LEAD Reference Content:Finance Operating Model - Value - Revision history

Admin at 23:36, 19 January 2017

2017-01-19T23:36:29Z

Admin at 23:34, 19 January 2017

2017-01-19T23:34:46Z

Admin at 15:56, 19 January 2017

2017-01-19T15:56:26Z

Admin at 15:49, 19 January 2017

2017-01-19T15:49:45Z

Admin at 15:44, 19 January 2017

2017-01-19T15:44:47Z

Show changes

Admin: Created page with "Finance Operating Model - Value {{DISPLAYTITLE: Best Practice around Risk Ontology}} == Best Practice of How to Set Up a Risk Ontology == === Abstract === The Risk Ontology p..."

2017-01-19T15:38:51Z

Created page with "Finance Operating Model - Value {{DISPLAYTITLE: Best Practice around Risk Ontology}} == Best Practice of How to Set Up a Risk Ontology == === Abstract === The Risk Ontology p..."

New page

Finance Operating Model - Value

{{DISPLAYTITLE: Best Practice around Risk Ontology}}
== Best Practice of How to Set Up a Risk Ontology ==
=== Abstract ===
The Risk Ontology presented in this publication has taken over a decade to research and develop, with hundreds of ‘man years’ involved to create the product you have in your hands now. This publication elaborates on the journey to research and develop this risk ontology as well as it described in detail of what it is. It explains the need for a risk ontology, helps to remedy the inconsistent use of risk objects, terms and models. It provides researched benchmarked risk terms and definitions, enabling practitioners to map them to their various ways of working and modelling.

Standards bodies like ISO, CEN, OMG, OASIS, and other practitioner organisations have documented vast amounts of business knowledge as frameworks (e.g., TOGAF, ITIL and COBIT), methods and or approaches (e.g. LEAN, Six Sigma, BPR, TQM, BPMN, BPMS, VDML). Each of these standards, frameworks, methods, and approaches have their own vocabulary, and hence definition of terms like activities, events, role, actors, owner, measure or even rule. This semantic heterogeneity might hamper mutual understanding, communication and artefact integration between standards bodies and organisations applying their standards. What is needed is a unified ontology and vocabulary for business that is rigorously built according to academic and industry standards and at the same time sufficiently detailed to be immediately applicable by practitioners in areas such as business modelling.

This paper introduces a Risk Domain Ontology, which from now on will be referred to as the ‘Risk Ontology’, which incorporates various constructs that can be found in risk standards and frameworks. As ontologies, of which a vocabulary is an immature stage, can be constructed rigorously, the artefact presented below is a domain ontology. By providing benchmark terms and definitions and mapping those terms and definitions to the terms in other existing framework’s vocabularies, this risk ontology is expected to help remedy the inconsistent use of terms around risk management, risk modelling, risk engineering, and risk architecture disciplines. As these mappings demonstrate the shared use of terms in the risk ontology and several business standards and reference frameworks, we could argue that the risk ontology documents the dominant business vocabulary, while mitigating semantic heterogeneity, identifying vocabulary overlap (e.g., the same word that is used in both standards) and signalling complementarity (e.g., a concept that is present in one standard and not in another) between business standards.

The risk ontology is being formalised using the Global University Alliance risk research, the LEADing Practice Risk Standards and communicating it in the Object Management Group’s (OMG) Meta-Object Facility (MOF) concept, and structure, of which the core is also available as an ISO standard. MOF provides a framework for defining meta-models for data, modelling and programming languages as well as describing concepts. The several ontology definition formats (e.g. RDF, OWL, Common Logic) have been defined in MOF through the Ontology Definition Meta-model (ODM) . As MOF has also been used to define UML, it allows for the creation of ontology-based domains-specific modelling languages. As MOF also defines the XML Metadata Interchange (XMI) standard recognised by ISO, it allows for a transformation of any instance of MOF to an XML format for online exchange and digital sharing. Like XML, RDF and OWL, which are W3C web standards.

Through the Interface Definition Language (IDL), MOF also integrates with programming languages (e.g., C++, Java), which would allow for ontology-based programming . As many other business modelling specifications (e.g., VDML, BPMN, SBVR ) have been formalised in MOF a formalisation of the risk ontology will facilitate the mapping between them. This will be present in the following way in this publication. Firstly, how the research and findings came about through the Global University Alliance. The research team, the research questions as well as the risk framework, methods, approaches and concepts studies. The publication and papers researched and how folksonomy concepts where used to define risk, identify and describe the most common meta objects used within Risk concepts. This includes what are the most common terms around the risk object classes, stereo types and subtypes. In addition, we will discuss how Semantic concepts where used to capture and define the most common structure and relationships.

