Search

Insurance is a promising risk transfer tool against switching cyberattacks on power grids that can disrupt operation and potentially lead to widespread outages. This paper emphasizes on a framework of premium calculation for cyber insurance businesses by modeling potential electronic intrusion with steady-state simulation results and its direct hypothesized impacts. The proposed actuarial framework models the operational monetary losses with the hypothesized power outages based on the cyber-reliability assessment and its expected mean time to restore power (MTTRP). The ruin probability is employed as the fundamental formula to determine the feasible insurance premium pool. Hypothesized spatial correlation studies on multiple substation contingencies associated with switching attacks have shown estimated operational losses and expected duration of power restoration, which is translated into the calculation of insurance premium. The proposed actuarial framework is validated using generalized IEEE test cases with modified parameters on substations. The potential implications of grid's hypothetical scenarios are discussed.

In the 21st century, with the continuous development of science and technology in our country, the explosive growth of data, big data has become an important resource acquisition channel at home and abroad with its massive data resources. De-importance can not only help small shops, but also The level of economic management of government organizations has spawned many unprecedented business models, which are more capable of promoting and promoting the sustainable development of our country's economy. For our country's power companies, each node such as the distribution network will generate massive amounts of data, and these cumbersome data in the past are now becoming a rare asset for the company. In the era of big data, the data generated by electricity can bring earth-shaking changes to enterprises. With the in-depth reform of all aspects of power companies, power companies in various places can only maintain a firm position in corporate competition if they closely follow the trend of big data, with lower costs, higher efficiency, and better power quality. Using the core technology of big data to seamlessly integrate it with enterprise risk management and realize the top-down application of big data mining and other information technologies within the enterprise will be an important way to build an information enterprise in an all-round way. Making full use of information technology in power production and management and actively promoting the application of big data in the power system will help improve the level of refined operation and management of power companies at all levels, improve operational efficiency, and promote the transformation and development of enterprises. The purpose of this paper is to research on the dynamic decision-making algorithm of power enterprise's operational risk management based on big data. In this paper, through in-depth research on big data, analyzing the current big data mining technology and combining with the operating enviro nment of electric power enterprises in our society, this paper discusses the dynamic decision-making algorithm of electric power enterprise operating risk management under big data. This article will take the management of electric power enterprises under big data as the research object, and conduct research and analysis through literature method, questionnaire survey method and mathematical statistics method. Studies have shown that some small probability of unqualified power equipment is put into the production and operation of the power industry, which has a great negative effect on the management and control of equipment risks, and the probability of accidents is greatly increased.

With the onset of the global pandemic, organizations have had to embrace digital transformation and adapt to the new normal. Digital transformation has helped global workforce to work from remote locations and ensure business continuity. However, this has also resulted in a significant surge in cyber attacks due to an increase in attack surface and rogue threat actors. Security Leaders and CFOs are facing a taxing challenge to decide on where and how to invest to secure their organizations and perform enterprise cybersecurity risk management in context of the financial constraints that most organizations are facing at the moment. We propose an efficient and risk-based cybersecurity maturity model called “Smart Secure”, for guiding security leaders to perform smart & efficient enterprise risk management. This would help in efficient distribution of available resources for information systems based on level of risk & criticality of the application, for their organization. Thus, providing a solution for efficient cybersecurity funding and prioritization to help improve overall cybersecurity posture for the organization.

Taking Shandong entity enterprises as an example, this paper studies the main ways of business model innovation. Through systematic analysis of the risks in the process of innovation, it is found that the risks in business model innovation mainly include: environmental risks caused by technological progress, policy changes and other factors; market risks caused by ineffective industrialization of new products and other factors; strategic risks caused by ineffective combination of innovation and strategy; and financial risks caused by unreasonable capital structure, etc. On this basis, taking the time of innovation as the order, this paper constructs risk prevention and control countermeasures based on business model innovation. The risk prevention and control before innovation can be carried out by positioning customer demand with the help of internet and big data technology, grasping the trend of technological progress and other measures; the risk prevention and control in innovation can be carried out by building cooperation network, reengineering business process and other measures; the risk prevention and control after innovation can be carried out by risk warning, continuous optimization of business model and other measures.

