Risk Analysis Process Research Articles

Автоматизированные системы управления рисками

Creating an industrial safety management system for enterprises requires the development and application of a set of mechanisms that ensure the prevention of accidents and incidents. Risk management systems are one of the most effective mechanisms for industrial safety. However, very little attention has been paid to automation of risk management. This article is devoted to the formation of the conceptual framework for creating automated risk management systems for industrial enterprises with hazardous production facilities. The paper analyzes the structural and logical scheme of risk management. It is shown that one of the most “risk-bearing” components of hazardous production facilities are technical devices. At the same time, the maximum level of automation is possible for technical devices in relation to their maintenance, repair, and risk management tasks. Analysis of the tasks related to risk management shows their complexity and diversity. The solution of these problems is possible through the use of modern information technologies. At the same time, it is necessary to create a unified database of hazardous production facilities, a comprehensive database of regulatory, technical and legal information, automation of risk modeling and analysis of control processes, and decision-making and implementation of processes that minimize risks. At the same time, the maximum level of automation is possible for technical devices in relation to their maintenance, repair, and risk management tasks.

Facilitating aspects and challenges for the implementation of a permanent education model for Health Surveillance

Introdução: O desenvolvimento de competências ocorre por meio da aprendizagem e envolve a aquisição de conhecimentos, habilidades e atitudes, e o desafio central que emerge para as organizações é disponibilizar oportunidades formais e informais de aprendizagem, integradas em programas de treinamento, desenvolvimento e educação. Objetivo: Identificar aspectos facilitadores e desafios para a implementação de um modelo de educação permanente para a Vigilância Sanitária. Método: Baseou-se em modelo de avaliação que contempla caracterização geral do contexto externo e interno, necessidades e dos componentes norteadores da estruturação dos processos formativos e análise técnica da avaliação de necessidades, do planejamento e execução e dos efeitos do programa de treinamento e desenvolvimento. Resultados: Os aspectos facilitadores identificados: competência legal de fomento aos estudos e pesquisas no âmbito do Sistema Nacional de Vigilância Sanitária (SNVS); normativos que ressaltam a valorização do desenvolvimento profissional; a realização de fóruns locais, regionais e federais, que especificam estratégias, desafios, eixos temáticos e áreas de formação para o SNVS; e a atuação da Agência Nacional de Vigilância Sanitária (Anvisa) como ente coordenador do Sistema, promovendo ações educativas em estados e municípios. Os desafios apontados: aprimoramento da articulação e integração dos entes do SNVS com outros setores da saúde; da atuação da Anvisa voltada para os demais entes do SNVS; da uniformidade na execução das ações; do comprometimento dos gestores com a análise de riscos e inovação dos processos de trabalho. Conclusões: Os processos para avaliação de necessidades e planejamento das estratégias de capacitação apresentam grandes oportunidades para aprimoramento, especialmente quando utiliza como referencial os diversos aspectos considerados relevantes pela literatura nas áreas de treinamento, desenvolvimento e educação.

Risk Evaluation in Software Project Using Bayesian Network Modeling

Project risk events are often influenced by each other and rarely act independently. In this context, effective methods to identify, model and analyze these risks are necessary. The objective of this article is to apply the risk analysis in a software development project, based on the model of the Software Engineering Institute (SEI), using the Bayes model to calculate the event probabilities and also the Noisy-OR calculation structure to assign the initial weights of the network of factors that influence the project. In this way, it is expected to increase the chances of success of the risk analysis process. The results obtained by the techniques adopted prove to be promising in assisting the process of decision making by the managers of software development projects.

Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems

Information technology (IT) security risk analysis preventatively helps organizations in identifying their vulnerable systems or internal controls. Some researchers propose expert systems (ES) as the solution for risk analysis automation since risk analysis by human experts is expensive and timely. By design, ES need a knowledge base, which must be up to date and of high quality. Manual creation of databases is also expensive and cannot ensure stable information renewal. These facts make the knowledge base automation process very important. This paper proposes a novel method of converting attack trees to a format usable by expert systems for utilizing the existing attack tree repositories in facilitating information and IT security risk analysis. The method performs attack tree translation into the Java Expert System Shell (JESS) format, by consistently applying ATTop, a software bridging tool that enables automated analysis of attack trees using a model-driven engineering approach, translating attack trees into the eXtensible Markup Language (XML) format, and using the newly developed ATES (attack trees to expert system) program, performing further XML conversion into JESS compatible format. The detailed method description, along with samples of attack tree conversion and results of conversion experiments on a significant number of attack trees, are presented and discussed. The results demonstrate the high method reliability rate and viability of attack trees as a source for the knowledge bases of expert systems used in the IT security risk analysis process.

