Risk Management Standards Research Articles

A dynamic simulation approach to support the evaluation of cyber risks and security investments in SMEs

The growing amount of cyberspace threats highlights the need to evaluate cybersecurity risks and to plan for effective investments. One internationally recognized document for cybersecurity risk management is the framework for Improving Critical Infrastructure Cybersecurity by the US National Institute of Standards and Technology (NIST). It provides guidelines, best practices and standards for cybersecurity risk management. Nevertheless, as other self-assessment frameworks, it produces a static view of an organization's cyber posture and does not capture the dynamics of organizational changes and cyberattacks. Moreover, the current situation sees small and medium enterprises (SMEs) in a critical position since they need to manage their cybersecurity while usually not being skilled or equipped enough to internalize this process. Therefore, there is a need for a practical and easily applicable model able to identify a cybersecurity risk profile and its dynamics. This study proposes a system dynamics methodology and tool (SMECRA - SME Cyber Risk Assessment) for supporting cybersecurity investment decisions for SMEs through the evaluation of cyber risk and previous investments. SMECRA addresses dynamic organizational complexity and can be used to assess cyber risks and related dynamics over time. Three case studies demonstrate its capability to assess a SME's cybersecurity status and to evaluate investments impacts on an organization's risk profile, raising cybersecurity awareness. This study is important for SMEs wishing to manage their own cybersecurity risk and for insurance companies in their economic evaluation of residual risks that SMEs wish to externalize.

Aspects of the Evolution from Risk Management to Enterprise Global Risk Management

Industry 4.0 transforms the economy through “destructive” technologies and new risks. It is requiring update of the views and the dealing with uncertain environment. The goal of this paper is to summarize the mainly used risk management standards, to analyze the general aspects of evolution of risk management, enterprise risk management, enterprise integrated risk management and to suggest the concept for the next step which is enterprise global risk management, where are implemented Industry 4.0 risk and Artificial Intelligence. The proposed concept considers organizational-hierarchical structure of the enterprise as complex, the risk management policy as global, the respective actions as permanent and the orientation toward risks as adaptive. It is determent the future development in connection with enterprise resource planning.

Çağdaş Risk Yönetimi Standartları Çerçevesinde Sanayi İşletmelerinde Risk Yönetimi Algısı Üzerine Bir Araştırma (A Research on Risk Management Perception in Industrial Enterprises within the Framework of Contemporary Risk Management Standards)

Purpose – The aim of the research is to measure the current risk management perceptions of industrial enterprises in order to guide them to create an effective risk management system in line with contemporary risk management standards. Design/methodology/approach – The research data were collected through a survey from 30 large industrial enterprises operating in the province of Kutahya, contributing to the city economy in terms of employment numbers, closed area size, turnover and export volume. The data were analyzed with SPSS 21 statistical program. Findings – As a result of the research, it was seen that the personal attitudes of business managers against risks are in the form of a “risk-free” perspective. Addition to that, it has been concluded that there is a traditional understanding that businesses predominantly perceive and manage financial risks. The findings have proved that the modern risk management understanding is not perceived in industrial enterprises and that the risk management has not reached a certain level of maturity yet. Discussion – It is an important issue for the effectiveness of the system to determine the perceptions they develop against risks before establishing a risk management system in contemporary standards. Without measuring the current risk and risk management perception in businesses, any risk management system will create serious deficiencies at the beginning. In this sense, with the scale developed in the study, it is expected that the managers of industrial enterprises will determine how they perceive contemporary risks and contribute to their businesses in reviewing and developing existing risk management systems.

A Dynamic Risk Management Approach for Reducing Harm From Invasive Bedside Procedures Performed During Residency.

