Framework for a risk assessment model to apply in virtual/collaborative enterprises

ScienceDirect Available online at www.sciencedirect.com Procedia Computer Science 181 (2021) 612–618 1877-0509 © 2021 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 10.1016/j.procs.2021.01.208 10.1016/j.procs.2021.01.208 1877-0509 © 2021 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 Available online at www.sciencedirect.com ScienceDirect Procedia Computer Science 00 (2019) 000–000 www.elsevier.com/locate/procedia 1877-0509 © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 Framework for a risk assessment model to apply in Virtual / Collaborative Enterprises Paulo Ávilaa,b,*, Alzira Motaa, João Bastosa, Leonel Patrícioa, António Piresa,b, Hélio Castroa, Maria Manuela Cruz-Cunhac, Leonilde Varelad aSchool of Engineering and CIDEM Research Center, Polytechnic of Porto, Portugal bCIDEM Research Center c2Ai - Applied Artificial Intelligence Laboratory, Polytechnic Institute of Cávado and Ave, Portugal dSchool of Engineering, University of Minho, Portugal Abstract Risk assessment is a theme of large spectrum applied in different fields. In the context of Virtual / Collaborative Enterprises there are several risks whose assessment should be aware to avoid undesirable consequences either for entire networked or for a partner in particular. The objective of this work is centered on the creation of a framework / guidelines to serve as a basis for the creation of a better risk assessment model for Virtual / Collaborative Enterprises. This work analyzed the few models available in the literature and identified some gaps that were used to purpose complementary guidelines for the design and / or improve the future risk assessment models. The pointed guidelines covered three important topics: risk factors; assessment methods; and the impact in different life cycle phases of a Virtual / Collaborative Enterprise. Considering the results of the work it is our conviction that there is space to improve the research in this field and a more robust and flexible risk assessment model should be developed. © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 * Corresponding author. Tel.: +351 228340500; fax: +351 228321159. E-mail address: [email protected] Available online at www.sciencedirect.com ScienceDirect Procedia Computer Science 00 (2019) 000–000 www.elsevier.com/locate/procedia 1877-0509 © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 Framework for a risk assessment model to apply in Virtual / Collaborative Enterprises Paulo Ávilaa,b,*, Alzira Motaa, João Bastosa, Leonel Patrícioa, António Piresa,b, Hélio Castroa, Maria Manuela Cruz-Cunhac, Leonilde Varelad aSchool of Engineering and CIDEM Research Center, Polytechnic of Porto, Portugal bCIDEM Research Center c2Ai - Applied Artificial Intelligence Laboratory, Polytechnic Institute of Cávado and Ave, Portugal dSchool of Engineering, University of Minho, Portugal Abstract Risk assessment is a theme of large spectrum applied in different fields. In the context of Virtual / Collaborative Enterprises there are several risks whose assessment should be aware to avoid undesirable consequences either for entire networked or for a partner in particular. The objective of this work is centered on the creation of a framework / guidelines to serve as a basis for the creation of a better risk assessment model for Virtual / Collaborative Enterprises. This work analyzed the few models available in the literature and identified some gaps that were used to purpose complementary guidelines for the design and / or improve the future risk assessment models. The pointed guidelines covered three important topics: risk factors; assessment methods; and the impact in different life cycle phases of a Virtual / Collaborative Enterprise. Considering the results of the work it is our conviction that there is space to improve the research in this field and a more robust and flexible risk assessment model should be developed. © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 * Corresponding author. Tel.: +351 228340500; fax: +351 228321159. E-mail address: [email protected] 2 Author name / Procedia Computer Science 00 (2019) 000–000 Keywords: Virtual / Collaborative Enterprises; Risk factors; Risk assessment model; Risk assessment Framework. 1. Introduction Risk is inherent to human being since the beginning of the humankind and his confrontation with Risk is permanent in all situations and at all moments. According to ISO 31000: 2018 [1], risk is defined as the effect of uncertainty on objectives, the consequences of which can be positive or negative. Of course, the negative consequences are the most worrying in the context of companies and specifically of virtual / collaborative (VE) enterprises. According to Link [2], when a network is chosen to run a business the consequent risk is higher than the risk related to the same business run by a single company. It is obvious from the findings of researchers that, although, return of investment, opportunities and risk sharing abilities are higher in VEs, they still operate in higher risky environments than single enterprises and therefore care must be taken in the formation (including partner selection) of VEs as it plays an important role in their success [3]. To be successful, an organization must commit to addressing risk management in a proactive and consistent manner [4]. In this way the risk management increases the likelihood of success and reduces both, the likelihood of failure and the uncertainty of achieving all the organization's global objectives. Managing risk is part of governance and leadership, and is fundamental to how the organization is managed at all levels. It