Risk Management Maturity Model Research Articles

PRisk-MM: a public sector risk management maturity model for Brazilian public organisations

This article proposes a risk management maturity model focused on the public sector and developed for Brazilian public organisations, the PRisk-MM. The PRisk-MM contains 5 levels of maturity and 23 maturity attributes related to 15 dimensions. The model was elaborated following the scientific rigour found in the literature on maturity models, being divided into 2 main phases: the development of the model and its validation in 5 public organisations of 2 state governments. The development of the PRisk-MM is based on a previous study conducted by De Lorena and Costa, who proposed a reference model with attributes and key contingent factors for public organisations using data collected in the federal and state governments of Brazil. The assessment procedure of the model uses triangular fuzzy numbers to better treat the subjectivity and ambiguity of human judgement when analysing maturity dimensions and their attributes. Moreover, the PRisk-MM is adaptive to governments’ contexts and, once applied, presents prescriptions on what organisations must do to develop their risk management implementation. Since the Prisk-MM demonstrates practical implications as a government tool, policymakers are expected to use it to assess the public organisations’ status of maturity and compare their performance in implementing RM.

ПРОЦЕС УПРАВЛІННЯ РИЗИКАМИ В ІТ-ПРОЄКТАХ

The purpose of the article is to study the process of project risk management and develop recommendations for its adaptation for IT projects. In the sphere of project management in the formation of project risk management process most often relies on international standards. The article presents an overview of the process of project risk management according to the standards: Project Management Body of Knowledge (PMBOK), International Organisation for Standardisation (ISO); Projects in Controlled Environments (PRINCE2). It is determined that the presented standards are sufficiently structured and can be applied to risk management in various projects, including those in the field of information technologies. The peculiarities of the risk management process in IT projects in accordance with the Microsoft Solutions Framework methodology are disclosed. It focuses on the formation of risk management process in projects in accordance with the Risk Management Maturity Model; Capability Maturity Model Integration (CMI); Maturity Level of Risk Management in IT Projects. IT projects have specific characteristics, and market competition, customer requirements, rapid development of technologies, team qualification – all this requires adaptability to the formation of the risk management process. When forming a risk management process in IT projects, especially in IT startup projects, the choice of a standard, methodology, or a combination of them (individual sections) should take into account the specifics of the project, project team, management, corporate culture, segment and market conditions, stakeholders, qualification of specialists engaged in risk management. In order to improve the effectiveness of risk management in IT projects, it is recommended that IT companies create structural and infra-red elements of risk management, namely: to attract risk management specialists; to develop job descriptions that define their functional duties and responsibilities; to develop corporate standards for risk management.

Assessing the Maturity Level of Risk Management in IT Projects

The purpose of the article is to determine the maturity level of risk management in IT projects. To achieve this goal, the most popular risk management maturity models were analyzed. This analysis allows the identification of methods and mechanisms for determining maturity levels, the identification of strengths and weaknesses for each model, and the study of findings obtained from their use. Based on the data obtained, the author’s risk management maturity model in IT projects was developed and tested, considering the strengths and weaknesses of the analyzed models. Based on the analysis results and empirical data, it was found that the application of the created model allows the determination of the current maturity level of risk management in IT projects, the identification of these projects’ management problems, and the development of recommendations for increasing the level of management. The results have shown that the transition to the Standardized maturity level eliminates 105 universal risks and significantly increases the chances of successfully achieving the designed goals. In addition, it was found that the evaluation of the risk elimination effectiveness and efficiency and the best risk management practices identification and standardization are the main processes that ensure the transition to higher maturity levels. The obtained results suggest that the created author’s risk management maturity model in IT projects can become a tool for identifying the best contractor (performer, supplier), which guarantees the development of the desired IT product.

A maturity model for supply chain risk management

PurposeSupply chains are among the most important, complex and risky systems in the modern world. Thus, managing risk is no longer an option, but a fundamental process in organizations. Given the lack of pathways that guide companies toward supply chain risk management (SCRM), the purpose of this study is to provide a conceptual reference, in the form of a maturity model, to support them in the evolution and improvement of this process.Design/methodology/approachThe proposal covered a broad literature review, a survey and a multiple case study. The research was conducted in the aerospace industry and included companies from the supply chain of a leading aircraft manufacturer.FindingsThe model elaborated with the research results has eight attributes and four levels, addressing critical issues for SCRM to achieve its scope and purposes. The attributes include the structuring and scope of the SCRM process, the importance it receives within the organization, the resources used and the qualification of employees, the role of leadership and the inter-organizational collaboration.Practical implicationsManaging risk along supply chains is particularly challenging, demands resources and knowledge and requires a continuous effort. The proposed model offers a reference for improvement, helping to identify areas that need to be strengthened and practices to be implemented. Thus, it can guide the focus and efforts in a more efficient and systematic way, in addition to support evaluations and comparisons.Originality/valueAlthough maturity models are abundant in different fields and several are available for risk management, models specifically developed for SCRM are scarce. This study broadens the understanding of SCRM with novel insights about how to improve this process in an evolutionary way. While many researchers focused their efforts on the SCRM process steps, this study identified critical issues that transcend these steps. The research was carried out in a sector with a long tradition in risk management and included companies belonging to a same supply chain, that is, using an approach still little explored in studies on SCRM or risk management maturity models.