This paper uses linear regression method to discuss the influence of enterprise risk taking on stock price crash risk and the regulation effect of product market competition on the relationship between them. The empirical results show that corporate risk taking is significantly positively correlated with stock price crash risk at 1% level. On average, the risk of stock price crash increases by 0.07% for every 1% increase in corporate risk taking. Product market competition has a positive regulating effect on the relationship between them. This paper plays a certain role in improving the supervision efficiency of capital market, strengthening investor education, enterprise risk management and market value management.

In order to make up for the deficiency of enterprise threat intelligence response mechanism, a scientific enterprise threat intelligence response evaluation model is proposed and the enterprise risk is empirically evaluated and analyzed. The enterprise threat intelligence response model was constructed based on the four main influencing factors of enterprise personnel quality, software/hardware facilities, technical support, and management awareness. The RBF neural network improved by grey Wolf swarm optimization algorithm was used for training and simulation, so as to conduct in-depth analysis and research. The results show that: 1. RBF neural network can make up for the deficiency of RBF neural network by optimizing grey Wolf pack; 2. While focusing on technological innovation and personnel training in the threat intelligence response system, enterprises cannot ignore the importance of management awareness.

The outsourcing of security management has become increasingly attractive for many organisations, this may be the only path available due to the lack of in-house expertise and infrastructure requirements. Deployment of contemporary systems are no longer the essential effective strategies in cybersecurity threat management. The managed security service providers offering a raft of essential mature security monitoring and management capabilities; security information and event management, strategic management of organisation's overall governance, enterprise risk and compliance with regulations (GRC) will become the option for many organisations. The need for embedding collaborative visualisation in cybersecurity systems are on the rise not only because intelligent visual data displays facilitate the highest possible situation awareness transmitted from the computer to the human but also as it provides the opportunity of collaboration with other experts in a timely manner. It facilitates analysts to acquire a higher number of accurate insights of incidents. Regardless of whether outsourced or on-prem, this will cost organisations a greater amount of money. This paper takes on the challenge proactively by exploring how to establish a virtualised, cyber-security operations centre (C-SOC) that provides information on situation awareness for managing cybersecurity through utilising highly stable open-source network security tools cost-efficiently. The infrastructure development is performed by integrating these tools within a VM networking environment.

Emergent and future conditions that influence the global container port industry include pandemics, regulations, markets, technologies, environments, organizations, energy resources, workforces, supply-chain partners, and others. It is critical to simultaneously formulate and adapt multiple strategic plans of individual ports to the above stressors. The Port of Virginia (POV) generates 400,000 jobs, or roughly 11% of jobs across Virginia, and has an overall annual economic impact of $92 billion. POV is currently investing $800 million to expand its annual container throughput capacity by 40 percent by the end of 2020. This investment supports initiatives outlined in the port’s 2065 master plan through the investigation of different scenarios that impact emergent and future port conditions. This paper describes the most and least disruptive scenarios of emergent and future conditions, including hybrid scenarios involving the COVID-19 pandemic. The degree of disruption is measured by the changes in priorities of a port’s strategic plan, in particular for the rank order of investments by their individual contributions to the strategic goals of the port. The analysis described herein includes sixteen strategic goals, 31 strategic plan investments, and several dozen emergent and future conditions. The analysis assembles the emergent conditions into scenarios. The most disruptive scenarios are selected for contingency planning, enterprise risk management, and research & development. Seven scenarios are available for future exploration in detail: (1) Funding Decrease (2) Natural Disaster (3) Green Technologies (4) Pandemic (5) Increased Automation (6) Alternative Financing (7) Population Changes. Green Technologies, Pandemic and Alternative Financing are explored in detail in this paper. The results of this paper are thus both a methodology for any port to address its emergent and future conditions via its strategic plans, and also a case study of enterprise resilience of a major container port of the United States. The results will be of interest to port owners and operators, risk managers, transportation agencies, regulators, freight shippers, human resource managers, the military, and others.