contributes to the improvement of management systems [1]. In view of the above, organizations should provide for the creation of models for the management of their risk considering the main activities associated with this process, which are explained in Figure 1. It should be noted those to which the risk assessment refers, because they are framed with the theme of this work. As shown in Figure 1, risk assessment comprises three activities, namely, the identification of risk identification, the risk analysis, and the risk Evaluation. These three activities are duly explained out in ISO 31000: 2018 [1]. Fig. 1. Risk management process [1]. In this work, the main concern is centered on the creation of a framework / guidelines to serve as a basis for the creation of a risk assessment model for VEs. According to the data collected in the following section, they show that Paulo Ávila et al. / Procedia Computer Science 181 (2021) 612–618 613 Available online at www.sciencedirect.com ScienceDirect Procedia Computer Science 00 (2019) 000–000 www.elsevier.com/locate/procedia 1877-0509 © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 Framework for a risk assessment model to apply in Virtual / Collaborative Enterprises Paulo Ávilaa,b,*, Alzira Motaa, João Bastosa, Leonel Patrícioa, António Piresa,b, Hélio Castroa, Maria Manuela Cruz-Cunhac, Leonilde Varelad aSchool of Engineering and CIDEM Research Center, Polytechnic of Porto, Portugal bCIDEM Research Center c2Ai - Applied Artificial Intelligence Laboratory, Polytechnic Institute of Cávado and Ave, Portugal dSchool of Engineering, University of Minho, Portugal Abstract Risk assessment is a theme of large spectrum applied in different fields. In the context of Virtual / Collaborative Enterprises there are several risks whose assessment should be aware to avoid undesirable consequences either for entire networked or for a partner in particular. The objective of this work is centered on the creation of a framework / guidelines to serve as a basis for the creation of a better risk assessment model for Virtual / Collaborative Enterprises. This work analyzed the few models available in the literature and identified some gaps that were used to purpose complementary guidelines for the design and / or improve the future risk assessment models. The pointed guidelines covered three important topics: risk factors; assessment methods; and the impact in different life cycle phases of a Virtual / Collaborative Enterprise. Considering the results of the work it is our conviction that there is space to improve the research in this field and a more robust and flexible risk assessment model should be developed. © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 * Corresponding author. Tel.: +351 228340500; fax: +351 228321159. E-mail address: [email protected] Available online at www.sciencedirect.com ScienceDirect Procedia Computer Science 00 (2019) 000–000 www.elsevier.com/locate/procedia 1877-0509 © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 Framework for a risk assessment model to apply in Virtual / Collaborative Enterprises Paulo Ávilaa,b,*, Alzira Motaa, João Bastosa, Leonel Patrícioa, António Piresa,b, Hélio Castroa, Maria Manuela Cruz-Cunhac, Leonilde Varelad aSchool of Engineering and CIDEM Research Center, Polytechnic of Porto, Portugal bCIDEM Research Center c2Ai - Applied Artificial Intelligence Laboratory, Polytechnic Institute of Cávado and Ave, Portugal dSchool of Engineering, University of Minho, Portugal Abstract Risk assessment is a theme of large spectrum applied in different fields. In the context of Virtual / Collaborative Enterprises there are several risks whose assessment should be aware to avoid undesirable consequences either for entire networked or for a partner in particular. The objective of this work is centered on the creation of a framework / guidelines to serve as a basis for the creation of a better risk assessment model for Virtual / Collaborative Enterprises. This work analyzed the few models available in the literature and identified some gaps that were used to purpose complementary guidelines for the design and / or improve the future risk assessment models. The pointed guidelines covered three important topics: risk factors; assessment methods; and the impact in different life cycle phases of a Virtual / Collaborative Enterprise. Considering the results of the work it is our conviction that there is space to improve the research in this field and a more robust and flexible risk assessment model should be developed. © 2020 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (https://creativecommons.org/licenses/by-nc-nd/4.0) Peer-review under responsibility of the scientific committee of the CENTERIS - International Conference on ENTERprise Information Systems / ProjMAN - International Conference on Project MANagement / HCist - International Conference on Health and Social Care Information Systems and Technologies 2020 * Corresponding author. Tel.: +351 228340500; fax: +351 228321159. E-mail address: [email protected] 2 Author name / Procedia Computer Science 00 (2019) 000–000 Keywords: Virtual / Collaborative Enterprises; Risk factors; Risk assessment model; Risk assessment Framework. 