Internal medicine (IM) residents frequently perform invasive bedside procedures during residency training. Bedside procedure training in IM programs may compromise patient safety. Current evidence suggests that IM training programs rely heavily on the number of procedures completed during training as a proxy for resident competence instead of using objective postprocedure patient outcomes. The authors posit that the results of procedural training effectiveness should be reframed with outcome metrics rather than process measures alone. This article introduces the as low as reasonably achievable (ALARA) approach, which originated in the nuclear industry to increase safety margins, to help assess and reduce bedside procedural risks. Training program directors are encouraged to use ALARA calculations to define the risk trade-offs inherent in current procedural training and assess how best to reliably improve patient outcomes. The authors describe 5 options to consider: training all residents in bedside procedures, training only select residents in bedside procedures, training no residents in bedside procedures, deploying 24-hour procedure teams supervised by IM faculty, and deploying 24-hour procedure teams supervised by non-IM faculty. The authors explore how quality improvement approaches using process maps, fishbone diagrams, failure mode effects and analyses, and risk matrices can be effectively implemented to assess training resources, choices, and aims. Future research should address the drivers behind developing optimal training programs that support independent practice, correlations with patient outcomes, and methods that enable faculty to justify their supervisory decisions while adhering to ALARA risk management standards.

Risk Management Implementation in Public Sector Organizations-Global Phenomena

The research aims to understand the integrated risk management global adoption, especially ISO 31000 in Public Sector Organizations (PSOs). Through desk research and complemented with literature reviews taken from case studies in the G20 Countries, this study is expected to give a helicopter view about the global adoption speed of ISO 31000 as an international standard of risk management by PSOs across the world, and capture the sense of key issues and challenges related to the implementation. The findings contribute to the existing risk management implementation literature as well as a foresight for global risk leaders in PSOs to excel in their own respective risk management initiative either as a single initiative or as a part of their attempt to initiate change management. Since the sample has been purposively limited to G20 countries, consequently it does not reflect other critical factors of issues and challenges which have probably been experienced by non-G20 countries.

INDUSTRY CORPORATE INNOVATION RISKS: ЕMPIRICAL RESEARCH RESULTS

In the article, a review of Russian and foreign literature was carried out, which allowed to consider the main standards of risk management and quantitative methods of risk assessment. The correlation-regression analysis of risks revealed the most significant risks affecting the efficiency of corporate innovation implementation in industrial companies. These include: misunderstanding the importance of innovation for the company; lack of financial resources for innovation; low level of support for the company’s top management for the introduction of innovative processes. A regression model of the impact of risks on the effectiveness of corporate innovation was built, which will predict the degree of impact of risks on the effectiveness of corporate innovation. Recommendations on improving the risk management system for various levels of innovative development of industrial companies are proposed, which are aimed at increasing the efficiency of introducing corporate innovations in industrial companies and ensuring a high level of competitiveness of companies.

Safety of warfarin therapy in children with coronary aneurysm due to Kawasaki disease

Objective: To investigate the safety of warfarin for Kawasaki disease (KD) with coronary artery aneurysm (CAA) and its prognosis. Methods: Twenty one children with KD complicated with giant CAA, multiple CAA in one coronary artery or thrombosis in coronary artery were enrolled in this prospective study. Warfarin was used to control the goal international normalized ratio (INR) ranging from 2.0 to 3.0. The CAA diameter, number, location and thrombus in coronary artery were recorded at the beginning of treatment, 1, 2, 3, 4 weeks and 2, 3, 6, 12 months after treatment, as well as the influence on INR, electrocaroliogram, creatine kinase-MB (CK-MB), troponin I. Standardized warfarin bleeding risk training and management was implemented. Children were divided into implementation group and non-implementation group according to the status of actual implementation of their parents. The incidence of bleeding events was compared between the two groups. Comparisons between groups were performed using a Rank sum test and a Fisher exact test. Results: In the 21 patients (15 males and 6 females), the age of onset ranged from 2 months to 6 years. There were 4 cases with grade Ⅱ, 7 cases with grade Ⅲ, 7 cases with grade Ⅳ and 3 cases with grade Ⅴ according to the severity of coronary arterial lesions before treatment. The time of clinical detection of thrombus in 10 children with thrombosis ranged from the fourth day to the fourth month. The dose distribution of warfarin was 0.06-0.10 mg/(kg·d), and the INR was 1.80-2.59. Among the 10 cases with thrombus, 8 cases had disappearance of thrombi and 2 cases with grade Ⅴ had thrombus organization to different degree. After treatment, the coronary artery ectasia of the 4 cases with grade Ⅱ all returned to normal. Among the 7 cases with grade Ⅲ, 3 cases of coronary artery aneurysms returned to normal, and 4 cases did not change. Among the 7 cases with grade Ⅳ , 5 cases of coronary artery aneurysms shrank to grade Ⅲ, and 2 cases remained unchanged. Three cases with grade Ⅴ lesions had no changes in aneurysm. Neither new thrombus nor new CAA was detected during the treatment. There was no significant change in electrocardiogram before and after treatment. No statistically significant difference was found regarding the troponin I (0.07 (0-3.01) vs. 0.04 (0-0.29) μg/L, Z=0.932, P>0.05) and CK-MB (20.6 (11.2-58.2) vs. 29.0 (16.7-47.0) U/L, Z=1.906, P>0.05) before and after treatment. The incidence of bleeding events in the implementation group was significantly lower than that in the non-implementation group (2/15 vs. 4/6, Fisher=5.689, P=0.031). Conclusions: The application of goal INR of 2.0-3.0 and adjustment of warfarin dose according to the severity of CAA combined with standardized and strict warfarin bleeding risk training and management, can increase the safety of warfarin therapy in children with KD, improve the prognosis of coronary artery lesions, promote the dissolution of thrombi, prevent new thrombosis, and effectively reduce the incidence of bleeding complication.

