Search

There are a number of standards and frameworks for security risk assessment; however, it appears that their application and adaptation to real organisational practices are rather limited. This paper reports some results from inquiries into risk assessment practices of security professionals in Ireland. The key findings show a lack of consensus on basic terminology when it comes to defining risk and risk assessment. The interviewed security professionals have developed varied approaches in practice and rather refer to their intuition and previous experiences. While the paper focuses on Ireland, the lack of consensus regarding the definition, and use of security terminology and practices, especially in the area of security risk management, is not necessarily limited to Ireland. [ABSTRACT FROM AUTHOR]

Salatiga City Disperinnaker, a government agency focusing on industry and labor, has developed the Salatiga Job Vacancy Information System (SIOLGA) to streamline its operations. As the SIOLGA application has recently completed its development phase, there arises a necessity for robust risk management to anticipate potential threats and vulnerabilities. Employing ISO 31000 standards, the research aims to mitigate risks effectively. The ISO 31000 framework encompasses risk identification, analysis, evaluation, and treatment phases. Through this process, the study identified 18 potential risks within the SIOLGA application, categorized into three levels: high, medium, and low. Specifically, there are 5 high-level risks, 10 medium-level risks, and 3 low-level risks. By implementing rigorous risk management strategies, the expectation is for the SIOLGA application to operate more efficiently and optimally, fulfilling its intended objectives.

The main risks to the sustainability of Mediterranean mussel farming in Greece were assessed using a generic framework derived from the AS/NZS ISO 31000:2009 Risk Management Model. Risk management scenarios were reviewed after they were successfully tested in the field by semi-qualitative/quantitative data generation protocols. A critical synthesis of the results identifies key indicative aspects needed by stakeholders to formulate a valid operational risk management plan for the sector. [ABSTRACT FROM AUTHOR]

This work reflects on the benefits of applying risk-based thinking for improvement in a quality management system. Based on the crucial role of theory and on the belief that conceptual accuracy and clarity are the main key to an effective practice, this work studies and analyzes the state-of-the-art core concepts of improvement and risk management, through international and national standards, including ISO 9000, ISO 31000 and ANSI-PMI Standards, among others. Consequently, reformulations of the main definitions about improvement are proposed, with the contribution of risk-based thinking concepts, in order to provide a wider perspective of the knowledge platform that has been built. The structure of this paper consists of: Summary, Introduction, Framework, Analysis and Discussion, Conclusions and References.

Research Purposes. This study purpose is to carry out an analysis with the application of good risk management that can provide benefits for companies to reduce the risk of fraud in the company. Research Methods. This research is a qualitative research with a case study with a naturalist approach. Research Results and Findings. The results of the research conducted show that companies that implement risk management well will find it easier to identify the types of fraud risk that can occur in the company. By successfully carrying out the risk identification process, it will make it easier for companies to overcome or deal with fraud risks such as a more effective process of allocating resources, determining strategies to achieve effective internal control, so that by having better preparation it is hoped that the risk of fraud can be minimized in such a way in such a way and does not cause any loss to the company.

In the pursuit of strategic and economic goals, risk management has become indispensable for organizations. Information technologies hold a central position in organizational operations, necessitating adaptable information systems that can effectively navigate associated risks. While numerous standards and frameworks are dedicated to Enterprise Risk Management (ERM), Information Technology Risk Management (ITRM) is addressed less frequently. Within this domain, COBIT 5 emerges as a notable guide, offering audit and governance principles tailored to ITRM. Nevertheless, COBIT 5, alongside other benchmarks, is observed to lack comprehensive, structured guidelines that support an integrated approach. This paper introduces a proposed roadmap and its supporting information system, drawing upon the foundations laid by ISO 31000, COSO ERM, and COBIT 5. The roadmap is designed to address the dearth of detailed frameworks in ITRM, presenting a holistic strategy that elucidates and simplifies the sequential steps and expected deliverables. The principal aim is to provide a structured methodology for the implementation of ITRM in organizations. Looking to the future, the potential application of Artificial Intelligence (AI) to further automate and refine this approach represents an intriguing avenue for research and development. The roadmap thus sets the stage for a transformative leap in ITRM, promising enhanced efficacy and strategic alignment. [ABSTRACT FROM AUTHOR]