Based on the process of enterprise risk management, a large sample survey was carried out on the current status of non-systematic risks of new start-ups in universities in China, and different types of risks were analyzed in depth from risk identification, risk decision-making and risk control. This paper points out that the new venture risk source in colleges and universities is a multi-dimensional and multi-level risk source system, which mainly includes three levels: the external environmental risk source, the internal system risk source, and the innovative project risk source. Based on this, combined with the characteristics of new start-up companies in colleges and universities, we built a risk-breaking innovation risk transmission network for enterprises. Finally, the concept of risk threshold for new entrepreneurship in colleges and universities is put forward, and the evolution mechanism of new entrepreneurial risk system in colleges and universities is analzsed. The study found that: Currently, the non-system risk faced by start-up companies is ranked as capital risk, market risk, management risk and technology risk. Second, there are certain differences in the level of control of venture companies for different types of risks. The article puts forward some feasible suggestions for the current situation of risk management for start-up companies.

Governance, Risk and Compliance (GRC) is a novel and multifaceted means to an approach, whereby Enterprise Risk Management (ERM) and compliance are regarded as strategic initiatives that link to the business objectives. This, in turn, requires corporate governance to foster the growth and performance of the organization. The proper implementation and execution of GRC has a host of benefits for organizations. Some of these benefits include risk-based decision-making, organizational efficiency, visibility, transparency and business agility. The most convincing and demonstrable argument for integrated GRC is as an enabler for the organizational strategy. Whilst acknowledging the many benefits GRC has for organizations, it is equally important to address the numerous challenges GRC has in respect to frameworks, people, process and technology. This paper addresses the technological challenges of GRC by means of analyzing a commercial GRC software tool. The objective of this analysis is to ascertain if the challenges are valid and if organizations should invest in GRC software.

Tail risk estimation for portfolios of complex financial instruments is an important enterprise risk management task. Time consuming nested simulations are usually required for such tasks: The outer loop simulates the evolution of risk factors, or the scenarios. Inner simulations are then conducted in each scenario to estimate the corresponding portfolio losses, whose distribution entails the tail risk of interest. In this paper we propose an iterative procedure, called Importance-Allocated Nested Simulation (IANS), for tail risk estimation. We tested IANS in a multiple-period nested simulation setting for an actuarial application. Our numerical results show that IANS can be an order of magnitude more accurate that a standard nested simulation procedure.

Nowadays, enterprise business processes significantly relay on sophisticated and complex IT technologies to enhance business productivity which in turn increase operations' risks of failures and interruptions. Enterprises strive to continuously improve their business continuity program by testing business continuity plans to ensure optimum productivity and resiliency. However, usually observations recorded from drills' activities are not addressed effectively and in timely manner. Business Continuity Management (BCM) and Enterprise Risk Management (ERM) processes should be aligned together to reduce the time to address recorded observations. This paper illustrates a new implemented approach by aligning BCM and ERM processes. The alignment is based on extended collaboration. For example, risk register should be designed and shared collaboratively with business continuity practitioners to ensure defining accurate risks mitigation plans and controls for all drills' scenarios as well. Both processes practitioners shall work closely in conducting Business Impact Analysis and Risk Assessments (BIA/RA) and measure the impact of IT services' disruptions. Moreover, ERM practitioners should be involved in all BCM activities to detect areas of improvement and measure the effectiveness of developed plans and controls. Once observations are recorded from business continuity and disaster recovery (BC/DR) drills and compliances, they should be presented to a joint steering committee, prioritized based on severity and then transferred to the enterprise risk register. Both processes should operate side by side toward robust IT operations. This practice has been proven to be very practical and effective to reduce business overall risks and overdue observations.

This paper discusses the possible effort to mitigate insider threats risk and aim to inspire organizations to consider identifying insider threats as one of the risks in the company’s enterprise risk management activities. The paper suggests Trusted Human Framework (THF) as the on-going and cyclic process to detect and deter potential employees who bound to become the fraudster or perpetrator violating the access and trust given. The mitigation’s control statements were derived from the recommended practices in the “Common Sense Guide to Mitigating Insider Threats” produced by the Software Engineering Institute, Carnegie Mellon University (SEI-CMU). The statements validated via a survey which was responded by fifty respondents who work in Malaysia.

Rethinking organisations' risk resiliency against cyber risks has been found both successful and lacking because it is more challenging when organisations mirror past siloed approaches. In pursuit of effectiveness and resiliency, this paper examines the antecedents of Cybersecurity Management (CsM) to explore how siloed risk controls influence business effectiveness. At the same time, it explores the additional strengths in enhancing CsM through alignment with Enterprise Risk Management (ERM) to ensure that handling risk is proactively, strategically, and comprehensively managed. To explore the problem, this research commenced by considering both secondary and primary qualitative data to determine the current state of strategic foresight of organisations. The authors found evidence of a granular legacy, stranded in different security domains and siloed strategic approaches.