Cost risk analysis for instance recommendation in a sustainable Cloud‐cyber‐physical system framework

AbstractCloud markets advocate powerful instances to take computation over from the cyber‐physical system (CPS). Combining the Cloud and CPS layer, the whole Cloud–CPS framework is designed to achieve both accurate data sensing and fast data analysis. While most researchers trust the computation side, and focus on the actuator in the physical space to ensure the service‐level objectives, SLO, that is, deadline misses, cloud can be a threat to the service sustainability as instance may fail, especially when one tries to make a cost‐effective design. Specifically, users must bear the risk of instance failure. These risks can cause the entire cyber‐physical system to collapse. Our work tackles the cloud aspect of the sustainability challenge from the cloud side in a cloud–CPS framework. We have studied the instance selection problem for the CPS systems, and propose a Cost‐Risk Analysis for Instance Recommendation, or CRAIR, to support a sustainable Cloud–CPS framework. We have adopted the classic risk analysis process from the portfolio management in hedge financial market, combining with the system modeling for the CPS instance selection, as an optimization problem. To solve this problem, we formulate it as a multi‐armed bandit problem and solve it with our upper confidence bound bandit algorithm together, our CRAIR can provide an online risk analysis to maximize the profit with a comparative ratio of O(1+). We have evaluated CRAIR based on simulations using real‐world Google and Alibaba workloads and cloud market numbers. The results show that, compared to traditional approaches, our approach provides the best tradeoff between SLOs and costs. All users achieve their SLOs goals while minimizing their average expenses by 34.6%. By using CRAIR for instance selection, the CPS service can maximize its benefit under a controlled risk.

Achieving efficiency in quantitative risk analysis process – Application on infrastructure projects

Infrastructure Projects (IP) are characterised by their extreme complexity in construction and management. Lack of effective risk analysis in construction of IP can cause failure in projects delivery. This paper aims to produce specific guidelines for the efficient application of quantitative risk analysis process. The literature guided contractors into efficient quantitative risk analysis (QRA) of IP to improve contractors QRA practices in the presence of uncertainty during the construction stage. The paper reviewed the literature of QRA process in construction of IP, and then performed a full quantitative risk analysis on a case study of IP in Egypt. The study includes sewage networks, water networks, irrigation networks, and district cooling networks of Cairo festival city project. The paper used an infrastructure schedule to apply the quantitative risk analysis. The schedule included activities for the construction of sewage networks, irrigation network, water network, and district cooling network. Based on the findings, Monte Carlo analysis technique has proved to be an efficient quantitative technique in supporting project managers in allocating deviations. Whereas, sensitivity analysis technique helped in ranking the most driving activities to failure in delivery of IP. The paper added value by providing knowledge and practical guidance for contractors in improving their QRA practice and decision making during the construction of IP.

FMEA-CM based quantitative risk assessment for process industries—A case study of coal-to-methanol plant in China

Coal-to-methanol enterprises in China face many risk factors that pose a serious threat to the safety of the company's production. Therefore, it is imperative to conduct risk assessments of coal-to-methanol plants. A failure mode and effects analysis (FMEA) is a significant analysis method in risk evaluation. However, due to the uncertainty in the risk analysis process, the assessment results may not be sufficiently accurate. To reduce the uncertainty, especially randomness and fuzziness in the evaluation process, a cloud model (CM) is utilized to improve the FMEA, and the FMEA-CM approach is proposed. First, the qualitative language terms are converted into the quantitative numerical characteristics of the cloud model, enabling the fuzziness and randomness in the evaluation process to be comprehensively considered. Second, the cloud weights of S, O and D are calculated by using the interval analytic hierarchy process (IAHP) and the CM. Moreover, the cloud risk priority number (CRPN) is put forward to improve the accuracy of the traditional RPN, and the CRPN algorithm is given. Finally, to rank risk events, the technique for order preference by similarity to an ideal solution (TOPSIS) method, improved by cloud distance based on Hamming distance, is put forward. A coal-to-methanol plant in Yinchuan, China, is introduced to demonstrate the applicability of the proposed FMEA-CM approach. Compared with the results obtained from the traditional FMEA and fuzzy TOPSIS method, the results obtained from the adoption of the FMEA-CM approach show that the FMEA-CM is a more accurate and effective method for the risk assessment of a coal-to-methanol plant.

