The overall aim of this article is to contribute to the further development of the area of risk analysis and risk management in the International Organization for for Standardization (ISO) standards by strengthening its scientific basis. Industrial standards, especially ISO standards, are the tools organizations use to manage their risk, through following their guidance and complying with their requirements. Organizations confirm their compliance with these standards through certification, which means that they heavily depend upon the quality of the ISO standards to enable them to effectively manage their risk. The purpose of this study is to investigate what guidance is given on key elements of risk management and how well ISO standards are aligned with state-of-the-art risk management literature. Eighteen ISO standards, all addressing risk management, were reviewed in this study with regard to risk terminology and guidance. The results of the study confirm the increasing importance of risk management for business. However, the study also shows a lack of guidance on doing risk analysis in the industrial standards examined. The ISO management system standards and guidelines are not aligned with the scientific literature on risk and are not appropriate for the management of risk arising from complex interactions and emergent behavior that is inherent in present-day sociotechnical systems.

The hazard analysis method "Systems Theoretic Process Analysis" (STPA) makes use of a functional system representation in the form of a Hierarchical Control Structure and uses this model as the starting point for the analysis process. The development of the Hierarchical Control Structure typically involves multiple iterations and starts at a rather abstract view, which is refined during the modelling process. Usually, no differentiation is made between the Hierarchical Control Structure model and its representation as a diagram. In addition, the representation is typically restricted to a single diagram. This paper addresses the opportunities of explicitly differentiating between model and views and introduces a concept encouraging use of multiple diagrams representing one model. This paper also discusses the rulesets and consistency considerations necessary to ensure the analysis is complete and the Hierarchical Control Structure representations are consistent with the model and with each other.

In this rapidly changing and fast-growing world, sustainability is an important paradigm. However, the constantly growing level of uncertainty leads to increased strain in decision making. This results in a growing need for a more effective and extensive approach for identifying project risk in particular events that are not easily detected but can have a severe impact, sometimes referred to as Black Swans or “fat tail” events. The VUCA meter is a normative approach to identify project risk by assessing in a structured way events that may be volatile, uncertain, complex, and ambiguous and might contribute to the project risk. In this study, the VUCA meter is benchmarked against a traditional risk identification process as recommended by PMI®. Firstly, two workshops, each referring to the respective risk identification method, were conducted. Secondly, a Delphi survey was run to investigate if the VUCA meter would capture Black Swan risk events that are bypassed by the traditional risk identification approach. The results clearly indicate that the VUCA meter can be developed to be a significant addition to the conventional risk identification process for large projects that are at an early stage. The VUCA meter facilitates a discussion that gets people to think beyond the traditional framework for identifying project risk factors. As a consequence, “fat tail” events, that are not apprehended with the conventional technique, are captured by the VUCA meter.

The overall aim of this article is to contribute to the further development of the area of benchmarking in risk management. The article introduces a two-step benchmarking model to assess the efficacy of ISO risk management systems. It furthermore aims at verifying its usefulness in terms of finding hidden risk issues and improvement opportunities. The existence of all key elements of an ISO 31000-based risk management system is examined at the beginning of this study. Then, the quality in terms of efficacy of important aspects of the risk management system is examined in more detail with special benchmarks. The application of the model to six ISO-certified organizations follows and reinforces the novelty of this study, which is to combine risk science knowledge with benchmarking theory in the application of ISO risk management standards in organizations. The results show that the benchmarking model developed in this study provides rigor when assessing and evaluating the efficacy of an ISO risk management system. By applying the model, risk issues and risk factors can be found that had not previously been identified. The findings are of importance for risk management, the benchmarking science, and for the development of ISO risk management standards.

No abstract