1. Introduction Risk is inherent to human being since the beginning of the humankind and his confrontation with Risk is permanent in all situations and at all moments. According to ISO 31000: 2018 [1], risk is defined as the effect of uncertainty on objectives, the consequences of which can be positive or negative. Of course, the negative consequences are the most worrying in the context of companies and specifically of virtual / collaborative (VE) enterprises. According to Link [2], when a network is chosen to run a business the consequent risk is higher than the risk related to the same business run by a single company. It is obvious from the findings of researchers that, although, return of investment, opportunities and risk sharing abilities are higher in VEs, they still operate in higher risky environments than single enterprises and therefore care must be taken in the formation (including partner selection) of VEs as it plays an important role in their success [3]. To be successful, an organization must commit to addressing risk management in a proactive and consistent manner [4]. In this way the risk management increases the likelihood of success and reduces both, the likelihood of failure and the uncertainty of achieving all the organization's global objectives. Managing risk is part of governance and leadership, and is fundamental to how the organization is managed at all levels. It contributes to the improvement of management systems [1]. In view of the above, organizations should provide for the creation of models for the management of their risk considering the main activities associated with this process, which are explained in Figure 1. It should be noted those to which the risk assessment refers, because they are framed with the theme of this work. As shown in Figure 1, risk assessment comprises three activities, namely, the identification of risk identification, the risk analysis, and the risk Evaluation. These three activities are duly explained out in ISO 31000: 2018 [1]. Fig. 1. Risk management process [1]. In this work, the main concern is centered on the creation of a framework / guidelines to serve as a basis for the creation of a risk assessment model for VEs. According to the data collected in the following section, they show that 614 Paulo Ávila et al. / Procedia Computer Science 181 (2021) 612–618 Author name / Procedia Computer Science 00 (2019) 000–000 3 the theme is very little developed and needs further and deeply study, thus justifying the relevance of the work here presented. To better frame this research work, it is also important to briefly introduce the concept of VE. There is no universally accepted definition of the concept of VE, but according to Ávila [5] a VE consists of the creation of a temporary network of several physical organizations with the intention of developing and producing one or more products / services in the desired quantities, responding promptly to a market request or opportunity. A VE should appear as a dynamic structure capable of reacting to a business opportunity, without each intervening company wholly or partially with its resources, losing its own physical and cultural entity, resulting in its deactivation at the end of life of the products. For its design may apply companies that integrate the production process vertically and / or horizontally, getting the coordination of the physical network of companies constituting of the VE being in charge of a company or group of companies. There are other organizational models that, despite having different designations, share in essence the above and can apply the results of our work to their models. For VEs, it is certainly relevant that throughout their life cycle they are able to make decisions that are aware of their risks, and that allow them to develop actions to minimize and control the risks of their various phases in their life cycle, including decision making to advance or not with the VE creation. To achieve the goal of this work, the rest of this paper is organized as follow. Section 2 identifies the main contributions of scientific works in the scope of risk assessment models and points its gaps. Section 3 presents the main guidelines that should be considered in the development of a new model. To finalize, some conclusions and future works are made in Section 4. 2. Literature Review Through the online scientific library “B-on”, from the Portuguese Foundation for the Science and Technologies, with access to most international scientific databases, cross-polls were carried out with Risk assessment and the terms: Virtual enterprise; Agile enterprise, Distributed Enterprise, Virtual Organization, Cloud Manufacturing, and Collaborative network. From the carried-out research, 94 papers were obtained, of which only 5 were framed with the theme. One of the reasons for the small number of framed papers is related with the fact that most of them were related with performance assessment that is not the scope of this work. The reason is that it is possible to get good performances without a low level of risk. So, to assess the performance is not the same as assess the risk. You et al. [6] proposed a multi-index decision-making method based on the fuzzy linguistic assessment information to analyze and assess knowledge sharing risks in VE. The authors considered in their model four main knowledge sharing risks: core competence losing risk, the enterprise culture risk, the knowledge spillover effect risk, and the moral risk. Also, in the field of knowledge risk Zunqi and Hai [8] developed an improved AHP method to deal with the assessment risk. Liu et al. [9] suggested a four-dimensional characteristic risk assessment index system based on risk occurrence probability, jeopardy, uncontrollability and unpredictability; and at the same, the F-CEM was adopted to establish the structural model of brainchild project market risk assessment or evaluation as well as the sequence sorting model of brainchild project market risks based on the voting theory. Kumar and Harding [3] presented a quantitative measure of the Risk in the Formation of a VE, namely during the partner selection process, based on the assessment of the collaborative performance risk and the network risk. Mahmood et al. [9] created a risk assessment methodology to facilitate analysis of the key factors of risks and assessment of the level of risks a VE faces during its complete functioning period. They proposed a semi-quantitative risk assessment method for the estimation and evaluation of risks matrices based on probability and impact. 