Mediterranean mussel farming in Greece developed considerably during the last 40 years reaching a gross commodity product up to the limits of the country's production capacity (35–40,000 tonnes/year). Despite the achievements in the sector's growth, little or no effort has been attributed yet to risk assessment and moreover to risk management of the activity. The present effort aims at developing a working framework for the shellfish aquaculture of Greece to be used as a tool by the sector's decision makers to advance strategies for risk elimination or avoidance. The work was based on a generic risk management standard tool, the Joint Australian and New Zealand Risk Management Standard AS/NZS ISO 31000:2009 that has been adapted to the specific national characteristics of all levels of the mussel farming business -activities and the industry function. The framework supported by data sets regarding development, production, profits and losses, retrieved by surveys through distributed questionnaires or interviews during site-visits, as well as by collecting data from national and international authorities. Data input covered technology, farm size, farmer risk-attitude, risk-management strategies, risk-perceptions and socioeconomic profiles. Major risks and risk management options were identified providing aid for remediation risk policies to the stakeholders.

As information technology becomes increasingly integrated into daily business processes within educational institutions in Indonesia, the need to address potential risks associated with this integration has become crucial. This research focuses on analyzing information technology risk management in Indonesian educational institutions using the ISO 31000 framework. The study aims to minimize the occurrence and impact of various information technology risks that can disrupt organizational processes. Through a comprehensive examination encompassing risk assessment, analysis, evaluation, and treatment, this research provides valuable insights into identifying potential risks within educational institutions. Furthermore, the findings serve as a reference for formulating risk management policies, enabling institutions to proactively mitigate the possibility of information technology risks and their future impact. By adopting the ISO 31000 framework, educational institutions can enhance their efficiency, effectiveness, and accessibility while safeguarding against potential disruptions.

In every large, medium and small industrial enterprise, risks must occur in the business process. The study conducted at one of the small medium enterprise (SME) in the Bantul, Yogyakarta. It begins with the fact that obstacles that often occur are delays in delivery, product damage, and also other obstacles. Hence, those are the reasons of this study conducted. Further, the risk management framework has an important role in reducing these problems. The approach used ISO 31000 method and the SCOR Model in making a proposed framework to improve risk management performance. Based on the proposed framework that has been made, the risk identification process in Rajut Bamboo has 32 risks in its business processes. The risk mitigation proposal is carried out on seven risks in the high-risk category. The risk mitigation results are obtained in the risk codes (D3) unfinished product and absence of SOP, (M2) quality control takes a long time, (P5) unplanned overhead costs, and (A1) products in storage are damaged or lost, thus it showed down to medium risk category, then the risk codes (D9) expensive packaging material costs, (D2) order time exceeds the specified time, and (M6) no mitigation planning, thus it showed down to low-risk category.

In the current digital era, telecommunications industry technology is growing rapidly, impacting the demands for innovation in the telecommunications operator business. One of them is the change in the size of the Subscriber Identity Module (SIM) card model, which is getting smaller, and the use of embedded SIM (eSIM) technology on smartphones. This study aims to identify operational risk factors from the change in SIM card technology to eSIM. The research method used is the Systematic Literature Review (SLR) method. This study documents and reviews scientific journal papers from scientific databases published from 2015 to 2022 on risk management in the information technology field, following this research's objectives. The results obtained from this study showed that there were 43 journals studied, of which four had the theme of technology-embedded subscriber identity module (eSIM), and 13 discussed risk operations technology

COVID-19 has created an entirely new unknown environment with new risks. Various restrictive national measures seeking to protect health took precedence over economic measures. Moreover, a large number of businesses are entirely dependent on international trade and exports. The aim of this paper is to map and analyze the development of small and medium enterprises’ exports during the COVID-19 pandemic in the Czech Republic. Moreover, it identifies the most significant export risks and their perception by small and medium enterprises. The chi-square test, Cramer’s coefficient, and exact binomial test were used to verify the statistical dependencies of research questions and hypotheses.Empirically, the statistically significant impact of the COVID-19 pandemic on the decline in small and medium enterprises’ exports was confirmed. In connection with the effectiveness of risk management, it was found that less than 50% of enterprises in the research sample are not ISO 31000-certified. The study concluded that the most significant export risks confirmed by statistical testing were COVID-19 risks and payment morale of foreign trading partners. AcknowledgmentThis study is co-financed by DKRVO 2022/04 Lean a Project Management in manufacturing Industry in the Czech Republic.