Assistance in selecting a project contracting strategy by combining complex systems theory and risk and vulnerability analysis

Oil and gas development projects involve many contracts for engineering studies, item procurement, construction workforce, installation or commissioning. One key component of such projects is the definition of a contracting strategy, which consists of breaking the project down into work packages that will be awarded to contractors with specific remuneration and supervision modes. Indeed, it links global design with the local contracts and internal activities that must be undertaken to deliver the results. Risks are associated with every contract as well as with the interfaces between the client and contractor and between the contractors themselves. The problem is then to select an adequate contracting strategy, considering the risks that may occur before or after signing a contract, with direct and possibly indirect and higher impacts. This communication aims to present a method for analyzing the risks of such contracting strategies. The analysis focuses on technical and organizational interfaces, notably contractual ones that exist within these alternative strategies. The expected result is a risk analysis process and tool, which is included in the global project contracting strategy selection process. An industrial application in an international oil and gas company will be presented.

Combining Environmental Footprint Models, Remote Sensing Data, and Certification Data towards an Integrated Sustainability Risk Analysis for Certification in the Case of Palm Oil

Monitoring the potential impacts of the growing Bioeconomy (BE) is a crucial precondition for the development of viable and sustainable strategies. Potential environmental consequences from resource production for the German Bioeconomy can be assessed with the concept of environmental footprint modelling. Furthermore, remote sensing and sustainability certification are tools that can support risk assessment and mitigation i.e., regarding land use (change), biodiversity, carbon stocks, and water consumption. Thus, they can complement the results of footprint models and produce assessment results with a much higher resolution. Among other things, this can enable the development of strategies for more sustainable production practices in high-risk areas and avoid potential bans of biomass imports from entire countries/regions. The conducted case study on palm oil in this paper shows intersections between indicators used in sustainability certification systems and in footprint modelling considering processes on plantation and mill levels. Local best practices for the sustainable production of biomass are identified through a literature review and are extended by a survey, which evaluates the feasibility and conditions of implementing the selected practices on plantations. The conceptual approach outlined in this paper can be seen as a first step towards an integrated sustainability risk analysis of processes and products used within the BE that might be further developed from this starting point. It takes into account footprint modelling data, the use of sustainability certification systems, and data and results from remote sensing analyses. This will enable low-risk producers of renewable resources, who are located in regions generally flagged as high-risk when using environmental footprint modelling, not to be excluded from market activities but to set best practice examples that can then be expanded into these regions.

A Model for Estimating Amount of Personal Protective Equipment Employed within Occupational Health and Safety

İş Sağlığı ve Güvenliği (ISG) çalışmaları incelendiğinde risklerin analizi sürecinde çok farklı yöntemlerin kullanıldığı görülmekle birlikte, risk analizi sonrasında alınacak önlemlerin başında yer alan Kişisel Koruyucu Donanım (KKD) kullanımı miktarının tahminine yönelik bir çalışma literatürde görülememiştir. Bu çalışmada işletmelerin KKD kullanımlarının tahmini için Otoregresif Entegre Hareketli Ortalamalar (ARIMA) temel alınarak bir model geliştirilmiştir. Beyaz eşya sektöründe faaliyet gösteren bir işletmede 2015-2019 yıllarındaki solunum koruyucu maskelerin kullanım verileri incelenmiş, 2020-2022 yılları için ortaya çıkabilecek solunum koruyucu maskesi ihtiyacı tahmin edilmiştir. Yapılan tahminlerle KKD kullanım miktarları karşılaştırılarak yöntemimizin etkinliği incelenmiştir. Endüstri çağında insan-makine arasında artan ilişkiler, insana uyumlu işletmelerin oluşturulmasını gerektirmektedir ve bu anlamda ergonomi bilimi, verimliliği artırmak için iş sağlığı güvenliği uygulamalarından istifade edebilir. Yapılan KKD tahminleri solunum koruyucu maskelerin gerçekleşen kullanım miktarlarına yakın sonuçlar vermiştir. Koruyucu maskelerin kullanım miktarının tahmini için yapılan bu çalışma gelecekte işletme genelinde kullanılan diğer kişisel koruyucu donanımların tahmini için de uygulanabilir.