ВПРОВАДЖЕННЯ МІЖНАРОДНІИХ СТАНДАРТІВ З БЕЗПЕКИ ПРАЦІ І УПРАВЛІННЯ РИЗИКАМИ ТА ШЛЯХИ ЇХ ПОКРАЩЕННЯ НА ПІДПРИЄМСТВАХ ТРАНСПОРТУ

The article investigates the ways and means of improving and perfecting the state of labor protection at transport enterprises of Ukraine through the implementation of international standards for risk management and occupational safety. A detailed analysis of international standards for occupational safety, and their main benefits that improve the health and safety of enterprises. The object of research is international standards on occupational safety and risk management. The purpose of the work is to analyze the implementation and use of international standards on occupational safety and risk management at Ukrainian transport enterprises. Research methods - analytical. Quality management of labor protection at enterprises is one of the priority areas of transport enterprises in order to reduce occupational injuries and improve working conditions. In order to effectively manage labor protection in transport enterprises, the authors of the article propose the introduction of international standards in the field of occupational safety and risk management in Ukraine. Examining the chosen topic, it was found that in many works that devoted to the application of international standards on occupational safety was not a generalization of all regulations and standards on labor protection and risk management in the enterprise. The main directions for the implementation of international standards for occupational safety and risk management in transport enterprises of Ukraine are proposed. The results of research can be recommended for implementation in the management system of labor protection at transport enterprises of Ukraine. KEY WORDS: INTERNATIONAL STANDARDS, OCCUPATIONAL HEALTH AND SAFETY, SAFE WORKING CONDITIONS, RISK ASSESSMENT, IMPROVING OCCUPATIONAL HEALTH AND SAFETY CONDITIONS, MANAGEMENT SYSTEM.

Ризики в системі обліку та фінансової звітності

The article is concerned with studying the risks that are formed in the accounting and financial reporting system, their grouping and characterization for effective management and improvement of enterprise performance. Risk management standards clearly indicate the responsibility of management in assessing risks, managing and reporting them. The transformation of user approaches and needs to complete and reliable information about the risks of enterprises, in particular to the preparation of integrated reporting, indicates that the process of improving both the management and the reporting systems is underway. Accounting simultaneously acts as a function of risk management through the creation of reserves and provisions, a means of displaying risks and decisions about them through disclosure of information in the reporting, and is also a source of risk formation. The literature highlights the latter aspect the least. On the basis of the carried out research, the following groups of risks arising in the accounting and reporting system are determined: risks in the field of application of international (or national) accounting and reporting standards; absence (inefficiency) of management accounting, tax planning, internal control, independent audit; risks of errors and fraud; risks of adverse changes in legislation. For each group, the enterprise will be able to choose the most effective response measures through distribution (by creating reserves, insurance, diversification, outsourcing, developing accounting policies and job descriptions) and reducing risks (through investing in staff education: trainings, seminars, courses and motivation, updating accounting software, compiling and reporting, substantiating professional judgment, improving the internal control system, regulating management accounting, integrated reporting, system solutions). Thus, in order to increase the efficiency of risk management, of practical value should be taking into account the risks of accounting and reporting systems, if we consider them as a source of risks, and not only as an instrument for administration or information disclosure.