Emerging Technologies such as artificial intelligence, the Internet of Things (IoT), and distributed ledger continue to transform businesses, enabling new value creation in transformative ways. Importantly, most investigations and the broader scholarly discourse is around applications. In addition to the potential impacts on society, these technologies create risks, which even in the corporate context are not easily identified or evaluated and therefore cannot be easily addressed. The risks are both upside risks (opportunities or rewards) and downside risks (exposures that jeopardize the company). Can these risks be identified and evaluated? If so, what models might work for evaluating and perhaps even optimizing risk? In this study, we will first explore what technologies are being deployed and where the organizational risk is being considered or evaluated from a governance perspective within the organization. Based on interviews with executives facing these new environments, we developed the over-arching research questions: What theories guide our thinking best in terms of developing risk optimization models? What might these risk models look like? The research involved an exploration using a survey instrument and multiple qualitative methods involving business leaders from companies deploying these technologies as well as the development and preliminary testing of three different risk optimization models using scenario analysis data. Based on this analysis, we developed the foundations for a risk model executives could use to consider these technologies.

In order to solve the present problem of China's industrial park which caused by environmental pollution, this paper adopts axios interface technology, Web service technology, node.js technology, developing an intelligent supervision system for environmental pollution in industrial parks. Through this system, which can achieve the function of remote real-time monitoring, forecasting and early warning, decision analysis of various environmental pollutants discharged by enterprises and emergency management of environmental pollution emergencies in industrial parks. The system can obtain real-time environmental pollutant discharge data of each enterprise through monitors installed in industrial parks, according to the obtained data using radial basis function (RBF) neural network algorithm to predict the trend of environmental pollutants of various enterprises. Also, according to the environmental pollutants data we get for each enterprise risk analysis, then the risk analysis results for decision-making of the enterprise. What's more, we use all the results to be displayed visually.

The use of the risk management principles to reduce the number of dangerous factors arising in the course of principal activity is shown in the example of machine-building enterprise. The risks for several processes are identified and a risk map is built. To form a risk management system the standard image of business processes was transformed by adding the necessary element — the subject of management.

It is necessary to correlate the organization dimension and task dimension in the risk management for collaborative innovation projects. However, the existing analysis methods are restricted to one of the two dimensions, which also reduce the result of risk management. Social Network Analysis (SNA), which is the representative method in organization dimension, quantitatively evaluates the governance network formed by stakeholders and their relationships statically, but doesn't meet the dynamic characteristic of the network which caused by the risk factors. At the same time, System Dynamics (SD), which is the representative method in task dimension, can analyze the variational risk factors in project lifecycle and present risk mitigation actions. But it does not match the risk control responsibilities with the corresponding stakeholders properly, which generate inadequate organization fundamental for the actions. Therefore, this paper put forward a new method named Network Dynamic Analysis (NDA) by integrating SNA and SD and designed a framework of risk management based on the new method. In the framework, NDA changes the style of design and test of risk mitigation action as it connects the risk factor and risk responsibility by considering the governance network in organization dimension and project risk factors in task dimension together. More specifically, the adjustment of governance network was regard as risk mitigation action and its effect is text by a dynamic simulation model. NDA integrates organization dimension and task dimension by considering the project governance network and risk factors together, so it can improve the accuracy of risk analysis and the effectiveness of risk control.

The paper reviewed risk management techniques and its challenges during implementation in infrastructure projects with a focus on harbour and seaport construction projects. Literature indicates that beyond year 2020, eighty percent of world trade which is conducted through seaports will require additional facilities. This need could potentially be met through rehabilitation of existing ports and development of new terminals. Globally, there is a high rate of project delays and failure due to unsuccessful risk management and implementation. The research was conducted through a systematic literature review of journal articles on risk management techniques and their implementation limitations. The research found that the most employed risk management techniques were enterprise and construction risk management systems, major infrastructure assessment frameworks, dynamic risk management, analytical hierarchy based techniques and the innovative risk management implementation approach. Impediments in implementation of risk management plans were found to be political influence, technical complications, environmental constraints and lack of adequately skilled personnel. This study could benefit risk managers in developing effective risk management frameworks.