Natural gas pipeline leakage analysis based on Advance risk analysis and Analytic hierarchy process

As of 2019, my country’s natural gas consumption will reach 310 billion cubic meters, and the proportion of natural gas consumption in energy will increase rapidly. In order to promote the long-term development of natural gas and prevent natural gas pipeline leakage accidents, the natural gas pipeline leakage accidents are analyzed. In this paper, through the pre-hazard analysis method, qualitatively analyze the 4 main factors and 14 sub-factors that cause the leakage of the natural gas pipeline. Then establish a hierarchical structure model by tomographic analysis, calculate the weight of each factor, and quantitatively analyze the cause of the leakage. Finally, according to the conclusion, corresponding measures are proposed.

Balanced Scorecard and ISO 31000, Risk Management Integration to Improve Performance: Case Study at Indonesian Credit Union

This study aimed to integrate the Balanced Scorecard and risk management processes with the Cindelaras Tumangkar Credit Union (CTCU), Condong Catur 01 Branch office. CTCU has four Branch Offices (BO), meanwhile this study was conducted on one of the CTCU at Condong Catur 01 Branch Office. The risk assessment was based on the framework model of ISO 31000 and Balanced Scorecard. The result of the risk identification showed that the risks faced by CTCU were financial risk (credit risk, market risk, liquidity risk), operational risk, and business risk. In the risk analysis process, the result stated that the credit risk was the highest risk, meanwhile the market risk was the medium risk. Based on the evaluation results, the financial risks needed urgent priority to be handled because the risks had the highest impact on the performance degradation. Those risks were managed by doing risk mitigation.

Communication inside Risk Assessment and Risk Management (COMRISK): Final report

A key feature of risk analysis is that risk assessment and risk management should be functionally separated. However, the usefulness of a risk assessment may be limited if the output is not designed to help with risk management decisions. The COMRISK project investigated the communication between risk assessors and risk managers. The overall goal of the project was to identify current practices and challenges in communication between risk assessors and risk managers during the risk analysis process, and thus increase and improve the understanding and the quality of the communication between them. Specific actions to achieve this aim included reviewing of historical food safety cases, analysing risk assessment requests, identifying communication guiding documents, including legislation and agreements, conducting semi‐structured interviews with risk assessors and risk managers, and identifying tools for facilitating the communication between risk assessors and risk managers. It was concluded that the usefulness of a risk assessment is strongly dependent on well‐defined and mutually recognised risk questions and that scarce or poor communication between risk assessors and risk managers is one of the major reasons when an output from risk assessment fails to support risk management. The communication between risk assessors and risk managers preceding the onset of the risk assessment, when the risk assessment requests with its risk questions are defined, is especially identified as one of the critical points to ensure a risk assessment that is fit for purpose. However, difficulties in understanding were also reported for the communication between risk assessors and risk managers during and after the risk assessment. Lack of communication is seldom a result of formal constraints or agreements nor can it be explained by a wish of the risk assessors or risk managers. Instead, perceived constraints or traditions appear to be possible underlying factors leading to scarce or poor communication between risk assessors and risk managers. It is essential that both risk assessors and risk managers acknowledge the crucial importance of communication between them while at the same time respect their different roles in a risk analysis.According to respondents, the best solution to facilitate the framing of the risk assessment questions isan open dialogue between risk assessors and risk managers to agree on the goal of the assessment and to build trust. Further, the interviewresults indicate that a formal systematic process may facilitate communication during the risk analysis. Where there is uncertainty, e.g due to data gaps or issues related to the methodology and models, it should be acknowledged and described properly by risk assessors to risk managers. Training of risk assessors and risk managers may improve the possibility of a timely and fit‐for‐purpose output.Such a training should give a deeper insight in the risk management process, give a better understanding of the risk managers role, and especially raise the awareness of the importance of the communication between risk assessors and risk managers.To improve the risk analysis process, it is also important that the risk assessor gets feedback regarding how risk assessments have met the needs of the risk managers.The present study also found that aspects of risk communication studied in this project are not extensively discussed in the guidance documents for risk analysis. More research is needed to identify the barriers for a fit for purpose communication.