Critical managerial measures on financial risks of sustainable public–private partnership projects: a PRISMA review

Purpose Public–private partnership (PPP), a project financing arrangement between private investors and the public sector, has revolutionized the approach to the funding and development of public infrastructure worldwide. However, the increasing cases of financial risks and poor financial risk management related to the model threaten the sustainability and financial success of PPP projects leading to huge financial investment losses. This study aims to review existing literature to establish the key measures to control the financial risks of sustainable PPP projects. Design/methodology/approach A PRISMA-compliant systematic literature review method was used in this study. Data were sourced from academic databases consisting of 56 impactful peer-reviewed journal articles. Findings The review outcomes demonstrate 41 critical factors (measures) in mitigating the financial risks of sustainable PPP projects. They include minimum revenue guarantee, strategic alliance with private investors, financial transparency and accountability and sound macroeconomic policies. The principal results of the study were categorized and conceptualized into a financial risk management maturity model for sustainable PPP projects. Lastly, the study reveals that further studies and project policies must focus more on addressing financial challenges relating to climate risks, and health and safety concerns such as COVID-19 outbreak that have negative impacts on PPP projects. Research limitations/implications The results provide essential research gaps and directions for future studies on measures to mitigate the financial risks of sustainable PPP projects. However, this study used small but significant existing publications. Practical implications A checklist and a conceptual maturity model are provided in this study to help practitioners to learn and improve upon their practices to mitigate the financial risks of sustainable PPP projects. Originality/value This study contributes to managerial measures to reduce huge losses in financial investments of PPP projects and the attainment of sustainability in public infrastructure projects with a financial risk maturity model.

What entails risk management maturity in public organisations?

This article investigates which attributes and contingent factors are crucial to develop a public sector risk management maturity model (PSRMMM). The purpose of this study is not to provide a PSRMMM per se, but to be a scientific reference in the creation of future models to better guide public organisations. Accordingly, enterprise risk management literature and specific public sector factors were analysed to build a questionnaire that was carried out in Brazilian federal and state public organisations. Next, a path of multivariate statistical techniques (CATPCA, K-modes, and multinomial logistic regression analysis) was used to analyse the data collected from 330 survey responses. Results reveal that 12 statistically significant variables explain 5 different levels of public sector risk management maturity. This study stands out for its originality in indicating the main contingent factors and attributes a PSRMMM must have per level of maturity, facilitating the development of prescriptions to guide implementation improvements. Moreover, this study has practical implications to government policymakers who use PSRMMM to assess the performance of public organizations in implementing risk management frameworks.

Measuring And Improving The Effectiveness Of ISO 31000 Based Erm In State-Controlled PSO - A Case Study Of Toll Road Operators In Indonesia

Toll road operators need to implement effective risk management. This study focuses on how a State-Owned Enterprise (SOE) toll road operator assesses the maturity of their ISO 31000-based risk management practices by using an ISO 31000-based risk management maturity model, ERMA ISO31000 RM3. The study is predominantly based on a qualitative approach through document reviews, questionnaires, and interviews. The assessment result shows that the company's risk management maturity score reaches 3.62 (a scale of 0.00 – 5.00) or at the DEFINED level of the risk management maturity. The study also shows that the company's risk management process gets the highest score, 4.45, while the lowest score, 3.22, is for the company's performance management. By using the maturity assessment result, the company's management can develop a risk management improvement road map to assist their efforts in increasing the effectiveness of their existing risk management practices. Referring to the assessment result, the management can prioritize the improvement on low-score maturity attributes, such as their performance management, risk culture, resilience and sustainability, risk management framework, and management process, while maintaining their current practices of the risk management process, which has already reached a considerably high maturity level.