In dealing with risks, organizational stakeholders will need risk management to ensure that risks within the organization have been identified and appropriate controls have been implemented in each implementation of the organization's IT infrastructure. Risk management is a process of identification, analysis, assessment, control, and efforts to avoid, minimize, and even eliminate unacceptable risks. Implementation of risk management with ISO 31000 by risk analysis and the areas that will be the focus of risk management. Mikroskil University requires risk management standards to minimize the risk of using the internet and servers in academic activities required by all academic levels at Mikroskil. The stages of the research method that are by chosen method are collecting the risks faced by the organization, determining the risk scale, and using a risk matrix for risk management priority exposure. The results of the risk management analysis are in the form of the basic principles of implementing risk management with the ISO 31000 standard, which is a recommendation to the organization in managing risk by applicable standards. The result of the risk level is two possible risks with a low level, ten with a high level, and 3 with an extreme level.

Mediterranean mussel farming in Greece developed considerably during the last 40 years reaching a gross commodity product up to the limits of the country's production capacity (35-40,000 tonnes/year). Despite the achievements in the sector's growth, little or no effort has been attributed yet to risk assessment and moreover to risk management of the activity. The present effort aims at developing a working framework for the shellfish aquaculture of Greece to be used as a tool by the sector's decision makers to advance strategies for risk elimination or avoidance. The work was based on a generic risk management standard tool, the Joint Australian and New Zealand Risk Management Standard AS/NZS ISO 31000:2009 that has been adapted to the specific national characteristics of all levels of the mussel farming business -activities and the industry function. The framework supported by data sets regarding development, production, profits and losses, retrieved by surveys through distributed questionnaires or interviews during site-visits, as well as by collecting data from national and international authorities. Data input covered technology, farm size, farmer risk-attitude, risk-management strategies, risk-perceptions and socioeconomic profiles. Major risks and risk management options were identified providing aid for remediation risk policies to the stakeholders. [ABSTRACT FROM AUTHOR]

Esta investigación tuvo como objetivo el Análisis de las matrices de riesgo de los procesos contractuales los municipios de 4a y 6ª categoría del Área Metropolitana de Cúcuta. Para este estudio se tomaron como muestra las matrices de riesgo que cumplen con los lineamientos de Colombia Compra Eficiente y que sean de contratos de obra civil publicados en el Secop I durante el periodo comprendido entre el año 2016 y el primer semestre del 2021. En el desarrollo de la investigación se clasificaron los riesgos según su correcta e incorrectamente identificación, encontrando una preocupante situación, pues se deja en evidencia el desconocimiento de los funcionarios y contratistas (empleados y servidores públicos) para la estructuracion de estrategias de proteccion de los recursos publicos. La identificación del incorrecto diligenciamiento de la matriz de riesgos previsibles en los documentos precontractuales analizados, pretende ser la base para que las entidades estatales pongan en practica estrategias para diseñar e implementar herramientas de memoria organizacional, con el proposito de fotalecer la gestion interna del conocimiento y proteger tanto a los funcionario y ordenadores de gasto como el erario publico de las consecuencias de la materializacion de riesgos previsibles.

