annuity claims. To determine the value of the damage, the authors conduct example annuity calculations using the scenario method. The calculations were conducted in relation to two medical malpractice cases involving Polish medical entities: one concerning an injured Polish patient, and the other a German patient (illustrating medical tourism from a neighbouring country). In both cases, Polish substantial law applies, as determined by the location of the tort. That is why, the claim assessment is based on life expectancy tables and macroeconomic data from both the Polish and German markets. The key findings lead to the conclusion that the insurance sums stipulated by the legislator are grossly inadequate in relation to the level of injury sustained. Limited empirical examples and scenario analyses of potential claims for serious bodily injury (without even considering the worst-case scenarios) suggest that the legislator’s minimum insurance sums are exceeded by 4 to over 100 times (for foreign patients), solely for annuities. This has negative consequences—albeit varying across different stakeholders. The findings also show that the value of annuities is indeed spread over time, but it significantly surpasses compensation claims, underscoring the importance of annuities in risk assessment. The results concerning the potential claim values should form the basis for the legislative decisions regarding minimum guarantee sums, especially if we assume the primacy of the proper protection of potentially injured parties. Furthermore, these findings are also important in shaping the scope of protection under voluntary insurance instruments.

Improving the Process of Managing Psychosocial Risks in Organizations.

Psychosocial risks (PSRs) are identified as one of the main modern occupational safety issues, primarily related to occupational stress, and need to be reduced to safe levels in accordance with international requirements. The research purpose is to improve the process of managing the PSRs in the occupational safety and health management systems of employees, taking into account the impact of psychosocial dangers in accordance with the requirements of ISO 45001:2018 and ISO 45003:2021 standards. To develop the process of managing the PSRs, a system analysis method is applied, which allows determining the structural relationships between the variable elements of dangerous psychosocial factors described in the ISO 45003:2021 standard. The bow-tie model has been improved to determine the relationship between psychosocial dangers and the dangerous event occurrence - experiencing stress by an employee, taking into account the influence of various dangerous psychosocial factors, which provides for an additional risk level assessment for restoring the health of an employee who has experienced stress. The process of psychosocial risk management consisting of ten steps is proposed, which involves identifying the relationship between psychosocial dangers and consequences for human health, taking into account the impact of various dangerous psychosocial factors based on questionnaires, followed by analysis and processing of the duration and intensity of experiencing stress. To reduce the impact of subjective assessments of the duration and intensity of experiencing stress on the psychosocial risk level, it is proposed to take into account the value of individual perception of experiencing stress (stress resistance) and the employees' health condition. The scientific novelty is to determine the psychosocial risk level as the sum of the risk values from the impact of each dangerous psychosocial factor, which are characteristic of aspects of work organization, social conditions at work, working environment, equipment, dangerous tasks and the level of employee health. The practical value is the development of scales for assessing the impact of dangerous psychosocial factors and a form for documenting the process of managing psychosocial risks with the indication of precautionary measures to control them.

Service quality management under risk prioritization and imprecise information: a hybrid fuzzy approach

PurposeConventional risk prioritization methods rely on crisp inputs but struggle with imprecise data and hesitancy, resulting in inaccurate assessments that affect service and information quality and performance monitoring. This study proposes a fuzzy data-driven risk prioritization model for service quality under imprecise information.Design/methodology/approachEnterprise risk management is crucial for service quality management, ensuring effective identification, assessment and mitigation of risks impacting service delivery and customer satisfaction. This paper proposes a fuzzy data-driven multi-criteria model for risk prioritization involving multiple decision-makers. It introduces a hybrid method combining intuitionistic and hesitant fuzzy group decision-making to assess better and prioritize risks based on decision-maker preferences.FindingsThe proposed hybrid fuzzy model improves service quality in business operations by efficiently representing uncertain information in traditional frameworks. It helps identify potential risks in advance and enhances control over business operations, enabling organizations to benchmark service quality and identify best practices. Accordingly, organizations acquire information and background knowledge to benchmark their service quality. This, in turn, improves service quality under performance management.Research limitations/implicationsDespite the advantages of fuzzy models in risk prioritization, such as mimicking human reasoning more accurately, their complexity can hinder adoption. The intricate computational steps may deter shop-floor managers who prefer the more straightforward conventional crisp RPN approach, which is easier to understand and implement. However, while developing a hybrid fuzzy risk prioritization model may require more effort, its benefits become apparent over time. Once developed, the model can be integrated into software applications, allowing decision-makers to use it easily. This integration simplifies fuzzy computations and enhances risk prioritization, leading to more informed decision-making and improved risk management in the long term.Practical implicationsThe proposed robust fuzzy framework improves risk management by integrating uncertain information and multiple decision-makers expertise, leading to more reliable outputs that enhance strategic decisions and operational efficiency.Originality/valueWe validate the proposed approach at an integrated steel plant’s risk management process, covering broad areas of the service quality domain. To the best of our knowledge, no study exists in existing literature attempting to explore the efficacy of the proposed hybrid fuzzy approach in risk management practices at prime sectors like steel. The study’s novelty is backed by this validation experiment, which indicates that the effectiveness of the results obtained from the proposed multi-attribute hybrid fuzzy methodology is more practical. The model’s outcome substantially adds value to the current risk assessment and prioritization literature that significantly affects service quality.