The risk maturity model: a new tool for improved risk management and feedback

AbstractNorwegian governmental institutions use their risk management regulations to acquire and manage projects and assess the institutional practices. After many years documenting a positive trend, the audit authority noticed a stagnation in process improvement across the organization. A literature review of the use of risk management maturity models from other industries suggested a method for achieving continuous improvement. A corresponding maturity model has been developed and tested with positive results.This research developed a risk maturity model based on compliance requirements for the Norwegian defense sector. The intended use of this model is as the foundation for conducting assessments through audits and provide explicit guidance toward given requirements that facilitate extensive improvement in application of the risk management system. Use of the model in performing maturity assessments of organizational elements within the defense sector showed that the model supports the subsequent improvement activities through providing better understanding of the existing situation, and explicit visual feedback on areas that are satisfactory and areas in need of improvement. A maturity model provides a stepwise path showing the next level of improvement on the way to achieve required performance.

A supply chain risk management maturity model and a multi-criteria classification approach

PurposeThe purpose of this paper is to propose a supply chain risk management (SCRM) maturity model combined with a fuzzy TOPSIS classification method to evaluate and sort an organization into a pre-defined maturity level.Design/methodology/approachAn axiomatic and prescriptive research method guided this study. Therefore, it proposes a prescriptive approach of maturity classification based on a theoretical SCRM maturity model combined with a multi-criteria decision technique.FindingsThe results of a pilot application indicated a consistent classification and the value of the model for diagnosing flaws and pointing directions for improving operational and disruption risk management. Its comprehensiveness allows applying it to supply chains of several industry sectors.Research limitations/implicationsThe proposed model does not include all possible risks and could be revised in further developments. Also, adjustment of the maturity profiles of the multi-criteria decision-making (MCDM) model requires a learning process from practical applications.Practical implicationsThe adoption of the risk management maturity grid by practitioners may bring the benefit of a more objective and comprehensive evaluation of risk management processes in the supply chain context.Social implicationsAn immediate social implication derives from the improvement actions that may result from the diagnosis of risk management vulnerabilities identified in the pilot application. In general, the proposed model has the potential to reduce risks, improve results and contribute to economic sustainability.Originality/valueThe maturity grid and decision model integrate overall aspects of risk management, bringing together managerial concepts to deal with a variety of supply chain operational risks. The combined multi-criteria classification procedure to sort the maturity level of an organization is also a novelty.

Risk Management Maturity Model for Logistic Processes

Recently, the maturity models for risk management are attracting growing attention. The obtained maturity level defines an assessment of an organization’s management competence. Therefore, as a set of various tools and practices, the maturity model is critical for a company’s overall risk maintenance strategy development and implementation. Thus, the purpose of this article is to present a model for risk management maturity for logistic processes. We investigated the main defined assessment areas for risk maturity model implementation in logistic systems. Based on research findings, we introduced a new risk maturity assessment area based on participation in the supply chain—cooperation at risk. The proposed model constitutes the base for a two-stage assessment method implementation, where the global maturity index is introduced. Finally, we implement the proposed two-stage assessment method to verify the proposed model’s diagnostic function and determine its labor intensity. The study confirmed that the five defined maturity areas (knowledge, risk assessment, process risk management, cooperation at risk, and risk monitoring) provide a complex diagnostic tool for risk maturity level identification and, based on the obtained results, allows to define an appropriate development strategy for a given decision-making environment.

Research on Application of Project Management Maturity Model in Risk Management of Electrical Engineering

Based on the analysis of foreign classic maturity models and the actual situation of electrical engineering projects, this paper constructs a suitable three-dimensional project risk management maturity model and establishes a project risk management evaluation index system. Through fuzzy comprehensive evaluation method and analytic hierarchy process, the key element indicators are evaluated and weighted, and the maturity score is obtained, which finally reflects the maturity of project risk management. Finally, through empirical analysis, we found out the shortcomings of enterprise project risk management and proposed the direction for improvement.

A Maturity Model for Assessing IS Risk Management Activity Considering the Dependencies Between Its Elements

The information systems (IS) are a key asset for organizations. Therefore, managing IS risks becomes more and more important especially within a world in perpetual change. Since IS risk management creates added-value, it must follow a process of continuous improvement orchestrated by a maturity model that figures out available pathways for a better improvement. The studied literature shows the lack of an IS risk management maturity model that considers all IS components and specificities of risk management activity. The present article shows first this lack in the section related to the comparative analysis of the existing models. Then, it proposes a maturity model to address this issue. The proposed model aims to assess the information system risk management activity while considering the dependencies between its elements.