Assessment Framework for Defining the Maturity of Information Technology within Enterprise Risk Management (ERM)

The process of reviewing, assessing and improving the organization's IT risk management requires some basic information summarized in a process maturity profile. In general, IT risk management standards or frameworks do not include a mechanism for assessing the maturity level of process implementations. This study was conducted to develop a framework, which can be applied to assess the maturity level of IT risk management under ISO / IEC 27005. A standards-based management system implementation can be represented as a model cycle of planning, implementation, validation and also action plan. The proposed evaluation framework consists of templates, methods, and working papers. Therefore, the template focus on the evaluation areas, which are planning, execution, validation, and execution, then evaluation area details (8 domains, 35 subdomains, 82 items), and evaluation metrics and criteria. Meanwhile, a working paper has been created to assist in conducting the evaluation. Actually, by using this evaluation framework, it can provide a representation of the maturity level from the entire process in managing IT risk, based on the provisions of ISO/IEC 27005. This framework complements the existing model with the representation of (1) providing a single-cycle planning, establishment, validation, and execution, (2) evaluation tools, (3) more comprehensive data collection methods, and (4) priority list of elements to be reformed and/or improved.

Investors’ Judgment and Decisions after a Cybersecurity Breach: Understanding the Value Relevance of Cybersecurity Risk Management Assurance

This study investigates how voluntary cybersecurity risk management (CyRM) assurance affects non-professional investors’ judgments and decisions. The study also examines how the value relevance of CyRM assurance is altered when having such assurance is expected/unexpected. Employing an experimental approach, we find that after a cyber-breach occurs, companies previously engaging in voluntary CyRM assurance receive more favorable investor assessments of management credibility and, in turn, higher stock valuations. We also find that investors’ assessments of management credibility and stock valuations are more extreme for companies that engage (do not engage) in CyRM assurance in industries where such assurance is not (is) the norm. This study begins to address the question of whether there is a demand for CyRM assurance offered by audit firms, particularly given lingering concerns in research and practice as to the viability of IT-related assurance services. Our research reinforces the profession’s position that management and boards need to recognize that cyber risk will differ by industry and that investors will react to violations of implicit industry standards for cyber risk management. The results also demonstrate the value to management credibility of having prior CyRM assurance after a cyber-breach; the reputation and damage control is important for both management and the company.

National and Foreign-controlled Companies Operating in Development Activities in Czechia and Aspects of their Capital Structure Management

Research background: Entities operating in the field of development activities show significant specifics, including a high level of indebtedness. Given the nature of development projects, which are long-term, and their financial complexity, companies take, at the same time, high risks. Therefore, there is need of a high standard of financial management and risk management in this type of companies. Purpose of the article: The aim of the paper was to provide information regarding return on equity and point out the risk factors of financial management. A partial aim of the conducted preliminary research was to identify and evaluate selected differences in financial management of national companies and foreign-controlled companies. Methods: The research was conducted as mixed research. It started with the undertaking of qualitative research focused on textual analysis of the text and collection of selected relevant quantitative data. For evaluation, we used INFA methodology, which links financial controlling and risk controlling indicators. The data under investigation were those related to the evaluation of return on equity in relation to risks taken. The indicators of the assets, self-financing ratio and debt ratio were assessed, including the assessment of the impact of these factors on return on equity and taken risks. Findings & Value added: The research provides new knowledge regarding the extent to which equity capital is used in the financial management of companies operating in the Czech Republic in development activities. The results indiciate that companies under foreign control and domestic companies show differences in financial structure and financial stability indicators, as well as in the effectiveness of using their capital.