The importance of enterprise innovation risk management is constantly increasing, because it has influence on the company's leading positions, increasing its competitiveness in the domestic and international markets. It also helps to increase the economic and production potentials that are necessary to implement the innovative development strategy of the state as a whole. There are certain problems in the field of innovation management. At present time, there is no unified assessment methodology of risk impact of the enterprise innovation activity. Each enterprise uses independently developed methods for calculating the risk based on the ratio of risk costs to the risk time. It leads to errors in the valuation of identified risks and their negative outcomes and, as a result, in this situation the risk management effectiveness is reduced. The authors of the article propose a classification of the main types of risks in an innovation project. On the basis of the proposed classifications, an innovation risk management model for enterprise has been developed.

Aiming at the existing problems in safety management of port enterprises, a standardized potential accident library and risk database is established by identification of dangerous or harmful factors and quantification of potential accident. Overall architecture of potential accident investigation and safety risk management system is put forward based on mobile intelligent terminal and PC terminal. System functions such as planning, potential hazard inspection, disposal and management, safety monitoring, statistical analysis, forecasting and early warning are designed and developed. Enterprise accident risk early-warning model and method is proposed. The system has been put into use successfully, it helps to enhance the efficiency of safety management effectively, and provides a strong scientific basis for enterprise risk early warning and security status and trend analysis.

Risk Management, according with the ISO Guide 73 is the set of "coordinated activities to direct and control an organization with regard to risk". In a nutshell, Risk Management is the business process used to manage risk in organizations. ISO 31000 defines a framework and process for risk management. However, implementing this standard without a detailed plan can become a burden on organizations. This paper presents a maturity model for the risk management process based on ISO 31000. The purpose of this model is to provide an assessment tool for organizations to use in order to get their current risk management maturity level. The results can then be used to create an improvement plan which will guide organizations to reach their target maturity level. This maturity model allows organizations to assess a risk management process according to the best practices defined in risk management references. The maturity model can also be used as a reference for improving this process since it sets a clear path of how a risk management process should be performed.

Increasing interconnectivity in financial institutions and markets along with complex, interdependent architectures present unique enterprise risks. While technological advances continuously improve the reliability and trustworthiness of individual technological system components, the complex, collaborative architectures relied on by most financial organizations present substantial challenges that span technology, personnel, and process dimensions. As systems and threat environments grow in sophistication, approaches to security testing and evaluation must evolve as well. Traditional approaches to cyber security testing may still be useful to evaluate basic architectural components, however new techniques are needed to enable the enterprise to construct simulation exercises that model real-world threat conditions and test the resiliency of all architectural components, including personnel and process dimensions. Organizations must not only establish capabilities to recognize breach attempts, but take decisive response action under conditions of uncertainty and stress. Techniques to evaluate resilient enterprise architectures sometimes underemphasize the threats surrounding human dimensions. This paper examines emerging risk considerations presented by increased connectivity among financial services enterprises. It explores new requirements for testing and evaluation of enterprise resiliency as well as organizational detection and response capabilities. The paper considers industry and other external environmental factors driving the need to develop comprehensive evaluation approaches to evaluate the effectiveness of enterprise capabilities in order to embed capability effectiveness assessments within enterprise risk management practices. Limitations of current cyber testing approaches in simulating the emerging cyber threat environment are identified, and the value of realistic, time-bound drills and tests that mimic the stress of real-world cyber events are explored.

Object: Research of methods and tools for monitoring the company's risks in order to control and adjust risk management in the current economic conditions. Methods: The paper examines the methodological basis in order to form a procedure for observation and analysis of risks for further application of methods to influence risky events. The possibility and expediency of introducing effective performance indicators of the company's structural divisions in risk management into the monitoring system are also considered. Findings: The authors propose an organizational and methodological framework for monitoring the company's risk management activities, including a documented format for monitoring the development of risk events in the application of methods to influence the factors and consequences of risks, and an algorithm for selecting risk management methods. Conclusions: By using the organizational and methodological scheme for monitoring the risk management system, the company becomes capable of responding in due time to an advent of risk events in order to reduce the negative impact of risks, which, in turn, will enhance the efficiency of risk management in general.