A New Maturity Model for Project Risk Management in the Automotive Industry

The purpose of this article is to present a new maturity model for the assessment and ongoing management of project risk management capability in the automotive industry. The research design is based on a multi-project case study analysis in a major German automotive company. The approach is qualitative and inductive, using 12 in-depth interviews with major stakeholders in the project management function in the company to provide data for the construction of the initial maturity model. This model is then verified and refined via an on-line survey and three follow-up interviews.The findings provide material for the construction of a new maturity model that can be used for the assessment of project risk management capability and as a tool for on-going monitoring and improvement. The model is structured around four dimensions of risk management – identification, assessment, allocation and appetite – and has four maturity stages – rudimentary, intermediate, standardised and corporate. The model is based on a detailed analysis of in-depth interview material in a specific industry sector. It can be used as a basis for similar research in other industries. The model adds to existing risk management maturity models and is unique in being specific to the automotive industry. It can be used by risk and project managers, and can also be adapted to other industry sectors.

МОДЕЛЮВАННЯ ОЦІНКИ “RISK MANAGEMENT” В СИСТЕМІ УПРАВЛІННЯ БУДІВЕЛЬНИМИ ПРОЕКТАМИ

The basic processes, methods and tools of the project risk management in the knowledge system “Guide to the Project Management Body of Knowledge” outlined. The theoretical and practical approaches to managing risk events affecting the cost, terms, quality of construction projects analysed. The correlation matrix of risk management processes to “tools and methods” of their implementation compiled. It is proposed to highlight the risk components as an important condition for the developer’s technological maturity in construction projects, programs, portfolio management. The risk manage-ment maturity model for the context of construction project risk management is developed. The math-ematical description for the evaluation of five maturity levels of risk management presented. The re-strictions of the target function of maturity “Risk Management” for each of the levels defined. The developed assessment tool is applicable for the work of top management of construction and development companies. It will be useful to self-assess progress in the development of risk-sustainable management. It is effective in choosing the actions necessary to move to a higher level of maturity. It is noted that the author's approach requires further scientific and practical development in the direction of operations with specific data.

2412 リスクマネジメントの定着促進に向けた成熟度モデルの提案(一般セッション)

2412 リスクマネジメントの定着促進に向けた成熟度モデルの提案(一般セッション)

GUIDELINES TO RISK MANAGEMENT MATURITY IN CONSTRUCTION PROJECTS

Purpose – This article aims to provide the guidelines to assess the risk management maturity (RMM) of construction projects.Design/methodology/approach – This article presents a literature review of the main risk management models, which aims to support a survey research to define, according to experts, the market preference and knowledge of RMM models.Findings – We pointed out in this article a set of guidelines to direct the maturity analysis of RM in the Construction Industry and proposed a model matrix to help companies to evaluate the maturity of the RM of a whole project or each activity separately.Research limitations/Implications – Limitations of this article include the search options originally defined by the researches in literature review and concepts and measures chosen to be evaluated by experts in the survey. Other approaches could explore the implementation of a RMM model considering quantitative measures in others areas.Practical Implications – The article provide to construction companies a way to measure their risk management capacity against four standard levels of maturity, allowing them to make benchmarking and to improve and increase their ability to manage risk.Originality/value – We highlighted to professionals and academics what factors were essential seeking to improve the risk management continuously.

A Proposed Risk Management Maturity Model to Promote the Implementation of Risk Management Activities(<Special Issue>Risk of Project and Organization)

A Proposed Risk Management Maturity Model to Promote the Implementation of Risk Management Activities(<Special Issue>Risk of Project and Organization)

Development of the ISR3M model for IS risk management evaluation using the Focus Area structure according to the MMDPIS generic process

Risk management (RM) is one of the main IS governance pillars. However, to remain a center of profit and cost optimization for the company, this activity must be evaluated, monitored and improved continuously. Hence the interest to develop an IS risk management maturity model. This paper aims to address this need by providing the ISR3M (Information System Risk Management Maturity Model) model. After a summary of literature review, it presents the design approach, then describes the model and evaluates it.

Developing Fuzzy Enterprise Risk Management Maturity Model for Construction Firms

AbstractConstruction firms have been seen as prime candidates for enterprise risk management (ERM) adoption. The ERM maturity assessment helps them to identify weak areas of their ERM implementatio...

Assessing Risk Management Capability of Public Sector Organizations Related to PPP Scheme Development for Water Supply in Indonesia

The success of Public Private Partnership (PPP) for water supply investment is inseparable from the capability of risk management of the parties within the project. This study investigates the risk management capability of Indonesian local public sector organizations that are potentially involved in PPP schemes for water supply. A risk management maturity model based assessment tool probing the culture, process, experience, application and partnership aspects is used in the survey. The model describes risk management capability in four levels (ad-hoc, initial, competent, excellent). The survey shows that their risk management capability is still in-average at the initial stage (level 2), meaning that the adopted risk management postures are mostly supported only by unstructured, ad-hoc and non-formal processes. The result of this study can help decision makers in choosing appropriate risk management methods and tools to be used by the local public authorities for managing risks in PPP schemes.