Analysis of the applicability of international standards of risk management in healthcare organizations

Analysis of the applicability of international standards of risk management in healthcare organizations

Organizational management of risky companies in the context of the perspective advancement of the system and resource security of the Ministry of Defence of Ukraine

The article arouses interest among managers and scientists who deal with the problems of internal control and risk management. The study is aimed at managers who require clarification of the nature of risk-based internal control. The regulation of the system of state internal financial control. The prerequisites for its formation are analyzed and the main elements are characterized. The article reveals the tendencies and vector of development of internal control and risk management in the Ministry of Defense of Ukraine and the Armed Forces of Ukraine in the context of the implementation of the tasks assigned to the Ministry of Defense and the Armed Forces of Ukraine. The main attention in the article is paid to the analysis of the guiding documents regulating the issues of internal control and risk management and their relationship with the documents of defense planning. A retrospective review of the development of risk-oriented internal control was carried out. The research used methods of analysis, synthesis, and systems approach. The number of normative legal acts and other documents have been determined that directly regulate the issues of internal control. The main national standards of risk management have been determined, the publication of which has become an essential step in the development of risk management. The elements of the internal control system are revealed and their brief description is provided. A certain algorithm and procedure for the development of organizational documents on internal control issues in the institution.

Исследование бюджетных рисков: процессный подход

Abstract. Competitiveness has always been the basis for building a market economy. In modern conditions, this quality should also be enjoyed by public sector institutions. Pre-education that takes place in the public sector of the economy, which mainly includes educational institutions, is aimed at creating a competitive environment among educational institutions, in which they must fight for victory in the competition to complete a state task, for applicants, for reputation, and, ultimately, for budget funding. And in this situation, various management systems, often borrowed from the commercial sphere of activity, come to the fore. One of these systems is the risk management system, which includes both the positive and negative nature of risk and its hybrid component in the modern interpretation. Existing risk management standards consider risk from these positions. Purpose of work it is a study of budget risks from the point of view of the process approach, assessment and relationship of the stages of the budget process and risks. The novelty of this work is the use of risk-based thinking to achieve the effectiveness of the quality management system of budget processes. Methods. The methodological apparatus of research on the stated problem is based on the methods of economic and comparative analysis, expert assessments. Results. The results of the study revealed a clear relationship and reflection of the main principles of the process approach in the budget process. In addition, it was determined that the budget process also has the characteristic key elements of the process approach. measures to prevent budget risks are taken jointly by the owner and participants in the budget process, using the necessary resources and following the relevant principles, while the coordinator, who is responsible for the coordinated work of participants in the process and ensures the safety and timely presentation of all potentially useful information, plays a key role in preventing and minimizing budget process risks.

Risk management in the Brazilian Federal Government: a ministerial analysis

This paper describes the current stage of the development of the ministries’ risk management systems, considering the demands and orientations given by the Joint Normative Instruction MP/CGU n. 01/2016 and the Public Governance Decree (Decree n. 9.203, of November 22, 2017, altered by the Decree n. 9.901, of July 8, 2019). With the intention of identifying how each ministry has been managing the risks that aim at ensuring that the goals of the public policies and the strengthening of their own governance structures will be met, this research formulated indicators that allow cases to be described, based on the recommendations of national and international standards of governance and risk management. The results show that Brazilian ministerial risk management is still incipient, due to the fragile institutionalization associated with political-administrative instability. There is still a need for institutionalizing a culture of risk management and mainly, adopting a long-term perspective in the public sector organizations so that consistent risk management systems can be effectively implemented.