The National Aeronautics and Space Administration (NASA) defines risk management as an integrated framework, combining risk-informed decision making and continuous risk management to foster forward-thinking and decision making from an integrated risk perspective. Therefore, decision makers must have access to risks outside of their own project to gain the knowledge that provides the integrated risk perspective. Through the Goddard Space Flight Center (GSFC) Flight Projects Directorate (FPD) Business Change Initiative (BCI), risks were integrated into one repository to facilitate access to risk data between projects. With the centralized repository, communications between the FPD, project managers, and risk managers improved and GSFC created the cross-cutting risk framework (CCRF) team. The creation of the consolidated risk repository, in parallel with the initiation of monthly FPD risk managers and risk governance board meetings, are now providing a complete risk management picture spanning the entire directorate. This paper will describe the challenges, methodologies, tools, and techniques used to develop the CCRF, and the lessons learned as the team collectively worked to identify risks that FPD programs/projects had in common, both past and present.

There has been a growing need to automatically identify, extract and analyze risk related statements from textual data. In this paper, we have exploited natural language processing research to develop a risk analytics framework that processes human-reported risk statements to analyzes the enterprise risk description texts to classify them into valid and invalid risk categories, and perform analytics to extract information from the text pertaining to the different categories of risks and their possible cause and impacts. A manual annotation study from management experts using risk descriptions collected for a specific organization was conducted to evaluate the framework. The evaluation showed promising results for automated risk analysis and identification.

Outsourcing supply chain activities is not simple. Yet, it allows organizations to strategically use outside vendors to perform activities that traditionally have been internal functions such as information systems, value buying and logistics in order to achieve efficiently, a higher level of product availability. The outsourcing strategy is considered, however, as a major change that may impact heavily the business competitiveness and future. In this context, organizations that are considering strategic outsourcing of supply chain activities must manage and control carefully the related risk factors in order to meet the sourcing objectives. This paper introduces a framework inspired from the Enterprise Risk Management (ERM) approach and aims to identify and classify outsourcing related organizational risks. This framework was operationalized for the case of the pharmaceutical supply chain in the public sector in Morocco.

Information Technology (IT) has become an integral part of conducting business within organizations including local government. Local government depends heavily on the use of IT to achieve its goals and objectives. The use of IT poses a number of risks within local government. Thus it is important for IT to be governed adequately. Core to the governance of IT is the process of risk management. To conduct effective risk management, an adequate risk assessment must be conducted within its given context. The Auditor General identified lack of adequate risk assessments within local government in South Africa. The objective of this paper is to propose an automated scenario-based IT risk assessment process model for local government to improve risk assessment. The research study followed a design-oriented IS research approach to devise and revise the process model.

Traditional business and risk analysis is designed to protect the organization, and thus is self-focused. Ethics is concerned with appropriate behavior towards the ‘other’. Is risk management ethical if it protects itself (the organization) but may leave its customers, neighbors, society and/or our environment in distress? This paper evaluates ethical and risk management papers from business, engineering and IT against a proposed ethical maturity model for the risk management process, defined towards an ideal. It also proposes an enhanced quantitative risk analysis method to implement a higher ethical level, by considering the ‘other.’

The business services of organizations depend widely on information systems. IT risks can harm these systems and thus affect the success of business goals. Therefore, the importance of security technologies in IT systems has received increased attention. These technologies require monetary investment. Risk management is used to justify this investment. Risk management is a strategic activity in the design of an organization: it is a systematic process of identifying, assessing and responding to events that may potentially affect business objectives. The objective of this paper is to address the challenges of protecting the business services of organizations. For this purpose, a concrete application will be detailed using EBIOS.

Building a good financial Model Risk Management(MRM) system requires advanced skills in technology, econometrics and financial businesses. Very often we have businesses that have different models with similar functionality. The question that we are trying to answer in the paper is how to rationalize different models within an Enterprise Risk Management(ERM) of in organization. It is a dilemma that Risk Management Practitioners are struggling with. Very often they are looking for someone who can understand their business ideas and transform them to technology solutions or come up with technology solutions to support their MRM ideas. While quantitative Analysts are very critical in this type of project, very often they fail in the software development skills that are required. We are witnesses these struggles where some model risk leaders fail to find some good technologists or econometricians to implement their risk management philosophy. Also we have cases where technologists or econometricians cannot receive proper requirements to implement the functionality that the business needs. Here we are trying to understand how we can rationalize on different models that have some common functionality. For example how to look at or consolidate the functionality of the following models, such as Probability of Default (PD), Loss Given Default (LGD), Allowance for Loan and Lease Losses (ALLL), Stress Testing (ST) and others Financial Models. In this paper, we will present a framework for Model Rationalization or how to consolidate models. Also we will present a methodology that can be used to test a model that has been consolidated through our framework, Model Rationalization.

