Risk Taxonomy Research Articles

Analysis of decisions and associated risks in the process of response for tender (RCT): the approach DR2CT

The decision-making process during the response to a call for tender is a critical phase for organizations, as it aims to utilize information about the company's external environment to support informed and strategic decisions. Typically, this information is represented as a list of potential risks that must be assessed and managed throughout the decision-making process. However, identifying risks associated with the business or external environment often lacks robust methodological frameworks, leading to gaps in risk management and decision support. This challenge defines the axis and scope of our contribution. In this context, we propose a comprehensive approach to enhance risk identification and analysis during the decision-making stages of responding to a call for tender (RCT). Our approach is structured to identify and analyze risks at different decision-making levels, providing a systematic methodology for their assessment. Central to this contribution are three key components: a decision model, a risk model, and two interrelated processes, one for decision analysis and the other for risk identification. The proposed decision model provides a structured framework for evaluating the tender, while the risk model offers a detailed taxonomy and characterization of risks. The decision analysis process facilitates the systematic evaluation of information and potential scenarios, and the risk identification process enables the proactive collection and categorization of risks derived from the analysis of the call for tender. Together, these components provide an integrated solution to support decision-makers in identifying, understanding, and mitigating risks, ultimately leading to more informed and resilient decision-making during the RCT process.

Comparing experts’ and users’ perspectives on the use of password workarounds and the risk of data breaches

Purpose The increased use of Information Systems (IS) as a working tool for employees increases the number of accounts and passwords required. Despite being more aware of password entropy, users still often participate in deviant password behaviors, known as “password workarounds” or “shadow security.” These deviant password behaviors can put individuals and organizations at risk, resulting in a data breach. This paper aims to engage IS users and Subject Matter Experts (SMEs), focused on designing, developing and empirically validating the Password Workaround Cybersecurity Risk Taxonomy (PaWoCyRiT) – a 2x2 taxonomy constructed by aggregated scores of perceived cybersecurity risks from Password Workarounds (PWWAs) techniques and their usage frequency. Design/methodology/approach This research study was a developmental design conducted in three phases using qualitative and quantitative methods: (1) A set of 10 PWWAs that were identified from the literature were validated by SMEs along with their perspectives on the PWWAs usage and risk for data breach; (2) A pilot study was conducted to ensure reliability and validity and identify if any measurement issues would have hindered the results and (3) The main study data collection was conducted with a large group of IS users, where also they reported on coworkers' engagement frequencies related to the PWWAs. Findings The results indicate that statistically significant differences were found between SMEs and IS users in their aggregated perceptions of risks of the PWWAs in causing a data breach, with IS users perceiving higher risks. Engagement patterns varied between the two groups, as well as factors like years of IS experience, gender and job level had statistically significant differences among groups. Practical implications The PaWoCyRiT taxonomy that the we have developed and empirically validated is a handy tool for organizational cyber risk officers. The taxonomy provides organizations with a quantifiable means to assess and ultimately mitigate cybersecurity risks. Social implications Passwords have been used for a long time to grant controlled access to classified spaces, electronics, networks and more. However, the dramatic increase in user accounts over the past few decades has exposed the realization that technological measures alone cannot ensure a high level of IS security; this leaves the end-users holding a critical role in protecting their organization and personal information. Thus, the taxonomy that the authors have developed and empirically validated provides broader implications for society, as it assists organizations in all industries with the ability to mitigate the risks of data breaches that can result from PWWAs. Originality/value The taxonomy the we have developed and validated, the PaWoCyRiT, provides organizations with insights into password-related risks and behaviors that may lead to data breaches.

The taxonomy of tail risk

AbstractWe use tail events at different levels of severity to define an asset's tail risk and to decompose the latter into a systematic and an idiosyncratic component. The systematic component captures an asset's tendency to experience joint tail losses with the market and generalizes a classic tail dependence coefficient. However, the idiosyncratic component consists of two parts: idiosyncratic tail risk that leads to asset‐specific tail losses and tail risk cushioning that dampens the tail losses emanating from the market. Tail risk cushioning is a novel concept that arises naturally in our framework, is consistent with the previous two and completes the taxonomy of tail risk. We examine the performance of our tail risk decomposition on a large dataset, confirming some previous results on tail risk and uncovering new theoretical and empirical findings.