2.1. Analysis of the risk factors Considering the analysis of the risk factors firstly should be pointed that not all the authors cover the same risk factors in their studies, but many of them are considered as the type of internal risk factors, risks that come from the VE’s activities during its life cycle. In spite of that, for external risks factors, for instance, global economic risk, politic risk, market risk, the models do not consider its risk assessment. For sure that for VE it is hard to manage and control this type of risk factors. 4 Author name / Procedia Computer Science 00 (2019) 000–000 Another important issue related with the risk factors analysis is that when the model is supported by quantitative assessment methods, the number of risk factors considered was less than in the models supported by semiquantitative assessment methods. At last, none of the models covers the risk of agility in the meaning of configurability capacity of the VE, which should be an import factor to not compromise the operation of the VE in case of something happen to one of the partners or when the VE needs a new configuration to increase its performance. Exactly what happens with a football team. 2.2. Analysis of the risk assessment methods Assessment methods are related with the way the risk is measured. A risk measure helps the risk manager to measure and quantify the risk implied by the uncertainty about the future realization of a variable X [10]. The risk assessment methods are categorized in the literature as Mahmood et al. [9]: (1) Quantitative Assessment – the final result is in the form of a numerical value that is related to the reliability theory, such as variance method, value at risk method (with several variants normal Delta method, historical simulation method, and Monte Carlo method), Delphi method, Bayesian method, belief functions method; (2) Qualitative Assessment – the final result is based on attributes such as high, medium, and low., such as the techniques Strength, Weaknesses, Opportunities, and Threats (SWOT) analysis and Political, Economic, Sociological, Technological, Legal and Environmental (PESTLE); (3) Semi-quantitative Assessment is based on quantitative and qualitative risk matrices such as the probability and impact matrices. Analyzed probabilities and their consequences do not require accurate mathematical data. Considering the 5 papers reviewed, the paper of Liu et al. [8] adopted a quantitative method and the papers of You et al. [6], Zunqi and Hai [8] and Mahmood et al. [9] used Semi – quantitative methods. In the case of Kumar and Harding [3], the model it is prepared to receive the likelihood of risk either by likelihood expression or by the expert judgment. It means that their model ca be used either a Semi-quantitative or a quantitative method, depending of the data source of the likelihood of risk. 2.3. The impact in different life cycle phases of a VE In order to perform how the previous risk management models interact with the different life cycle phases of a VE. Among seven reference VE models exposed by Castro [11] was considered the life cycle of Putnik [12] that considers five main phases according to the Figure 1. Briefly, the extended life cycle starts with the Identification of the Opportunity to create a VE, followed by the selection (by the Client or VE Owner) of a Market of Resources where he can find support to its creation. After the contractualization between the VE Owner and a Market of Resources, the process of designing the VE, and the search and selection of resources providers towards the A/V E integration takes place. During the Operation phase, the VE can suffer reconfiguration, represented by the arrow to the phase of VE Design and integration, or the VE Owner can even decide to contractualise with another market in alternative or complementarily, represented by the arrow from Operation to Contractualization with the Market. And finally, the Dissolution phase (Dissolution is a special case of Reconfiguration) [13]. Detailed explanation of these phases can be seen in the same reference using IDEF0 graphical language. Fig. 2. VE Extended Life Cycle [12]. Paulo Ávila et al. / Procedia Computer Science 181 (2021) 612–618 615 Author name / Procedia Computer Science 00 (2019) 000–000 3 the theme is very little developed and needs further and deeply study, thus justifying the relevance of the work here presented. To better frame this research work, it is also important to briefly introduce the concept of VE. There is no universally accepted definition of the concept of VE, but according to Ávila [5] a VE consists of the creation of a temporary network of several physical organizations with the intention of developing and producing one or more products / services in the desired quantities, responding promptly to a market request or opportunity. A VE should appear as a dynamic structure capable of reacting to a business opportunity, without each intervening company wholly or partially with its resources, losing its own physical and cultural entity, resulting in its deactivation at the end of life of the products. For its design may apply companies that integrate the production process vertically and / or horizontally, getting the coordination of the physical network of companies constituting of the VE being in charge