In every large, medium and small industrial enterprise, risks must occur in the business process. The study conducted at one of the small medium enterprise (SME) in the Bantul, Yogyakarta. It begins with the fact that obstacles that often occur are delays in delivery, product damage, and also other obstacles. Hence, those are the reasons of this study conducted. Further, the risk management framework has an important role in reducing these problems. The approach used ISO 31000 method and the SCOR Model in making a proposed framework to improve risk management performance. Based on the proposed framework that has been made, the risk identification process in Rajut Bamboo has 32 risks in its business processes. The risk mitigation proposal is carried out on seven risks in the high-risk category. The risk mitigation results are obtained in the risk codes (D3) unfinished product and absence of SOP, (M2) quality control takes a long time, (P5) unplanned overhead costs, and (A1) products in storage are damaged or lost, thus it showed down to medium risk category, then the risk codes (D9) expensive packaging material costs, (D2) order time exceeds the specified time, and (M6) no mitigation planning, thus it showed down to low-risk category. [ABSTRACT FROM AUTHOR]

PT. Kereta Api Indonesia (Persero) or PT. KAI is one of the State-Owned Enterprises which is engaged in inland transportation, namely trains. In the process of providing transportation services, PT. KAI requires a continuous supply of fuel oil. In the operation of the fuel supply chain, PT. KAI has potential risks such as losses and several other risks that can harm the company. From these problems, this research tries to conduct a risk analysis by applying the ISO 31000 risk management framework to determine the effectiveness of PT. KAI in managing fuel supply chain risks. The distribution of subsidized fuel has been implemented before 2012 by PT KAI is the loco scheme, where a high level of potential risk is found outside the risk tolerance limit so that PT. KAI responds to this problem with risk transfer. Where is PT. KAI tries to take risks by using third-party services to provide and manage fuel for train operations' consumption needs.

Toko Mega Komputama Salatiga merupakan sebuah usaha yang bergerak di bidang penjualan yang menyediakan berbagai produk IT dan toko tersebut telah mengimplementasikan pengggunaan SI/TI dalam menunjang aktivitas bisnis yang dijalankan. Toko Mega Komputama menggunakan website “megakomputama.com” untuk menunjang penjualan dan pemasaran produk, etalase produk dan berinteraksi dengan pelanggan. Namun, dalam dunia manajemen pasti selalu ada kemungkinan risiko yang dapat terjadi dan dapat mengganggu aktivitas bisnis pengguna sistem tersebut. Oleh karena itu, analisis risiko teknologi informasi pada website toko Mega Komputama sangat diperlukan. Pada penelitian ini menggunakan framework ISO 31000:2018 dengan harapan mampu mengidentifikasi dan meminimalisir risiko yang mungkin terjadi pada website Mega Komputama.

La gestión de riesgos y calidad de software son factores críticos de éxito en la gestión de proyectos de tecnologías de la información. En ese contexto, la investigación se basa en el propósito de contribuir en la gestión del proyecto para lograr el éxito, a través de una gestión de riesgos adecuada basada en un estándar reconocido. El objetivo de la investigación es determinar el grado de relación entre la gestión de riesgo y la calidad de software en proyectos realizados por los profesionales del Colegio de Ingenieros del Perú, Consejo Departamental Lima. El estudio es de diseño no experimental y de tipo correlacional, para ello se realizó una encuesta virtual, en la cual se consideraron aspectos como: aplicación de procesos de gestión de riesgo, planificación financiera, motivación del equipo de trabajo, capacitaciones y atributos de calidad del sistema de los proyectos que realizaron los encuestados. Los resultados indican que la gestión de riesgos tiene una relación significativa en la calidad de software, por lo que realizar una gestión de riesgos adecuada en proyectos asegura lograr los resultados esperados y, en mayor grado, a cumplir con las características de calidad.

The application of risk management aims to minimize the probability and or consequences of unfavorable events as well as increase awareness of risk in strategic and operational decision making in an effort to achieve organizational goals. The Internal Audit Unit (SPI) Politeknik Pelayaran Surabaya is a supervisory unit formed to assist the implementation of Good University Governance by carrying out inspections or audits of all work units in the non-academic field.Risk treatment is required through risk management as the implementation of the management function in risk management at SPI Politeknik Pelayaran Surabaya. The risk management process uses a standard risk management process 31000 which consists of a context setting process, risk identification, risk analysis, risk evaluation, risk management, monitoring and review, and communication and consultation. This study uses a descriptive qualitative method with a case study at Internal Audit Unit (SPI) Politeknik Pelayaran Surabaya which describes and analyzes risk management using interview and documentation techniques in data collection. Data were analyzed using an interactive model, including data collection, data reduction, data presentation, and conclusions or verification. The final result of the risk management analysis of the internal audit unit (SPI) Politeknik Pelayaran Surabaya is a form of handling strategy in the implementation of internal control. [ABSTRACT FROM AUTHOR]