A Systematic Review of Personal Information Sharing in Smart Cities: Risks, Impacts, and Controls

AbstractSmart cities aim to deliver smart services that rely on emerging technologies to their users. In order for users to get the provided services, they need to share their personal information with different parties. However, sharing personal information in smart cities may impact the privacy of that information. Thus, there is a need to address privacy risks relevant to sharing personal information in smart cities. This study aims to address this issue by conducting a systematic literature review (SLR) to identify and extract privacy risks, impacts, and existing controls associated with sharing personal information, considering elements involved and interacting during the sharing activity in smart cities. A set of 83 selected studies in both academic and industry fields were reviewed, and the results were categorised into three main groups: privacy risks, impacts, and controls. Moreover, the implications and future research directions were also reported. The proposed privacy risk taxonomy will provide a much-needed foundation for the industry and research community, intending to research and evaluate privacy risk frameworks and design solutions for sharing personal information in smart cities.

Humanzentrierte Implementierung von (teil-)autonomen Drohnen

Abstract The industrial use of drones is constantly increasing due to the transition from Industry 4.0 to Industry 5.0. A prerequisite for the concrete implementation is the legal and organizational risk assessment of flight robotics. The core of the article is a systematic overview of relevant human-centered risk factors for the adaptation of drones in organizations. Based on the proposed risk taxonomy, design options for human-drone interaction and an overview of key questions for risk assessment are presented.

A study of sustainability risks from industry 4.0 perspective: taxonomy and future research avenues

PurposeA large number of organisations are moving towards adopting Industry 4.0 (I4.0), and simultaneously, the emphasis on attaining sustainability development goals is also increasing. Hence, it is imperative to understand the interplay between I4.0 and sustainability. However, the literature addressing the same is still in infancy. Accordingly, the purpose of this study is to fill this gap in the literature by exploring the potential sustainability impacts of I4.0 on the organisations and society in terms of sustainability risks.Design/methodology/approachTo gain an understanding of sustainability aspects in the I4.0 context, relevant literature is gathered using Scopus and Web-of-Science database. An in-depth review of 51 research papers is performed to determine the sustainability risks associated with I4.0.FindingsFrom the study, a total of 16 sustainability risks are identified, and I4.0 sustainability risk taxonomy is developed. The proposed taxonomy extends the sustainability implications of I4.0 beyond the triple bottom line umbrella and includes the organisational perspective as well. Furthermore, the study provides future research avenues to scholars by positing five potential research questions under different risk management stages.Research limitations/implicationsThe study provides an understanding of sustainability risks associated with the adoption of I4.0. The findings will help practitioners streamline their production and operation processes by finding out possible solution to the sustainability risks of their smart factories in advance. The present research will act as a stepping stone towards I4.0 sustainability. The proposed research questions will assist the future researchers in extending the field of I4.0.Originality/valueTo the best of the authors’ knowledge, this is one of the first studies to address the topic of sustainability risks in the context of I4.0.

AI Risk Profiles: A Standards Proposal for Pre-deployment AI Risk Disclosures

As AI systems’ sophistication and proliferation have increased, awareness of the risks has grown proportionally. The AI industry is increasingly emphasizing the need for transparency, with proposals ranging from standardizing use of technical disclosures, like model cards, to regulatory licensing regimes. Since the AI value chain is complicated, with actors bringing varied expertise, perspectives, and values, it is crucial that consumers of transparency disclosures be able to understand the risks of the AI system in question. In this paper we propose a risk profiling standard which can guide downstream decision-making, including triaging further risk assessment, informing procurement and deployment, and directing regulatory frameworks. The standard is built on our proposed taxonomy of AI risks, which distills the wide variety of risks proposed in the literature into a high-level categorization. We outline the myriad data sources needed to construct informative Risk Profiles and propose a template and methodology for collating risk information into a standard, yet flexible, structure. We apply this methodology to a number of prominent AI systems using publicly available information. To conclude, we discuss design decisions for the profiles and future work.