THE VISION AND IMPLEMENTATION OF INTELLIGENT SECURITY SYSTEM

The implementation of artificial intelligence in all areas of information technology promises significant productivity improvements, particularly in security systems. In the context of modern threats and a high level of unpredictability, security systems are an environment where the use of intelligent technologies can provide maximum efficiency. Intelligent security systems not only respond to incidents but also predict their development, enabling proactive actions and risk minimization. Such systems represent a new approach to security, focusing on situational awareness and real-time data processing. This article presents approaches to the implementation of an intelligent security system capable of detecting and analyzing situations, using the collected information to make operational decisions. The core of the system is based on the General Formal Ontology, which allows for the creation of a unified model of concepts and objects, ensuring data consistency and interpretability. This approach simplifies the integration of the system with other components and expands its application capabilities. The initial version of the intelligent security system includes two key modules: a front-end for user interaction and a back-end that handles data processing and system management. These components perform essential functions such as access control and surveillance, allowing for effective management of security processes in real-time. A vital part of the system is the knowledge base, which contains scenarios of typical incidents and algorithms for handling them, enhancing the responsiveness and reducing the number of false alerts. The system provides not only monitoring but also analytics, optimizing risk management processes. The implementation of such solutions opens new perspectives for the integration of AI into security systems, enhancing their efficiency. The proposed architecture allows for the development and scaling of the system in accordance with new requirements and challenges faced by modern infrastructures. This research represents a significant step towards the creation of next-generation security solutions, focused on high performance, reliability, and situational awareness.

A Comprehensive Risk Based IT Governance Framework for SaaS Adoption in Capital Market

ABSTRACT Software as-a-service (SaaS) adoption is essential in regulated industry such as capital market to bring in scalability, required to deal with the fluctuations in trading volumes, and agility, required to stay responsive to changing market conditions. In this context, the study examines the factors that the capital market organization look for in adopting SaaS. Based on the perceived risk theory and prospect theory, we propose a perceived risk based IT governance framework in SaaS adoption decision in capital market. Following a case study-based research methodology, we examined the factors that influence the risk perception of the decision makers about SaaS-based solution in a capital market industry. We found that the decision to opt for SaaS adoption in organization depends on (i) the top management’s consideration for risk preference, problem framing, decision domain, and data security, and (ii) organizational processes in practice such as IT governance archetype and risk management processes. Based on this, we generate a risk score for a capital market firm to weigh potential benefits and risks in adopting SaaS. In this study, we assume that the top management provides guidance toward firm’s risk appetite which is then compared to the generated risk score to decide for SaaS adoption. This study contributes to the technology adoption literature by emphasizing the role of individual risk preferences and problem framing in influencing technology adoption decisions particularly for technologies that pose certain risks. Finally, the study contributes by bringing forth the role of an IT governance framework in assessing SaaS-related risks.

Systematizing the risk management process in clinical radiotherapy practice: Recommendations of the working group on risk management of the DGMP

PurposeThe Deutsche Gesellschaft für Medizinische Physik [German Society of Medical Physics] has recently published two coherent reports, No. 25 and No. 28, detailing the design and implementation of a risk management (RM) process for German radiotherapy (RT) departments. This study offers an overview and background of the efforts behind these reports. Methods and MaterialsFor three years, up to nine medical physicists (MPs) with practical RM experience held weekly meetings to develop recommendations for a clinical RM process. Care was taken to ensure that the recommendations were equally applicable to RT departments of various sizes. A process-based method derived from the failure mode and effects analysis (FMEA) was created to identify and address risks from unintentional radiation exposure. This method was applied to exemplarily analyze the hazardous scenarios in breast RT using surface guidance and deep inspiration breath hold (DIBH) techniques. Three common criticality methods—risk matrix, risk priority number, and action priority—were applied, and each step was schematically explained for first-time users. Each report was peer-reviewed by two radiation oncologists and 11 MPs. ResultsIn report No. 25, basic requirements were outlined for running the RM process, conducting risk assessments, and monitoring clinical procedures. A three-year plan-do-check-act cycle was proposed for continuous improvement. In report No. 28, general process lists for external beam radiotherapy (EBRT), brachytherapy, and radionuclide therapy were designed. Based on the EBRT process list, 45 hazardous scenarios in the surface-guided breast RT in DIBH were identified. Two scenarios were used to illustrate handling instructions for the three criticality methods. ConclusionsThe recommendations provide clinical MPs and other health professionals with a pragmatic approach to RM, balancing both the needs of smaller practices and larger clinics in Germany. The risk of unintended exposures of patients is viewed acceptable once it has been lowered to a state that is as low as reasonably achievable.