In order to improve and sustain their competitiveness over time, organisations nowadays need to undertake different initiatives to adopt frameworks, models and standards that will allow them to align and improve their business processes. In spite of these efforts, organisations may still encounter governance and management problems. This is where Risk Management (RM) can play a major role, since its purpose is to contribute to the creation and preservation of value in the context of the organisation’s processes. RM is a complex and subjective activity that requires experience and a high level of knowledge about risks, and it is for this reason that standardisation institutions and researchers have made great efforts to define initiatives to overcome these challenges. However, the RM field nevertheless presents a lack of uniformity in its terms and concepts, due to the different contexts and scopes of application, a situation that can generate ambiguities and misunderstandings. To address these issues, this paper aims to present an ontology called SRMO (Software Risk Management Ontology), which seeks to unify the terms and concepts associated with RM and provide an integrated and holistic view of risk. In doing so, the Pipeline framework has been applied in order to assure and verify the quality of the proposed ontology, and it has been implemented in Protégé and validated by means of competency questions. Three application scenarios of this ontology demonstrating their usefulness in the software engineering field are presented in this paper. We believe that this ontology can be useful for organisations that are interested in: (i) establishing an RM strategy from an integrated approach, (ii) defining the elements that help to identify risks and the criteria that support decision-making in risk assessment, and (iii) helping the involved stakeholders during the process of risk management. [ABSTRACT FROM AUTHOR]

SIAK stands for population administration information system. It is a computerized system that was established according to administrative service regulations to organize the population administration system in Indonesia, more precisely in the Western Seram Regency. Given the critical function of this application in aiding in identifying regional demographic statistics, it is vital to examine potential dangers while also identifying mitigation measures that may be performed to avoid them. ISO 31000 was utilized in the study to map potential hazards for subsequent reduction using the House of Risk (HOR) methodology. According to the findings of this research, there is one danger that falls into the high category, namely the unstable network. Additionally, based on the results of risk mitigation identification, two mitigation steps are identified that can mitigate 60% of existing risks, namely the construction particular resistant to natural disasters for critical equipment storage and collaboration with internet providers to ensure stable internet and network connections.

The article deals with a problem of building an anti-trust compliance system in state executive authorities from the point of view of contemporary risk management. The authors expound a well-known instrument based on the bow-tie diagram construction which successfully helps to develop effective measures to prevent violation of anti-trust legislation cases by state executive authorities. They also give some numeric results of statistical modelling of anti-trust legislation violation risks by state executive authorities by means of the Monte-Carlo method.

The overall aim of this article is to contribute to the further development of the area of benchmarking in risk management. The article introduces a two-step benchmarking model to assess the efficacy of ISO risk management systems. It furthermore aims at verifying its usefulness in terms of finding hidden risk issues and improvement opportunities. The existence of all key elements of an ISO 31000-based risk management system is examined at the beginning of this study. Then, the quality in terms of efficacy of important aspects of the risk management system is examined in more detail with special benchmarks. The application of the model to six ISO-certified organizations follows and reinforces the novelty of this study, which is to combine risk science knowledge with benchmarking theory in the application of ISO risk management standards in organizations. The results show that the benchmarking model developed in this study provides rigor when assessing and evaluating the efficacy of an ISO risk management system. By applying the model, risk issues and risk factors can be found that had not previously been identified. The findings are of importance for risk management, the benchmarking science, and for the development of ISO risk management standards. [ABSTRACT FROM AUTHOR]