Ethical AI and the Future of Healthcare: Combining Academic Theory and Industry Practice to Ensure Patient-Centered Care

Purpose: This paper seeks to define a risk taxonomy, establish meaningful controls, and create a prospective harms model for AI risks in healthcare. Currently, there is no known comprehensive definition of AI risks, as applied to industry and society. 
 Materials and Methods: The temptation for current research, both in academia and industry, is to apply exclusively-tech-based solutions to these complex problems; however, this view is myopic, and can be remedied by establishing effective controls informed by a holistic approach to managing AI risk. Sociotechnical Systems Theory (STS) is an attractive theoretical lens for this issue, because it prevents collapsing a multifaceted problem into a one-dimensional solution. Specifically, the multidisciplinary approach—one that includes both the sciences and the humanities—reveals a multidimensional view of technology-society interaction, exemplified by the advent of AI. 
 Findings: After advancing this risk taxonomy, this paper utilizes the risk management framework of Lean Six Sigma (LSS) to propose effective mitigating controls for the identified risks. LSS determines controls through data collection and analysis, and supports data-driven decision making for industry professionals.
 Implications to Theory, Practice and Policy: Instantiating the theory of STS into industry practices could be critical, then, for determining and mitigating real-world risks from AI. In summary, this paper combines the academic theory of sociotechnical systems with the industry practice of Lean Six Sigma to develop a hybrid model to fill a gap in the literature. Drawing upon both theory and practice ensures a robust, informed risk model of AI use in healthcare.

Capacity building in aviation safety risk management through risk taxonomy

Capacity building in aviation safety risk management through risk taxonomy

A taxonomy of macro-financial risks and policies to address them

A taxonomy of macro-financial risks and policies to address them

What do we know about ESG and risk? A systematic and bibliometric review

AbstractEnvironmental, Social and Governance (ESG) issues have become particularly relevant in the agendas of policymakers, investment decisions by companies and asset allocation process of investors. However, the transition to a greener and more sustainable economic system is not without risks. The literature has investigated the relationship between ESG and risk in different ways, through multiple perspectives and approaches. We select all documents with “ESG” and “Risk” in the title, abstracts and keywords available in Scopus and, after removing non‐relevant papers, we are left with a sample of 589 documents published in the period 1983–2022. To provide a view of the most important studies, we also focus on the most cited documents to discuss the methodological approaches and main results. The results show that over time, ESG has gained increasing attention from the literature, but researchers work in isolation and there is no single approach or leading core topic driving academic productivity; a clear taxonomy of ESG risks appears to be missing. To the best of our knowledge, this paper is the first to discuss research on ESG and risk from a financial perspective. The results highlight some existing gaps in the literature that can provide a hint for the development of the topic by researchers. These include a clearer taxonomy of ESG risks that can affect investors' and companies' decisions, a greater effort to evaluate how ESG risks distribute and spill from one sector to another and the inclusion of emerging economies and small and medium‐sized enterprises in the samples.

Taxonomy Of Operational Risks in Fintech: A Systematic Literature Review

Objective: The Fintech industry has been gaining importance among customers of the financial system, thanks to the agility, scope, and simplicity of the services offered through digital platforms. This article aims to describe, from the literature, the Fintech taxonomy to identify the Operational Risks by mapping current knowledge and finding gaps in the relevant literature. Design/Methodology/Approach: A systematic literature review is carried out based on a bibliometric analysis using the search equation "Fintech", "Risk", "Credit" in the SCOPUS indexer. Eighty scientific articles were obtained, and a .cvs database was downloaded to perform the cooccurrence study of keywords with the VOSviewer® software. Subsequently, a content analysis was performed by the ATLAS.ti® tool. Results/Discussion: The review proposes a taxonomy of five codes from the point of view of different authors: Cyber Risk, Model Risk, Business Practices Risk, Customer Knowledge Risk, and Data Protection Risk. They help to identify the classification of Fintech risks for analysis. Conclusions: The analysis is carried out by dispersion diagrams, which show the degree of relationship between the different risk variables in Fintech. Originality/Value: This document maps the information and scientific knowledge related to the classification of Operational Risks in Fintech, their degree of relationship, and consequences.