of a company or group of companies. There are other organizational models that, despite having different designations, share in essence the above and can apply the results of our work to their models. For VEs, it is certainly relevant that throughout their life cycle they are able to make decisions that are aware of their risks, and that allow them to develop actions to minimize and control the risks of their various phases in their life cycle, including decision making to advance or not with the VE creation. To achieve the goal of this work, the rest of this paper is organized as follow. Section 2 identifies the main contributions of scientific works in the scope of risk assessment models and points its gaps. Section 3 presents the main guidelines that should be considered in the development of a new model. To finalize, some conclusions and future works are made in Section 4. 2. Literature Review Through the online scientific library “B-on”, from the Portuguese Foundation for the Science and Technologies, with access to most international scientific databases, cross-polls were carried out with Risk assessment and the terms: Virtual enterprise; Agile enterprise, Distributed Enterprise, Virtual Organization, Cloud Manufacturing, and Collaborative network. From the carried-out research, 94 papers were obtained, of which only 5 were framed with the theme. One of the reasons for the small number of framed papers is related with the fact that most of them were related with performance assessment that is not the scope of this work. The reason is that it is possible to get good performances without a low level of risk. So, to assess the performance is not the same as assess the risk. You et al. [6] proposed a multi-index decision-making method based on the fuzzy linguistic assessment information to analyze and assess knowledge sharing risks in VE. The authors considered in their model four main knowledge sharing risks: core competence losing risk, the enterprise culture risk, the knowledge spillover effect risk, and the moral risk. Also, in the field of knowledge risk Zunqi and Hai [8] developed an improved AHP method to deal with the assessment risk. Liu et al. [9] suggested a four-dimensional characteristic risk assessment index system based on risk occurrence probability, jeopardy, uncontrollability and unpredictability; and at the same, the F-CEM was adopted to establish the structural model of brainchild project market risk assessment or evaluation as well as the sequence sorting model of brainchild project market risks based on the voting theory. Kumar and Harding [3] presented a quantitative measure of the Risk in the Formation of a VE, namely during the partner selection process, based on the assessment of the collaborative performance risk and the network risk. Mahmood et al. [9] created a risk assessment methodology to facilitate analysis of the key factors of risks and assessment of the level of risks a VE faces during its complete functioning period. They proposed a semi-quantitative risk assessment method for the estimation and evaluation of risks matrices based on probability and impact. 2.1. Analysis of the risk factors Considering the analysis of the risk factors firstly should be pointed that not all the authors cover the same risk factors in their studies, but many of them are considered as the type of internal risk factors, risks that come from the VE’s activities during its life cycle. In spite of that, for external risks factors, for instance, global economic risk, politic risk, market risk, the models do not consider its risk assessment. For sure that for VE it is hard to manage and control this type of risk factors. 4 Author name / Procedia Computer Science 00 (2019) 000–000 Another important issue related with the risk factors analysis is that when the model is supported by quantitative assessment methods, the number of risk factors considered was less than in the models supported by semiquantitative assessment methods. At last, none of the models covers the risk of agility in the meaning of configurability capacity of the VE, which should be an import factor to not compromise the operation of the VE in case of something happen to one of the partners or when the VE needs a new configuration to increase its performance. Exactly what happens with a football team. 2.2. Analysis of the risk assessment methods Assessment methods are related with the way the risk is measured. A risk measure helps the risk manager to measure and quantify the risk implied by the uncertainty about the future realization of a variable X [10]. The risk assessment methods are categorized in the literature as Mahmood et al. [9]: (1) Quantitative Assessment – the final result is in the form of a numerical value that is related to the reliability theory, such as variance method, value at risk method (with several variants normal Delta method, historical simulation method, and Monte Carlo method), Delphi method, Bayesian method, belief functions method; (2) Qualitative Assessment – the final result is based on attributes such as high, medium, and low., such as the techniques Strength, Weaknesses, Opportunities, and Threats (SWOT) analysis and Political, Economic, Sociological, Technological, Legal and Environmental (PESTLE); (3) Semi-quantitative Assessment is based on quantitative and qualitative risk matrices such as the probability and impact matrices. Analyzed probabilities and their consequences do not require accurate mathematical data. Considering the 5 papers reviewed, the paper of Liu et al. [8] adopted a quantitative method and the papers of You et al. [6], Zunqi and Hai [8] and Mahmood et al. [9] used Semi – quantitative methods. In the case of Kumar