HAZOP_LOPA-based operation process risk analysis and management research

At present, HAZOP analysis and LOPA analysis are widely used to analyze and control the risk of process flow, but few people manage HAZOP and LOPA for risk during operation. Through the research of HAZOP and LOPA analysis methods, combined with long-term work experience in the field, the author proposes to combine HAZOP and LOPA analysis methods into operational process safety risk analysis, and use the same subject expert team to identify the risks in the operation process. Control and control results also help to re-revise the operating procedures, conduct risk management and control from the operational level, and improve the completeness of safety evaluation. This paper introduces the basic method of HAZOP_LOPA joint analysis operation process, clarifies the analysis points, and lists the commonly used 8 types of guidance words. Finally, the risk of maintenance and maintenance operation of quick-open blind filter is analyzed by examples. The results show that Based on HAZOP_LOPA, operational risk analysis can quantitatively evaluate the reliability of existing protection measures, eliminate or reduce safety risks, and achieve safety risk review of operational procedures. This method improves the reliability of operating procedures and enhances the safe operation level of employees. It is of great significance.

Risk Management & Mitigation Plan for Data Center Environment

To ensure company stability in running a business, the management team of the company must be aware of risks that could arise under various condition. These risks should be identified and mitigated as early as possible, before its effect the company. No matter what resource its affected, either core or support resource risks must be mitigated to avoid loss and damage to the company. Data Centre is one of the core resources of a company; it keeps the company information and used daily in the company. If by any causes, the data center could not be accessed or function; normally, it would cause a great loss to the company. This paper discussed the used of Facilitated Risk Analysis and Assessment Process (FRAAP) technique to list and mitigate risk to the company data center. There are four steps of FRAAP technique used in this paper: creating risk description list, creating a risk sensitivity profile, creating risk exposure rating, and creating mitigating control list. The used of FRAAP technique, resulted in identification of two type of risk which are confidentiality and availability. The mitigation plan in this paper, cover the steps planned to mitigated risk resulted from information leak (Confidentiality); ex. hacking, virus, Etc. and natural disaster (Availability); ex. Flood, earthquake, fire, Etc. These planned mitigation steps are divided into three lists, which are: Risks response, Emergency Response Steps, Recovery steps, and restoration steps of the company data center.

A systematic review of quantitative risk analysis in construction of mega projects

Abstract Mega projects (MP) require efficient management of risks during their construction. Therefore, it is crucial to identify any possible deviations towards meeting their objectives. Such deviation forced MP to be delivered behind schedule and over budget. According references, MP does not require only qualitative analysis but requires an accurate quantitative analysis based on knowledge and practice. Thus, this paper aims to undergo a systematic review of quantitative analysis literature in construction of worldwide MP, with the utmost aim to improve contractors quantitative risk analysis practices in the presence of uncertainty. A time line was produced which shows the process of quantitative risk analysis in this literature including the past six years from 2013 to 2018. This was followed by a critical analysis in order to account for quantitative risk analysis techniques highlighted throughout literature sources. Furthermore, the paper reviews the literature of worldwide mega projects by which quantitative risk analysis process was practiced. It was observed that Monte Carlo analysis technique has succeeded in supporting project managers in allocating deviations in the objectives of MP. The paper adds value to practitioners using the process of quantitative risk analysis as well as contractors working on construction of MP.