DETERMINANT FACTORS OF THE DECISIONS ASSOCIATED TO RISK OF THE COLOMBIAN COFFEE GROWERS

The main idea of this paper is to identify the determinant factors of the decisions associated with the risk of Colombian small-scale coffee growers. Through a survey from a selected sample from Colombian coffee growers, classified by region and size,we identify the risk propensity and confidence in risk management instruments. With the data, we build two taxonomies: the first one, the risk taxonomy; and the second one, the risk management instruments taxonomy. With these results, we build six unobservable constructs through Confirmatory Factor Analysis CFA methodology. The constructs represented: i) the history of successes and failures resulting from decisions made in the past; ii) the influence of the idiosyncratic characteristics of the problem on coffee growers' perceptions of risk; iii) the tendency of coffee growers to take or avoid risks; iv) the alternatives that a decision maker confronts; v) the individual evaluation of the risks before a situation and the confidence in that evaluation; and iv) the effects of the risk management instruments offered to the coffee growers. The results of the six latent constructs were significant, which allows us to conclude that the latent constructs are measurement models defined as indicators that describe the decisions associated with the risk of small-scale coffee grower’strough the identified factors.

Financial Crimes in Web3-Empowered Metaverse: Taxonomy, Countermeasures, and Opportunities

At present, the concept of metaverse has sparked widespread attention from the public to major industries. With the rapid development of blockchain and Web3 technologies, the decentralized metaverse ecology has attracted a large influx of users and capital. Due to the lack of industry standards and regulatory rules, the Web3-empowered metaverse ecosystem has witnessed a variety of financial crimes, such as scams, code exploit, wash trading, money laundering, and illegal services and shops. To this end, it is especially urgent and critical to summarize and classify the financial security threats on the Web3-empowered metaverse in order to maintain the long-term healthy development of its ecology. In this paper, we first outline the background, foundation, and applications of the Web3 metaverse. Then, we provide a comprehensive overview and taxonomy of the security risks and financial crimes that have emerged since the development of the decentralized metaverse. For each financial crime, we focus on three issues: a) existing definitions, b) relevant cases and analysis, and c) existing academic research on this type of crime. Next, from the perspective of academic research and government policy, we summarize the current anti-crime measurements and technologies in the metaverse. Finally, we discuss the opportunities and challenges in behavioral mining and the potential regulation of financial activities in the metaverse. The overview of this paper is expected to help readers better understand the potential security threats in this emerging ecology, and to provide insights and references for financial crime fighting.

The Taxonomy of Tail Risk

The Taxonomy of Tail Risk

Machine learning and Natural Language Processing of social media data for event detection in smart cities

Social media data analysis in a smart city context can represent an efficacious instrument to inform decision making. The manuscript strives to leverage the power of Natural Language Processing (NLP) techniques applied to Twitter messages using supervised learning to achieve real-time automated event detection in smart cities. A semantic-based taxonomy of risks is devised to discover and analyse associated events from data streams, with a view to: (i) read and process, in real-time, published texts (ii) classify each text into one representative real-world category (iii) assign a citizen satisfaction value to each event. To select the language processing models striking the best balance between accuracy and processing speed, we conducted a pre-emptive evaluation, comparing several baseline language models formerly employed by researchers for event classification. A heuristic analysis of several smart cities and community initiatives was conducted, with a view to define real-world scenarios as basis for determining correlations between two or more co-occurring event types and their associated levels of citizen satisfaction, while further considering environmental factors. Based on Multiple Regression Analysis (MRA), we established the relationships between scenario variables, obtaining a variance of 60%–90% between the dependent and independent variables. The selected combination of supervised NLP techniques leverages an accuracy of 88.5%. We found that all regression models had at least one variable below the 0.05 threshold of the f − t e s t , therefore at least one statistically significant independent variable. These findings ultimately illustrate how citizens, taking the role of active social sensors, can yield vital data that authorities can use to make educated decisions and sustainably construct smarter cities. • We use a bespoke taxonomy of risks to detect events on social media in a smart city. • As active social sensors, citizens provide valuable insight for smart city management. • We determine general patterns and trends in citizen sentiment in a smart city context. • Our Machine Learning techniques show an accuracy of 88.5% for risk event detection. • We validate relationships between user satisfaction and events by Regression Analysis.