Cloud computing nowadays is adopted by many organizations around the world because of its potential benefits such as cost reduction, high availability and elastic scaling. In spite of all the claimed benefits and to deal with any potential risk and vulnerability of cloud computing, risk management is becoming a critical domain that requires a fundamental review in the business strategies and can be linked to cloud computing, in order to have a successful cloud implementation. Risk management can help in avoiding, transferring, mitigating or minimizing the risks associated with being on the cloud. The main objective of this research is to explore the existing risk management frameworks in order to recommend an appropriate risk management framework for cloud computing environment. Qualitative data were collected and analyzed based on interviews conducted amongst the information technology and risk management professionals in Omani organizations (public and private). The recommended framework can be used in conjunction with other risk management approaches for industries which already moved to cloud or in transition of moving towards cloud environment in Oman.

It has been noticed that one of the main problems with R&D projects is the high amounts of risk. Standard risk management practices have historically proven to be inadequate in R&D project where not all aspects of the project are known. The problem with the risk management process is not the management of the risks but the lack of identification of risks. Standard risk identification techniques such as brainstorming make use of the diversity and experience of large groups of participants but in research and development projects the project teams are generally made up of small teams who are specialised in one field. This lack of diversity and few numbers causes general risk identification techniques to fail in identifying all possible risks. A structured brainstorming risk identification method was developed for use in R&D projects in order to lead the project teams in the identification process to identify more risks and increase the effectiveness of the risk management process.

IT organisations are facing risks that make IT projects not able to meet up planned schedule and quality. Hence, there is the need for risk mitigation in IT organisations to support IT team members to mitigate risk. This paper is a contribution to propose a risk mitigation model to provide expert assistance during IT risk mitigation. By assisting team members and decision makers to identify risks associated with in IT process by providing risk documentation to estimate the probability and impact of IT risks. The risk mitigation model can also introduce risk advice and suggest alternatives to treat the risk by providing support for the reuse of knowledge gained from past IT projects. The risk mitigation model will assist IT organisations in mitigating risk and making right decisions using a risk repository as a medium to provide support for practitioners in the mitigation of mainly operational and technical risk.

The purpose of this study contributes to safe improvement in consideration of security in addition to convenience by the social media utilization in the company. The company uses the marketing using social media, but a lot of risks exist. We contribute to safe improvement by performing an example investigation in this study, and doing risk assessment. In this study, in order to extract a risk event, the RBS method was used. And we divided it into next four risk classifications by risk matrix method, "Risk Mitigation", "Risk Avoidance", "Risk Transference", and "Risk Acceptance". As a result, it became clear that it was necessary for the company to take risk measures mainly on "recognition of cost effectiveness", "the countermeasure against blog flaming", and "information leakage measure of employee". It is necessary for the company to take these risks measures from this result with precedence. Based on this, it is believed that the company can utilize social media effectively if the company follows these measures.

Risk management is very broad and important task in the business management area. Many companies try to apply and integrate the risk management technique and tools as part of the management processes. The goal of this paper is to compare methods for risk modelling and design a methodology for risk evaluation and modelling in electronic manufacturing area. The risk model is a way of basic structure description of the risk. Selection of risk modelling approach is necessary for right identification of risks, their analysis, finding of their sources and their elimination.

Risk assessment has always been the most challenging part of the risk management process for aviation operations. This paper investigates the risks involved in the Tripoli and Mitiga International Airport in Tripoli, Libya. This case study addresses the risks that may occur during aircraft flight operations. It also investigates the human performance during the ground and flight operations. The paper implements some countermeasures in order to avoid and/or eliminate the risks, and to make sure that all risks remain at an acceptable level. The results demonstrated that a 67.9% of the registered risks are operational risks, 10.7% of the recorded risks are personal risks, 3.6% are health and safety risks, another 3.6% are strategic risks, 7.1% are financial risks, and another 7.1% are technical risks. Besides, the most of the countermeasures which suggested as solutions are suitable and beneficial. Moreover, implementation of the safety management system are effectively reduced the cost and improved the efficiency of the business.