Construction and Optimization of Comprehensive Risk Management System of Enterprises

In the complex and changing market environment, the construction and optimization of enterprise comprehensive risk management system is crucial. This study clarifies the connotation and objectives of enterprise comprehensive risk management, analyzes the main risks faced by the enterprise and the reasons for them, and constructs a comprehensive risk management system including risk management organization structure, process and information system. In terms of risk prevention and control in key areas, specific measures are proposed for strategic, financial and market risks. Meanwhile, through risk management technology innovation, culture construction and capacity enhancement, the efficiency and accuracy of risk management have been improved, and the risk awareness and professional quality of all staff have been enhanced. In conclusion, the comprehensive risk management system of an enterprise is a systematic project, which requires the joint efforts of all departments to adapt to the market environment and provide guarantee for the sound development of the enterprise.

Risk management of educational projects: substantiation of essential semantic units

Importance. The scale of implementation of educational projects in the Russian Federation is growing. Various federal projects, roadmaps for the development of education, strategies and policies for shaping the future of education, etc. are being developed. The results of our own research on risk management of educational projects are compared with the essential features characterising the current state of risk management of educational projects. The aim of the research is to substantiate the essential features identified and formulated in the course of this study, reflecting the meanings and values of the process of risk management of educational projects Materials and Methods. Texts of scientific articles, documents of applications for the status of the republican innovation site, documents summarising the work experience of the contestants in the field of educational projects in the republican contest “Teacher of the Year of the UR”, documents regulating educational projects within the framework of the National Project “Education”, documents aimed at the development of pedagogical education and training of pedagogical staff, texts of educational programmes of higher education–bachelor’s, master’s, and postgraduate courses. The research has been carried out using the methods of content analysis, critical discourse, reflexive problematisation, comparison and synthesis. Results and Discussion. The semantic units of the construct “risk management of educational projects” are highlighted and classified, and the results of our own research on each semantic unit are collated with the actual state of risk management processes. The study demonstrates that the risk management of educational projects is changing, the expert community is including risk management as an integral element in its activities, while the institutionalisation of risk management of educational projects is in the stage of methodological development.Conclusion. The activity of the subject of the educational project already includes risk management, while the process is built on the conscious use of an interdisciplinary approach, requiring special training, including the subject's awareness of the norms, rules, and regularities of risk management.

Minimising cybersecurity risk exposures in industrial control system environments: a techno-human vulnerability analysis approach

ABSTRACT Organisations operating IoT-enabled industrial control systems (ICSs) are concerned about growing cybersecurity risks and impacts to their systems. Cyber-attacks on ICSs demonstrate that technology alone is neither a problem nor a solution to the growing cybersecurity issues affecting these systems. As socio-technical systems, ICSs encompass the functions and interactions of social and technological system elements to enable and/or sustain industrial processes. Thus, a more effective cybersecurity risk management process needs to consider human and technology factors, especially for high-value industrial process targets. Combining critical reviews and gap analysis of existing vulnerability assessment methods with conceptual modelling, a Vulnerability Analysis Critical Impact Point Process (VACIP) methodology is proposed which considers both human and technological vulnerabilities within a cyber-physical system environment to inform an improved insight about attack criticality and impacts. VACIP is validated using a simulated industrial mini testbed; showing that it can enable practicable support for security vulnerability discovery, impact criticality analysis, weak link identification, and prioritised controls. Its novelty is demonstrated in its combination of technology and human vulnerability evaluations in the minimisation of system security exposures. It provides a useful guide for adopting effective cybersecurity risk assessment and exposure reduction strategies.

Evaluating the Impact of Technological Innovations on Operational Risk Management in Financial Institutions

This study evaluates the impact of technological innovations on operational risk management in financial institutions, focusing on how emerging technologies influence risk identification, mitigation, and management processes. Employing a qualitative approach through literature review and library research, this study synthesizes recent findings on the integration of technologies such as artificial intelligence (AI), blockchain, big data analytics, and cloud computing within financial risk frameworks. Findings indicate that these technologies offer substantial improvements in risk management by enhancing accuracy in risk detection, increasing response speed, and reducing human error. AI and machine learning models, for instance, are shown to enable real-time monitoring and predictive analytics, allowing institutions to identify potential risks before they materialize. Blockchain technology improves transparency and security in transaction processing, thereby mitigating fraud-related risks. Big data analytics provides insights into customer behavior, which can help detect anomalous activities and improve decision-making. However, the study also highlights challenges, including the need for robust cybersecurity measures, potential regulatory gaps, and skill shortages in handling complex technological systems. This study provides insights for financial institutions aiming to balance technological integration with effective risk management, underscoring the need for comprehensive frameworks that align technological advancements with regulatory compliance and organizational capability. Future research should focus on empirical studies assessing the long-term implications of these technologies on risk management efficacy in diverse financial settings.