and Harding [3], the model it is prepared to receive the likelihood of risk either by likelihood expression or by the expert judgment. It means that their model ca be used either a Semi-quantitative or a quantitative method, depending of the data source of the likelihood of risk. 2.3. The impact in different life cycle phases of a VE In order to perform how the previous risk management models interact with the different life cycle phases of a VE. Among seven reference VE models exposed by Castro [11] was considered the life cycle of Putnik [12] that considers five main phases according to the Figure 1. Briefly, the extended life cycle starts with the Identification of the Opportunity to create a VE, followed by the selection (by the Client or VE Owner) of a Market of Resources where he can find support to its creation. After the contractualization between the VE Owner and a Market of Resources, the process of designing the VE, and the search and selection of resources providers towards the A/V E integration takes place. During the Operation phase, the VE can suffer reconfiguration, represented by the arrow to the phase of VE Design and integration, or the VE Owner can even decide to contractualise with another market in alternative or complementarily, represented by the arrow from Operation to Contractualization with the Market. And finally, the Dissolution phase (Dissolution is a special case of Reconfiguration) [13]. Detailed explanation of these phases can be seen in the same reference using IDEF0 graphical language. Fig. 2. VE Extended Life Cycle [12]. 616 Paulo Ávila et al. / Procedia Computer Science 181 (2021) 612–618 Author name / Procedia Computer Science 00 (2019) 000–000 5 The previous models of risk management were analyzed and identified its impact in the different life cycle phases of a VE and the results are shown in the Table 1. Here the term impact means in what phases the models analyze the problematic of the risk assessment in VE. Table 1. Impact of the risk assessment models in the different life cycle phases of a VE. Life Cycle phases of the VE Topics analyzed Models You et al. [6] Zunqi, and Hai [7] Liu et al. [8] Kumar and Harding [3] Mahmood, et al. [9] Identification of the Opportunity Opportunity Analysis X Market study X X Contractualisation with the Market “none topic” VE Design and Integration Collaborative Development X Knowledge Sharing X X Individual Performance X Study on Partners X Operation Cooperative Development X X Task coordination X Costs control X Service performance X Dissolution Network disintegration X Feedback between partners X As can be seen in Table 1 none of the models cover the phase Contractualisation with the Market, that in fact is an import issue to assure the virtuality of the system, but also and very important, its agility, as will be discussed in the next section. 3. Guidelines to support a risk assessment model to VE Through the analysis made in the previous section and considering our works in the field of VE, hereafter are pointed the main complementary guidelines for an assessment model covering the main aspects of the previous section. 3.1. Risk factors As a first guideline is that the model should have space to integrate external risk factors when predictable and using as much as possible the expert’s knowledge. As was mentioned in the subsection 2.1 the configurability capacity should be an important issue to be considered in a risk assessment model for VE. In fact, for the new assessment models this is a guideline to take into consideration. 6 Author name / Procedia Computer Science 00 (2019) 000–000 To help in the design of the risk assessment for the configurability capacity, two remarks can be expressed. The first one it is related to the fact that the number of partners pre-selected to perform a specific task can be used as a variable to quantify that risk. The second one it is related with the dispersion of the performance values of the preselected partners. The size of that dispersion can also be used to assess the risk of configurability of the VE. 3.2. Assessment methods Semi-quantitative risk assessment does not require the same mathematical skills as quantitative risk assessment, nor does it require the same amount of data, which means it can be applied to risks and strategies where precise data are missing. We consider that semi-quantitative assessment is useful especially as a quantification of risk is difficult and, to a considerable extent, the extreme. At the same time, qualitative interpretation is too subjective. The combination of the two models can be a solution in some cases, combining the specific advantages of each and decreasing their disadvantages [14]. Cumulatively, to enforce our guideline concerning the assessment method, most of them have been implemented in deferent subjects with well-known satisfactory results. Besides that, are easily implemented that could mean costs and time savings. To complement the previous guideline, the ISO 31010:2019 - Risk management — Risk assessment techniques [15], join the most important risk assessment methods, in a total of forty-one, and provides guidance on the selection and application of techniques for assessing risk in a wide range of situations. The collection of methods is organized according to Table 2, an excerpt of the original one, that identifies which each technique is applicable to the different stages of risk assessment; namely risk identification, risk analysis, and risk evaluation. Table 2. Applicability of techniques to the risk assessment process – Excerpt of the original one (ISO 31010:2019). Tools and techniques Risk assessment process Sub-clause Risk Identification Risk analysis Risk evaluation Consequence Likelihood Level of risk Structured or semi-structured interviews SA NA NA NA NA B.1.5 Structured “What if?” (SWIFT) SA SA A A A B.2.6 Surveys SA NA NA NA NA B.1.6 Toxicological risk assessment SA SA SA SA SA B.7.1 Value at risk (VaR) NA A A SA SA B.7.2 A: applicable; SA: strongly applicable; NA: not applicable. 