Toko Surabaya cabang Surakarta merupakan sebuah perusahaan yang bergerak dalam bidang penjualan pakaian, toko tersebut sudah menggunakan penerapan SI/TI dalam menunjang aktivitas bisnis yang dijalankan. Toko tersebut menggunakan aplikasi SmartConsole yang digunakan untuk menunjang penjualan, mendata stok barang, serta mendata pengeluaran sehari-hari yang dibutuhkan. Namun dalam dunia manajemen pasti selalu ada kemungkinan risiko yang mungkin dapat terjadi dan dapat mengganggu aktivitas bisnis dalam penggunaan sistem tersebut. Dengan begitu analisis risiko sangat diperlukan terhadap sumber daya SI/TI yang terdapat pada toko tersebut. Dengan menggunakan ISO 31000 diharapkan dapat meminimalisir risiko yang terdapat pada aplikasi SmartConsole. Hasil dari analisis risiko ini berupa analisis kemungkinan risiko, mengelompokkan kemungkinan – kemungkinan risiko berdasarkan dampak nya sehingga menghasilkan usulan tindakan risiko terhadap kemungkinan risiko yang terdapat pada aplikasi SmartConsole, dengan begitu toko tersebut dapat memperlakukan kemungkinan risiko yang ada sesuai dengan prioritas level risikonya dan dapat mencegah serta meminimalisir sehinga tidak mengganggu aktivitas bisnis di Toko Surabaya cabang Surakarta.

As ETEs desempenham papel crucial na manutenção da saúde da população. Porém, geram quantidade considerável de lodo de esgoto. Os custos relacionados ao manejo do lodo podem representar 50% dos custos operacionais da ETE. Além disso, o lodo pode ser prejudicial à saúde humana e os trabalhadores que atuam no seu manejo estão expostos a diversos riscos ocupacionais. Esta pesquisa tem como objetivo examinar a relação entre o manejo do lodo e os riscos ocupacionais associados, por meio de processos de gestão de riscos, baseados na ISO 31000, em duas ETEs de médio porte do interior paulista que utilizam tecnologias diferentes, lodos ativados convencionais e reatores anaeróbios UASB. Dentre os principais riscos ocupacionais avaliados, foram considerados críticos a exposição a microrganismos patogênicos dispersos no ar e no contato direto acidentale o risco de acionamentos acidentais de equipamentos durante a manutenção. Percebe- se que ainda há muita resistência, tanto dos trabalhadores como dos empregadores, em relação à saúde e segurança do trabalho. Muito se deve a fatores culturais e sociais, e, portanto, sempre haverá a necessidade da atualização dos instrumentos legais e intensificação da fiscalização. Além disso, é necessário promover, de forma frequente, a conscientização dos trabalhadores e, principalmente, dos empregadores, discutindo o papel dos gestores dos serviços de saneamento básico, em especial no tratamento de esgotos, no processo de desenvolvimento de cultura de segurança do trabalho nas empresas.

Aplikasi manajemen resiko serta perkiraan resiko bisa menolong industri menghemat pengeluaran sekaligus melindungi masa. Aktivitas yang dilakukan pada saat manajemen risiko antara lain planning, organize, setting, coordination ataupun controlling/evaluation untuk penanggulangan risiko. Penelitian ini dengan menggunakan aplikasi yang dipakai perusahaan untuk menjalankan operasi perusahaan. Peneliti melakukan kombinasi dari framework yang sudah tersedia sebelumnya agar tercipta metode yang lebih efektif dan efisien dalam manajement resiko yang digunakan oleh perusahaan. Kombinasi itu ialah COBIT 5 buat resiko, PMBOK, ISO 31000 serta NIST SP 800- 30 buat mengatur resiko. Penelitian ini akan menggunakan rekomendasi manajemen risiko dan rekomendasi pengembangan aplikasi keuangan dengan SOA Framework . Hasil penelitian ini yaitu aplikasi finansial industri ABC mempunyai 17 kriteria tingkatan rendah, 12 sedang serta 2 tinggi. Penelitian ini menghasilkan panduan manajemen resiko aplikasi keuangan perusahaan ABC yang bisa digunakan sebagai rekomendasi untuk mengelola Risiko demi kelancaran berjalannya proyek, Pengembangan aplikasi keuangan perusahaan ABC menambahkan 7 use case baru sebagai rekomendasi, yaitu Pencatatan Kebutuhan ATK dan RT, Pengeluaran Pemasaran CRUD, Pencatatan Pendapatan, Pencatatan Kas untuk Kebutuhan SPV, Memasukkan DP Pelanggan, Memasukkan Piutang dan Pelunasan Pelanggan, Pembelian Material Proyek.