A stakeholder-based taxonomy for managing regulatory compliance risk and aligning to business strategy

Despite advances in how organisations identify and categorise evolving regulatory requirements, there is no common alignment around a robust taxonomy to manage regulatory compliance risk. This paper explains the importance of risk taxonomy, and how objectives provide the lens through which to categorise risks in a robust taxonomy. It summarises a stakeholder-based approach for categorising regulatory compliance risk, providing a financial services taxonomy example that has been successfully implemented at CWB. The advantages of a stakeholder-based taxonomy approach are reviewed, including its (a) robust risk identification and assessment; (b) flexible application to any scale or complexity of enterprise; (c) natural alignment for structuring oversight; (d) facilitation of focused reporting and aggregated updates; (e) agility to apply to an evolving external landscape; and most importantly (f) alignment with processes and tools for strategic management. Areas for further research to expand that literature are proposed, building from the paper's two main ideas — applying an objectives focus to risk taxonomy, and using it to apply a stakeholder-based approach to regulatory compliance risk taxonomy. The paper concludes with practical next step considerations for chief compliance officers in managing their own programmes.

Risk‐based approach for managing obsolescence for automation systems in heavy industries

AbstractObsolescence is an important consideration in the management and engineering of heavy industrial facilities. Examples of these could include refineries, chemical plants, and other large‐scale materials processing facilities. These facilities have lifetimes of many decades but operate on software, automation hardware, and other electrical equipment that reaches obsolescence much sooner than the rotating equipment, unit operations, and other major systems of the facility. This work proposes a method to manage obsolescence of automation and electrical systems at industrial sites. This risk management method was developed by first analyzing a database of upgrade projects at several industrial sites and identifying parts that had been replaced due to obsolescence. The analysis was used to prioritize replacement of obsolescent parts based on the average operational lifespans, their criticality in operations, their manufacturer's continued production state, and other factors. Based on those results, a taxonomy of obsolescence risk, and a risk assessment plan were developed to manage the replacement of parts. The value of this proposed management strategy was validated through its application to 13 heavy industrial facilities. The results indicate a reduction of roughly 70% in reactive replacements due to obsolescence after the major upgrade and a 24% reduction in unplanned downtime due to part failure during normal operations. While this study is focused on heavy industries, the proposed method for identifying and managing component obsolescence can be applied to other industries and systems.

Proposed Taxonomy of Cybersecurity Risk in Mobile Applications

Smartphone devices are rapidly becoming one of the essential part of everyone’s life, users relying on them to maintaineverything from messages, personal files, contacts and social media account to digital banking, online shopping and retailtransactions with the help of dedicated mobile applications. The increase in the number of smartphone users, however, alsoleads to an increase in security threats. Many unethical hackers and cybercriminals have been eager to use these technologiesfor personal gain, such as theft, destruction, plagiarism, and a variety of other things. This study examines various cybersecurityrisks to mobile applications such as mobile banking and wallet apps. This study presents a new taxonomy for mobile applicationssecurity risks. Furthermore a taxonomy classifying the identified cybersecurity risks has been proposed which can cover alltypes of cyberattacks on mobile apps. The study also discuss some useful suggestions to help improve user awareness aboutsecurity aspects in mobile applications.

Clinical risk in remote consultations in general practice: findings from in-COVID-19 pandemic qualitative research.

The COVID-19 pandemic-related rise in remote consulting raises questions about the nature and type of risks in remote general practice. To develop an empirically based and theory-informed taxonomy of risks associated with remote consultations. Qualitative sub-study of data selected from the wider datasets of three large, multi-site, mixed-method studies of remote care in general practice before and during the COVID-19 pandemic in the UK. Semi-structured interviews and focus groups, with a total of 176 clinicians and 43 patients. Data were analysed thematically, taking account of an existing framework of domains of clinical risk. The COVID-19 pandemic brought changes to estates (for example, how waiting rooms were used), access pathways, technologies, and interpersonal interactions. Six domains of risk were evident in relation to the following: (1) practice set-up and organisation (including digital inequalities of access, technology failure, and reduced service efficiency); (2) communication and the clinical relationship (including a shift to more transactional consultations); (3) quality of clinical care (including missed diagnoses, safeguarding challenges, over-investigation, and over-treatment); (4) increased burden on the patient (for example, to self-examine and navigate between services); (5) reduced opportunities for screening and managing the social determinants of health; and (6) workforce (including increased clinician stress and fewer opportunities for learning). Notwithstanding potential benefits, if remote consultations are to work safely, risks must be actively mitigated by measures that include digital inclusion strategies, enhanced safety-netting, and training and support for staff.