3.3. The impact in different life cycle phases of a VE It is our conviction, that a risk assessment model should have impact in all the phases of a VE, including the phase of Contractualisation with the Market. The operational aspect of the market of resources consists of an Internet-based intermediation service, mediating offer, and demand of resources to dynamically integrate in a VE, assuring low transactions costs and the partners’ knowledge preservation. Brokers act within the market of resources as intermediation agents for agility and virtuality [16] and his performance is an important issue for the Success of the VE [17]. Besides that, and complementary, another important issue is the schedule of risk assessment model during the VE’s lifecycle. In short, which type of risk should be assessment in each phase of the VE. It means that a specific risk associated with the operation phase should be assessed as early as possible during a previous VE lifecycle phase. Of course, that is not always possible, but the risk assessment schedule is important to reduce the unforeseen risks. Paulo Ávila et al. / Procedia Computer Science 181 (2021) 612–618 617 Author name / Procedia Computer Science 00 (2019) 000–000 5 The previous models of risk management were analyzed and identified its impact in the different life cycle phases of a VE and the results are shown in the Table 1. Here the term impact means in what phases the models analyze the problematic of the risk assessment in VE. Table 1. Impact of the risk assessment models in the different life cycle phases of a VE. Life Cycle phases of the VE Topics analyzed Models You et al. [6] Zunqi, and Hai [7] Liu et al. [8] Kumar and Harding [3] Mahmood, et al. [9] Identification of the Opportunity Opportunity Analysis X Market study X X Contractualisation with the Market “none topic” VE Design and Integration Collaborative Development X Knowledge Sharing X X Individual Performance X Study on Partners X Operation Cooperative Development X X Task coordination X Costs control X Service performance X Dissolution Network disintegration X Feedback between partners X As can be seen in Table 1 none of the models cover the phase Contractualisation with the Market, that in fact is an import issue to assure the virtuality of the system, but also and very important, its agility, as will be discussed in the next section. 3. Guidelines to support a risk assessment model to VE Through the analysis made in the previous section and considering our works in the field of VE, hereafter are pointed the main complementary guidelines for an assessment model covering the main aspects of the previous section. 3.1. Risk factors As a first guideline is that the model should have space to integrate external risk factors when predictable and using as much as possible the expert’s knowledge. As was mentioned in the subsection 2.1 the configurability capacity should be an important issue to be considered in a risk assessment model for VE. In fact, for the new assessment models this is a guideline to take into consideration. 6 Author name / Procedia Computer Science 00 (2019) 000–000 To help in the design of the risk assessment for the configurability capacity, two remarks can be expressed. The first one it is related to the fact that the number of partners pre-selected to perform a specific task can be used as a variable to quantify that risk. The second one it is related with the dispersion of the performance values of the preselected partners. The size of that dispersion can also be used to assess the risk of configurability of the VE. 3.2. Assessment methods Semi-quantitative risk assessment does not require the same mathematical skills as quantitative risk assessment, nor does it require the same amount of data, which means it can be applied to risks and strategies where precise data are missing. We consider that semi-quantitative assessment is useful especially as a quantification of risk is difficult and, to a considerable extent, the extreme. At the same time, qualitative interpretation is too subjective. The combination of the two models can be a solution in some cases, combining the specific advantages of each and decreasing their disadvantages [14]. Cumulatively, to enforce our guideline concerning the assessment method, most of them have been implemented in deferent subjects with well-known satisfactory results. Besides that, are easily implemented that could mean costs and time savings. To complement the previous guideline, the ISO 31010:2019 - Risk management — Risk assessment techniques [15], join the most important risk assessment methods, in a total of forty-one, and provides guidance on the selection and application of techniques for assessing risk in a wide range of situations. The collection of methods is organized according to Table 2, an excerpt of the original one, that identifies which each technique is applicable to the different stages of risk assessment; namely risk identification, risk analysis, and risk evaluation. Table 2. Applicability of techniques to the risk assessment process – Excerpt of the original one (ISO 31010:2019). Tools and techniques Risk assessment process Sub-clause Risk Identification Risk analysis Risk evaluation Consequence Likelihood Level of risk Structured or semi-structured interviews SA NA NA NA NA B.1.5 Structured “What if?” (SWIFT) SA SA A A A B.2.6 Surveys SA NA NA NA NA B.1.6 Toxicological risk assessment SA SA SA SA SA B.7.1 Value at risk (VaR) NA A A SA SA B.7.2 A: applicable; SA: strongly applicable; NA: not applicable. 