An Integrated Process‐Related Risk Management Approach to Proactive Threat and Opportunity Handling: A Framework and Rule Language

• Published date: 01 January 2017
• Date: 01 January 2017
• DOI: http://doi.org/10.1002/kpm.1527

■Research Article

An Integrated Process-Related Risk

Management Approach to Proactive

Threat and Opportunity Handling: A

Framework and Rule Language

Jinwoo Kim, Jinyoun Lee, Jooseok Lee and Injun Choi*

Department of Industrial and Management Engineering, Pohang University of Science and Technology

(POSTECH), Pohang, South Korea

Managing risk in business processes has been a subject of active research in the past few years. The current uncertain

global business environment especially requires organizations to adopt more effective risk management approaches

that properly cope with both negative and positive impacts from risk in business process execution. This study intro-

duces a process-related risk management approach that can support comprehensive and proactive risk management

during the runtime stage of business processes. First, it analyzes the behavioral requirements for proactivemanagement

of process-related risk. Second, it suggests a framework that enables timely risk monitoring and treatment. Third, it of-

fers a rule language as an implementation model for systematic support of the proposed risk management approach.

Finally, it presents an architecture and prototype system to demonstrate the feasibility of the proposed framework

and rule language. This approach overcomes the limitations of existing risk management approaches by identifying

all necessary activities, as well as when and where they must be applied. Copyright © 2016 John Wiley & Sons, Ltd.

INTRODUCTION

The current uncertain global business environment

requires firms to adopt more effective risk manage-

ment approaches. Unfortunately, traditional busi-

ness process management (BPM) systems do not

properly address the risk in daily operations that

may have a profound impact on organizational

objectives (Suriadi et al., 2014). Therefore, managing

risk in business processes has been a subject of ac-

tive research in the past few years (Conforti et al.,

2015; Haggag et al., 2015; Tjoa et al., 2011).

The various studies into process-related risks re-

fer to the existing guides or standards of risk man-

agement, such as the PMBOK, ISO 31000, and

INCOSE handbook (International Council on Sys-

tems Engineering (INCOSE), 2007; International Or-

ganization for Standardization (ISO), 2009; Project

Management Institute (PMI), 2013). Traditionally,

researches in the field of risk management usually

focus on avoiding the negative impacts of risks

rather than exploring their positive impacts

(Lessard and Lucea, 2009). However, recent risk

management standards and guidelines have sought

to extend the scope of risk management approaches

to handle the positive impacts of risks. For example,

the PMBOK includes a risk management approach

to prevent negative risks and to exploit positive out-

comes potentially hidden within a situation (Project

Management Institute (PMI), 2013). In BPM re-

search, however, most studies of process-related

risks concentrate on reducing the negative impacts

of risks, rather than as a lucid means to handle op-

portunities. Therefore, an advanced risk manage-

ment approach is required that can support

handling of both negative and positive impacts

generated by risk in business process execution.

Furthermore, risk management research in the

BPM context has additional shortcomings, such as

few studies addressing risk issues during the

runtime stage of business processes (Suriadi et al.,

2014). Notably, the existing risk management

approaches cannot properly support prediction,

prevention, and mitigation of risks (Conforti et al.,

2011). To solve this problem, a more effective risk

*Correspondence to: Injun Choi, Department of Industrial and

Management Engineering, Pohang University of Science and

Technology (POSTECH), Nam-gu, Pohang 790-784, South Korea.

E-mail: injun@postech.ac.kr

Knowledge and Process Management

Volume 24 Number 1 pp 23–37 (2017)

Published online 19 December 2016 in Wiley Online Library

(www.wileyonlinelibrary.com) DOI: 10.1002/kpm.1527

Copyright © 2016 John Wiley & Sons, Ltd.