The paper suggests a methodology of risk assessment based on the recommendations and requirements of ISO/IEC 31010 standard regarding the outer and inner parameters of a specific organisation. A System for Prevention and Management of Process-Related Risks (SPMR) is suggested. It helps to forecast and monitor the risks effectively. The system is based on the BI system workflow, which allows the Managers of the organisation to receive graphic information.
Heads of various organisations always face a range of risks and pay a lot of attention to
risk management in decision-making process. The problem of risk management is
therefore of great importance for IT developers. The need for information that would
allow for timely risk management has led to the development of a new sphere - risk
management. Experts working worldwide in various spheres of human activity
managed to develop an internationally recognised risk management standard [
The need to produce quality goods that would meet consumers’ requirements resulted
in the introduction of quality management systems (QMS) in organisations. The design
and introduction of such systems, in turn, led to the development of quality standards.
International standards for quality management systems were elaborated over time to
meet the requirements of people. It therefore became necessary to assess and manage
risks [
A specific feature of ISO/IEC 31010 is that it takes into account various criteria
applicable to risk management. On the one hand, the standard recommends using clear and
consistent risk assessment techniques. On the other hand, it also suggests the most
effective risk assessment methods for enterprises. The standard provides a unified
description of such methods, their specifics, strengths, and limitations. ISO/IEC 31010
also lists the requirements to the risk assessment methods that must be met when
designing a risk management system (RMS). According to the standard, RMSs must
regard the following parameters: 1) applicability of the methods at various stages of risk
assessment and 2) factors influencing the choice of the assessment methods.
The applicability of risk assessment methods (Table A) [
Taking into account the factors determining the selection of risk assessment techniques
(Table B) [
Another issue that should be regarded when selecting risk assessment methods is the fact that ISO/IEC 31010 also focuses on the level of expertise in various spheres. It should be noted that the standard is general in nature - it reflects good practices of selecting risk assessment techniques and provides guidance across various industries and types of organisations.
Corollary. In order to develop a functional RMS, the recommendations of ISO/IEC
31010 [
When designing a RMS, the developers should take into account the recommendations
of ISO/IEC 31010 [
At the second stage, the criteria relevant for certain activities of the organisation are determined. and ranked by the organisation’s experts. The criteria are universal, i.e. applicable to any group of risk assessment techniques.
As a result, we obtain a hierarchy where the top level is the target (selection of the best group of assessment techniques), the second level contains the criteria for the selection of groups of assessment techniques, and the third level contains the groups of assessment techniques. The third stage includes selecting groups of techniques (alternatives) using the analytic hierarchy process (AHP).
The selection of risk assessment techniques is performed by means of VBA - a programming language used in Microsoft Excel. The selection process is demonstrated in Fig. 2. The selection process is demonstrated in Fig. 3.
The fourth stage includes graphic selection of risk assessment methods. The selection
process is based on the relevance of the groups of methods of both sets.
The fifth stage includes the analysis of the selected techniques regarding the
recommendations of ISO/IEC 31010 (Table A, B) [
Corollary. Development of a RMS includes the following. • It is necessary and possible to take into account inner and outer parameters of the organisation when selecting risk assessment methods. • Parameter-based selection process allows the developers to broaden or narrow the search area based on the relevance of the groups of methods.
The process of RMS design involves experts working at the organisation. Risk assessment methods help to identify the risk, its category, level, and type, the probability of risk and its consequences.
The suggested programme for selecting risk assessment methods is a subsystem of the BI system “System for Prevention and Management of Process-Related Risks” (SPMR). 3
The development stage starts with “Risk Identification” [
The initial stage of risk occurrence is represented by the parameter “Source CAUSE”. Its value, as well as the set of such parameters corresponding to a certain parameter “Event SOURCE”, denote the moment when the source occurs. The set of parameters “Event SOURCE” denotes the moment when the parameter “EVENT” occurs. The set of parameters “EVENT” results in the occurrence of risk.
As the occurrence of risk has certain impact on the organisation, the parameter “Source CAUSE” is the key one. It allows to identify the initial stage of risk occurrence and take measures to eliminate the cause of risk. These actions correspond to Risk MITIGATION.
To implement this process within the BI system SPMR, the value of the parameter “Source CAUSE” is determined by experts. This value is shown in the column “Norm” of the Risk Register chart (Fig. 4). The BI system can also generate an .xlsx file, which is completed with the current data and the values of the parameter “Source CAUSE” imported in the column “Fact” of the Risk Register (Fig. 4). The dynamic monitoring of risk probability is performed using the Risk Assessment Graph (Fig. 6).
This graph enables the Manager to see risk probabilities at a certain period of time. When the Manager of the organisation makes a decision to take certain measures, the BI system locks the values of the parameters in the column “Source CAUSE” in the RISK REGISTER. These values correlate with the values in columns “Norm” and “Fact” and thus, when the value of the “Fact” exceeds the value of the “Norm” the cells of the column “Source CAUSE” are highlighted.
If all the cells of the column “Source CAUSE” corresponding to the parameter “Event SOURCE” are highlighted, the colour of this cell also changes. The same algorithm is applied to the cells of the RISK REGISTER. If all the cells of the column “Event SOURCE” corresponding to the parameter “EVENT” are highlighted, the colour of this cell also changes.
If all the cells of the column “EVENT” corresponding to the parameter “RISK” are highlighted, the colour of this cell also changes. This denotes the moment of the occurrence of risk at the organisation.
Highlighting of the cells of the RISK REGISTER allows to make a Risk Diagram which reflects the process of risk occurrence in time. An example of such a process is shown in Fig. 7.
In order to prevent and monitor risks, the organisation creates a set of documents, which describe the measures and procedures of elimination of the factors that may cause risks. All the documents are approved by the administration of the organisation and stored in accordance with the rules of the IT service.
The BI system also has a function that allows Managers to take risk prevention measures using the Risk Diagram. When a Manager makes a decision to take certain actions to eliminate a threat of risk based on the Risk Diagram, the employees can open a corresponding document and act accordingly. The subsystem responsible for the process is demonstrated in Fig. 8. Thus, the proposed algorithm allows for real time risk elimination. • The paper suggests a methodology of risk assessment based on the recommendations and requirements of ISO/IEC 31010 standard regarding the outer and inner parameters of a specific organisation. • A System for Prevention and Management of Process-Related Risks (SPMR) is suggested. It helps to forecast and monitor the risks effectively. • The system is based on the BI system workflow, which allows the Managers of the organisation to receive graphic information.