Penerapan Manajemen Risiko dalam analisis keputusan dan sistem pengendalian dapat meningkatkan kinerja operasional dan nilai kompetitif dari organisasi. Semakin meningkatnya kompleksitas pekerjaan, kompleksitas risiko, sumber risiko yang saling berkaitan satu sama lain, serta semakin berkembangnya teknik pengidentifikasian risiko dan teknologi informasi melatarbelakangi banyak organisasi untuk menerapkan manajemen risiko. Pada penelitian ini dilakukan analisis dan pengembangan prototipe aplikasi manajemen risiko. Tujuan dari penelitian ini adalah membuat rancangan dan prototipe manajemen risiko yang dapat digunakan sebagai kertas kerja oleh Risk Owner dan Risk Officer dalam melakukan identifikasi, analisis, dan pembuatan rencana penanganan atas potensi risiko yang ada di departemennya. Penelitian dilakukan dalam tujuh tahapan, yaitu studi literatur, telaah dokumen dan proses bisnis saat ini, wawancara dan Focus Group Discussion bersama stakeholder, perancangan kebutuhan sistem manajemen risiko, pengembangan prototipe aplikasi, Focus Group Discussion untuk pengujian hasil pengembangan bersama stakeholder, dan penarikan kesimpulan. Hasil yang diperoleh dari penelitian ini adalah rancangan kebutuhan sistem manajemen risiko berupa atribut, kriteria dampak, kriteria kemungkinan, nilai keefektifan kontrol saat ini, skor efektifitas kontrol saat ini, serta tingkat dan perlakuan risiko, dan dan prototipe aplikasi manajemen risiko telah selesai dibuat dan dievaluasi. Pada penelitian ini juga telah mengidentifikasi lima proses utama sistem manajemen risiko, yaitu penentuan sasaran dan target kerja departemen, identifikasi risiko, analisis risiko, mitigasi risiko, dan monitoring risiko.

Enterprise risk management (ERM) is significant in running a company. ISO 31000 is one of the ERM types that are familiar. However, there are still pros and cons of ISO 31000. Thus, this study aimed to find out the responses of the Indonesian fintech lending companies managements in implementing ISO 31000. Specifically, this study tried to identify the problems in implementing ISO 31000:2018 to be implemented as ERM. Besides, it also discussed the benefits of the ISO 31000:2018 implementation from the companies' management's perspectives. The data were collected through questionnaires and interviews. The questionnaire results were quantified and interpreted in percentage, while the interview results were analyzed qualitatively using the interactive data analysis method. The study results showed that most of the companies' management believed that they had no significant problems implementing ISO 31000:2018. In addition, they felt that implementing ISO 31000:2018 as ERM gave many benefits in running the companies. The study's findings were discussed by connecting them with the current theories and empirical reviews. However, since the study was done qualitatively, a further study that involves quantitative study to measure the effectiveness of ISO 31000 empirically is needed to support the results of this study. [ABSTRACT FROM AUTHOR]

Many higher education institutions in the world have testing laboratories linked, or not, to their teaching and/or research programs. However, only a small proportion of these laboratories have accreditation in accordance with the ISO/IEC 17025 standard. The ISO/IEC 17025 establishes the management and technical requirements necessary for the implementation and maintenance of a quality management system (QMS) in laboratories that perform testing, calibration and/or sampling activities, being used by them to demonstrate their competence in carrying out their activities. One of the requirements of the current version of the standard is the need to carry out risk management (RM), introduced with the demand for risk-based thinking. The objective of this research was to propose a system for the implementation of RM in laboratories, through mapping, identification, classification, critical analysis, and treatment of risks. The research considered the history of actions taken, the risks verified by the laboratory team, the evaluation of their impacts and the probabilities of their occurrence, their classification and the identification of actions necessary to accept, mitigate or eliminate these risks. The system proposed was applied in a testing laboratory at a university in southern Brazil, enabling the maintenance of its accreditation. [ABSTRACT FROM AUTHOR]