Enabling digitisation to reduce risk in the food system

Enabling digitisation to reduce risk in the food system

Methodological recommendations on safety decision making for offshore oil & gas platforms

Object and purpose of research. This paper discusses offshore oil & gas platforms as complex social and technical systems. The purpose is to consider the results of the research on development of recommendations aimed at improving the methodological apparatus for making management decisions to insure the offshore oil & gas field structures safety operations.
 Materials and methods. This work followed common methods of theoretical studies and was based on KSRC guidelines, risk management standards, as well as relevant publications, both Russian and foreign.
 Main results. Existing methodological recommendations on safety decision-making for offshore oil and gas facilities were systematized. The task of describing the implementation of decision-making methodology intended to ensure safe operation of offshore facilities and their equipment has been successfully accomplished.
 Conclusion. Methodological recommendations on decision making suggested in this paper with reference to the operation of offshore oil and gas facilities are intended to improve their safety, as well as to prevent or mitigate their possible accidents (failures) and justify the choice of optimal cost-effective solutions.

ANALYSIS OF THE RISK MANAGEMENT PROCESS IN THE QUALITY MANAGEMENT SYSTEM OF AN ENTERPRISE MANUFACTURING MEDICAL DEVICES

In modern market conditions, any organization, including those engaged in the production of medical devices, must identify risks, carry out their analysis, and determine the degree of their influence on the achievement of goals. This forces enterprises, on the basis of standards for management systems, standards for risk management, including taking into account the specifics of organizations, to implement a risk-based approach, creating their own risk management mechanisms. The article presents and describes in detail the basis for the methodology of the risk management process scheme in the quality management system of an organization engaged in the field of medicine.

Standardized risk management in catheterization procedures for non-ST-segment elevation myocardial infarction: associations with in-hospital clinical outcomes

Abstract Introduction and purpose Patient risk in non-ST-segment elevation myocardial infarction (NSTEMI) depends on clinical setting, individual patient variables and procedural characteristics. Standardized risk-adjusted periprocedural management for catheterization procedures using a Standard Operating Procedure (SOP) was investigated to evaluate associations with in-hospital clinical outcomes. Methods In 01/2018, our heart center established an SOP for coronary catheterization procedures in NSTEMI, targeting 1) standardized pre-procedural risk assessment using National Cardiovascular Data Registry (NCDR) risk models, and 2) standardized post-procedural risk-adjusted safety measures, including advanced patient monitoring (intermediate/intensive care) and use of vascular closure devices. All patients presenting with invasively-managed NSTEMI in 2018 were retrospectively evaluated for SOP-based pre-procedural risk scoring, SOP-based post-procedural management and in-hospital clinical outcomes of mortality, major bleeding (MB, according to BARC ≥3) and acute kidney injury (AKI, according to KDIGO). Results A total of 430 patients (age 72±12 years, 71% male, BMI 27±5) presenting with NSTEMI from 01 to 12/2018 were included, 9.8% presented in cardiogenic shock and 4.7% had suffered a preclinical cardiac arrest. Overall in-hospital mortality was 3.7%, MB occurred in 6.5%. 207 patients (48.1%, SOP+ group) had received both 1) pre-procedural risk assessment and 2) post-procedural risk-adjusted safety measures; the other 223 patients (51.9%, SOP- group) had not received either 1) or 2). There were no significant differences in baseline characteristics and prior-existing medical conditions between groups, however, significantly more patients in SOP- group were treated in emergency settings (39.9% vs. 21.7%, p=0.004). However, significantly more patients in SOP- were treated in emergency settings at higher risk (39.9% (SOP-) vs. 21.7% (SOP+); p<0.001). In univariate analysis, all in-hospital clinical outcomes of mortality (1.4% (SOP+) vs. 5.8% (SOP-); p=0.016), MB (2.9% (SOP+) vs. 9.9% (SOP-); p=0.003) and AKI were significantly lower in the SOP+ group (15.9% (SOP+) vs. 24.2% (SOP-); p=0.033). After correction for the difference in risk between groups due to emergency settings by multivariate logistic regression analysis, MB remained significantly lower in SOP+ (p=0.02), while mortality (p=0.14) and AKI (p=0.19) were not significantly associated with SOP-status anymore. Conclusion Standardized risk management in invasively managed NSTEMI was associated with significantly lower rates of in-hospital major bleedings. Funding Acknowledgement Type of funding source: Private grant(s) and/or Sponsorship. Main funding source(s): Junior Clinician Scientist Track, Medical faculty, Heinrich-Heine-University Düsseldorf, Germany