A methodology for applying modern information technologies in the economic analysis of organization's risks

Subject. The article examines theoretical, methodological and practical aspects of applying modern methods and information technologies to improve the economic risk analysis of organizations. Special attention is focused on internal audit and control, in particular, on the self-assessment procedure, being an innovative tool for monitoring and assessing risks to identify and minimize them within the corporate governance system. Objectives. The purpose is to study possibilities for improving the methodology for economic risk analysis of organizations through modern information technologies, innovative tools, and mathematical models. Methods. The study rests on methods of quantitative, qualitative analysis, popular scientific and empirical research in the field of economic sciences, including comparative, structural and functional methods of economic analysis, the desk study, methods of expert assessments, situation analysis, statistical assessment, testing parameters, etc. Results. The offered methodology is aimed at risk assessment and risk analysis of organizations. The results of the study contribute to the implementation of new tools of internal control, audit and analysis, in particular, the self-assessment procedure and the coefficient of reliability of results, which have a positive impact on efficient risk management and the enhancement of investment appeal of organizations. Conclusions. The automation of the risk analysis process and selected procedures and techniques should create conditions for a logical transition to more accurate (as compared to currently prevailing in practice) quantitative measurement methods, and for building the mathematical models that make it possible to predict and obtain results based on empirical data rather than on expert estimates.

Construction method and application of real‐time monitoring and early‐warning model for anaerobic reactor leakage

AbstractThe anaerobic reactor is one of the most critical reaction devices for biogas engineering, wherein is usually a large amount of flammable gas methane. Fire and explosion accidents will be easily triggered if the gas leaks, threatening the surrounding buildings, equipment, personnel, and so forth. Avoiding the significant accidents caused by CH4 leakage has become a critical issue in the design and condition monitoring for an anaerobic reactor. This article presents a model construction method for leakage early‐warning. Incident database and hazard and operability analysis (HAZOP) can be utilized to identify the leakage risks, and computational fluid dynamics (CFD) simulation and consequence quantity calculation can be used to determine the consequence influence ranges. The calculation results can be employed to establish prediction models for abnormal situations. Process safety management (PSM) data and risk analysis results can be combined with the possible abnormal situations to assist operators in adopting the right solutions. An early‐warning system has been developed to illustrate the industrial application of the model. It can be concluded that collecting multi‐parameter values according to the real‐time changes in the actual production process, continuous monitoring and early‐warning of leakage risk, and so forth, will contribute to accident avoiding and emergency response in reactor operations.

Risk Evaluation Using Nominal Group Technique for Cloud Computing Risk Assessment in Healthcare

Emerging of cloud computing with flexibility, improve accessing data, and cost-saving makes this technology accessible and growing fast. As a result of the emergence of cloud computing bring interest to industries to used cloud computing. Although cloud computing brings so many benefits to customers, the previous study reveals that cloud computing penetration in the Healthcare area is still low. With effective cloud risk assessment methodology will gain the confidence to cloud users in this technology. Study in cloud risk assessment methodology still infant and the complexity in identifying security risk still debating. This paper explores the risk assessment process by highlighting the method in the risk evaluation process. Risk evaluation is an essential phase in the risk assessment process. It compares the result from the risk analysis process and determines whether to accept or tolerate the risk criteria to decide on the risk analysis. In this study, the Nominal Group Technique (NGT) is introduced to compare risk analysis results in the earlier phase. Since risk evaluation based on organizational objectives, external and internal context and stakeholders' views, NGT is promising for effective results. This study not only contributing to the prioritizing list of risks and threats in a systematical manner but indirectly NGT process makes stakeholders aware of the current cloud security risk situation in the organization. Equal opportunity expressing views in this focus group discussion is hope can generate a brilliant solution in risk assessment results.

A novel Security-by-Design methodology: Modeling and assessing security by SLAs with a quantitative approach

Recent software development methodologies, as DevOps or Agile, are very popular and widely used, especially for the development of cloud services and applications. They dramatically reduce the time-to-market of developed software but, at the same time, they can be hardly integrated with security design and risk management methodologies. These cannot be easily automated and require big economic investments, due to the necessity of security experts in the development team and to the lack of automatic tools to evaluate risk and to assess security in the design and operation phases. This paper presents a novel Security-by-Design methodology based on Security Service Level Agreements (SLAs), which can be integrated within modern development processes and that is able to support the risk management life-cycle in an almost-completely automated way. In particular, it relies upon a guided risk analysis process and a completely automated security assessment phase, which enable to assess the security properties granted by a cloud application and to report them in a Security SLA. We validated the proposed methodology with respect to a real case study, which showed its effectiveness in improving the awareness of designer and developer teams on security aspects and in reducing the secure design process time.