3.3. The impact in different life cycle phases of a VE It is our conviction, that a risk assessment model should have impact in all the phases of a VE, including the phase of Contractualisation with the Market. The operational aspect of the market of resources consists of an Internet-based intermediation service, mediating offer, and demand of resources to dynamically integrate in a VE, assuring low transactions costs and the partners’ knowledge preservation. Brokers act within the market of resources as intermediation agents for agility and virtuality [16] and his performance is an important issue for the Success of the VE [17]. Besides that, and complementary, another important issue is the schedule of risk assessment model during the VE’s lifecycle. In short, which type of risk should be assessment in each phase of the VE. It means that a specific risk associated with the operation phase should be assessed as early as possible during a previous VE lifecycle phase. Of course, that is not always possible, but the risk assessment schedule is important to reduce the unforeseen risks. 618 Paulo Ávila et al. / Procedia Computer Science 181 (2021) 612–618 Author name / Procedia Computer Science 00 (2019) 000–000 7 4. Conclusion The risk assessment model for VE is an important thematic for the sustainability of the VEs, because of the magnitude of the value resulted from the risk assessment may compromise the VE design and / or its operation. This work analyzed the few models available in the literature and identified some gaps that were used to propose complementary guidelines for the design of future risk assessment models. The pointed guidelines covered three important topics: risk factors; assessment methods; and the impact in different life cycle phases of a VE. Considering the results of the work the authors are convicted that there is room to improve the research in this field and a more robust and flexible risk assessment model should be developed. References [1] International Organization for Standardization (2018) “ISO 31000:2018 - Risk management — Guidelines”. [2] Link, P. (2001) “Risikomanagement von Innovationskooperationen”. Doctoral Thesis, Nr. 14240, ETH Zurich, Zurich. [3] Kumar S.K., Harding J. (2011) “Risk Assessment in the Formation of Virtual Enterprises”. In: Camarinha-Matos L.M., Pereira-Klen A., Afsarmanesh H. (eds) Adaptation and Value Creating Collaborative Networks. PRO-VE 2011. IFIP, Advances in Information and Communication Technology, vol 362. Springer, doi: 10.1007/978-3-642-23330-2_49. [4] Project Management Institute, Inc. (2013). “A Guide to the Project Management Body of Knowledge (PMBOK Guide 5)”. USA. [5] Ávila, P. (2004). “Modelo Rigoroso de Seleção de Sistemas de Recursos para o projeto de empresas Ágeis/Virtuais para produtos complexos”. Doctoral Thesis. Braga: Universidade do Minho. [6] You, Tian-hui et al., (2006) “Analysis and Assessment of Knowledge Sharing Risk in the Virtual Enterprise”, Proceedings of the 9th Joint International Conference on Information Sciences, Atlantis Press. doi:10.2991/jnmp.2006.13.4.1. [7] Zunqi, Yang and Hai, Lin (2008) “Assessment of knowledge shared risk in virtual enterprise based on modified analytic hierarchy process”, Proceedings of the 2008 IEEE International Conference on Information and Automation, pp. 1056-1060, doi: 10.1109/ICINFA.2008.4608155 [8] Liu, S. Liu, M., Su, Q. (2009) “Research on Risk Management Model for Cooperative Development Process in Virtual Enterprises”, 2009 International Conference on Information Management, Innovation Management and Industrial Engineering, pp. 96-101, doi: 10.1109/ICIII.2009.333. [9] Mahmood, K., Shevtshenko, E., Karaulova, T., Otto, T. (2018) “Risk assessment approach for a virtual enterprise of small and medium sized enterprises”, Proceedings of the Estonian Academy of Sciences, vol 67, 17–27, doi: 10.3176/proc.2017.4.27. [10] Biagini, F. Meyer-Brandis, T., Svindland (2014) “The mathematical concept of measuring risk”, Klüppelberg, C., Straub, D., and Welpe, I. M. (eds). Risk – A Multidisciplinary Introduction. Springer. [11] Castro, António (2015) “Plataforma para suporte ao ciclo de vida de organizações virtuais e seleção dinâmica de parceiros e fornecedores”. PhD Thesis. University of Minho. [12] Putnik, G. D. (2000) “BM_Virtual Enterprise Architecture Reference Model”. Gunasekaran A. (Ed.), Agile Manufacturing: 21st Century Manufacturing Strategy, Elsevier Science Publishers. [13] Cunha M., Putnik G., Ávila P. (2004) “Virtual Enterprises’ Extended Lifecycle, Management”, Faculty of Organizational Sciences – Belgrade, Vol 9, No. 34, p. 4-13. [14] Radu, L. (2009) “Qualitative, Semi-Quantitative And, Quantitative Methods For Risk Assessment: Case Of The Financial Audit”, Analele Stiintifice ale Universitatii Alexandru Ioan Cuza din Iasi - Stiinte Economice, Alexandru Ioan Cuza University, Faculty of Economics and Business Administration, vol 56, pp 643-657. [15] International Organization for Standardization (2019) “ISO 31010:2019 - Risk management — Risk assessment techniques”. [16] Cunha M. M., Putnik G. D., Ávila P. (2008) “Market of Resources for Virtual Enterprise Integration”, in Putnik G. D., Cunha M. M. (Eds) Encyclopedia of Networked and Virtual Organizations, Idea Group Reference, Idea Group Inc., pp. 886-893. [17] Ávila P., Putnik G., Cunha M. (2005) “Broker Performance for Agile/Virtual Enterprise Integration”, in Putnik, G. & Cunha, M.. (Eds.) Virtual Enterprise Integration: Technological and organizational Perspectives, IDEA Group Inc, USA, p. 166-185.