Over the last four years, instability and unrest in Libya raised risk analysis topic to a very sensitive grade that it might affect any business. This imposed more attention at identifying and assessing of potential risks in a very early stage of any project, which is highly important for planning the most appropriate strategies to minimize threats and exploit opportunities.

Presently, all organizations are facing by various types of risk. The risk can be occurred anywhere and to anyone. Therefore, they need to manage risk properly to reduce cost and other consequences. Enterprise Risk Management (ERM) was introduced many years ago and currently implemented by many countries as well as organizations due to positive impact especially in their performances. In Malaysia, it was first implemented around ten years ago and the organizations are recommended to use it as a tool or basis to recover any potential risks. There are many factors drive to ERM adoption in organizations that gave big impact on their performances. A part of that, the aim of this paper is to construct a conceptual framework that describes the relationship between factors or drivers to ERM adoption and ERM impact on performance. This relationship will moderate by two other factors which are quality of Board of Directors (BOD) and quality of internal audit. The area of this paper will be focus on Malaysian Public Higher Educational Institution (IPTA) which is only five institutions will be selected as respondents. The selection of these institutions was made based on top five ranking university in Malaysia. The potential respondents among higher and middle level management were identified and they will answer a set of questionnaire and the data will be analyze using Statistical Package for Science Social (SPSS) and Structural Equation Modeling (SEM). The expected finding from this paper is there are positive significant relationship between both independent and dependent variables moderated by both parties which is BOD and internal audit.

Enterprise risk management has never been more important in today's organizations. The rapid changes brought forth by the technological advancements and globalization, and the complexity in managing these changes has made it challenging for an organization to manage its risks effectively. The ISO31000:2009 enterprise risk management (ERM) framework was developed in an attempt to help organizations address this challenge. Unfortunately, the framework is highly abstract and consists of confusing terms and definitions, which make it difficult to be adapted according to an organization's risk management requirements. Using the Six Sigma approach, this paper presents a pragmatic roadmap on the process of adapting the ISO31000:2009 ERM framework in a business unit of a large organization operating globally. In so doing, this study helps to provide invaluable insights and a viable method to adapt the ISO31000:2009 framework into a number of effective risk management practices in an organization.

There are large, medium, and small enterprises which develop software projects that can be influenced by a risk. Identifying risk is first step of perfectly assessing and controlling risks in a project. In the literature, a lot of researchers identified risk factors in software projects but none of these can be generalized as base of risk factors in the software projects as they differ in time, culture, and being studied in different application areas while using different research methodologies. Majority of the researchers focused on general software projects while few of them focused on specific application areas like virtual projects or e-commerce projects but no research focused identifying risk factors of software projects in terms of the firm size. In this paper, we are studying risk factors that Small and Medium Enterprise (SME) in Malaysia perceive as risk in their software development projects. 202 respondents from 25 enterprises located in three states in Malaysia was surveyed and analyzed. Finally, the top risk factors for each risk dimension were presented along their relationship with project risks.

Today, to deal with the rapidly evolving needs of the market and its increased competitiveness, more and more companies operating in the field of construction use the risk management approach to improve their project's control. This approach is generally based on a continuous and iterative process that aims to identify and analyze risks, to assess and prioritize them, in order to monitor and control them. In this context, the identification phase is considered the most critical because it does condemn the rest of the risk management process. In this paper, we propose a study that will customize some existing methods of risk identification in order to detect the risks related to a construction Project. Then, we will study the dependencies between risks in order to define the impact of the occurrence of a risk on other risks characteristics.

The occurrence of risks in an enterprise can result in differences between business goals and their realization. Risk management is a central activity in the design of an enterprise: risk assessments supports the identifications of problems that expose the enterprise to risk, while risk treatment plans are drivers for enterprise engineering. Risk treatment plans are typically created in isolation, and often informal. We deal with this problem by developing a collaborative risk management framework, that involves all levels of an organization in conducting risk assessments and formalizing the treatment plans. We propose procedures to perform an integrated risk analysis, as well as metrics to deal with the collaborative aspect of risk management.