Enterprise Modelling, Engineering and Architecture concepts were applied to identify the most common Risk Models. This includes using the LEADing Practice decomposition and composition standard to identify where do the objects and the specific relations appear in various models. This is seen as a huge benefit as the risk concepts can then be applied back to various modelling standards such as process modelling, value modelling, rule modelling as well as enterprise architecture concepts such as business architecture, application architecture and technology architecture. It is also in the risk model that the objects involved with ‘possible risk’ and those with ‘actual risk’ are specified. After that the risk meta models are presented, with clear defined hierarchic relationships that allow of a polymorphic inheritance of properties in the meta models. Followed by the outlining and description of the meta meta model, with all its objects, relations which all the risk ontology aspects conform to. The Risk Ontology lessons learned and its advantages are summarized in the final section. We hope you have as much joy reading it as we have had writing it.

=== The Risk Research & Analysis ===
We are for the most asked why we developed a Risk Ontology and the answer is actually quite basic. We saw the confusion in the market around the subject and especially the need. For example, all the various Risk frameworks, methods, approaches and or concepts have their own vocabulary. Each of these vocabularies have their own definition of terms, like what is Risk, objects related to risk or even how does compliance and rules apply to risk. The lack of standard Risk terms, definitions, and concepts was the starting point of the Global University Alliance (GUA) interest around the topic.

We in the GUA, which is an international consortium of universities, professors, lecturers and researchers whose aim it is to provide a collaborative platform for academic research, analysis and development and to explore leading practices, best practices as well as to develop missing practices, believed that Risk was worthy of further investigation. With currently over 450 universities, lecturers and researchers from across the world the risk analysis was coordinated with a research team, chosen by the GUA Board.

The first analysis and research in 2004, identified that the lack of repeatable standards around risk in the concepts of enterprise modelling, engineering and architecture concepts, results in unnecessary threats, danger, jeopardy, vulnerabilities, endangerment and safety issues. The need to identify relevant aspects, reusable/replicable pattern and develop models that can be used by any organization, both large and small, regardless of its products/services, activities or industry, became apparent.

In September 2004, the research and analysis on how organizations apply risk within various enterprise modelling, engineering and architecture concepts was initiated. Throughout this process of analyzing and identifying the de-facto way of modelling, engineering and architecting risk in various concepts was the basis of specifying which objects are involved with risk.

The underlying research questions where among others:
*What is risk?
*How is risk being modelled, engineered and architected?
*What are the most common risk meta objects?
*What are the most common risk object classes?
*What are the most common risk object stereo types?
*What are the most common risk object subtypes?
*What are the most common Risk terms used?
*Which semantic relationships do the objects have between each other?
*Which is the most common Risk Models?
*Where do the objects and the specific relations appear in various models?
*Which objects are involved in the ‘possible risk’ modelling, engineering and architecture?
*Which objects are involved in the ‘actual risk’ modelling, engineering and architecture?

The Global University Alliance used the concept of ontology as both a shared vocabulary and the very definition of its objects and concepts. In order to go the next steps and fully use the potential of developing the risk ontology. The Risk Ontology, includes all the above mentioned research findings and developed based on them the following:
*Define a Risk Object overview.
*Develop a Risk categorization and classification.
*Specify a Risk Taxonomy.
*Describe a Risk Model with specific representation of the real world objects.
*Develop a Risk Meta Model describing the objects within the Models.
*Create a Risk Meta-Metamodel that defines and describes the various Risk Metamodel and their relations.

The main body of research and analysis was structured in the following ways:
*Research and analyse what works around risk modelling, engineering and architecture, again and again (best practice), and what are unique practices applied by leading organizations (leading practices).
*Identify common and repeatable patterns which provide the basis for the Risk Ontology.
*Develop “Reference Content” in terms of risk objects, risk semantic relations, risk taxonomy, risk models, risk meta models, etc. that increase the level of re-usability and replication within the field of risk modelling, risk engineering and risk architecture.
*Extended with accelerators that adopt and reproduce the identified risk best practices and leading practices.

=== Frameworks and concepts studied ===
Surrounded by multiple different risk frameworks, methods, approaches, concepts and even more publications on the subject, did we do an intensive research on the existing body of knowledge. Among the many relevant, here are the 27 frameworks/concepts we used the most, followed by the 114 publications we quoted or used most from. The list does not reflect importance of subject or that other framework or publications are not relevant, they were chosen as these having the information we used (in addition to the market research).

Simply stating that due to space limit we could not list the hundreds of frameworks, methods, approaches, concepts and publications on the subject. We therefore only mention the most used frameworks/concepts and publications, and believe they cover the subject discussed from various angles:

{| class="wikitable" style="text-align: left; width: 60%;"
|-
| style="background: #0b98d6; color: #ffffff; width: 30%;" | '''Framework/Concept'''
| style="background: #0b98d6; color: #ffffff; width: 30%;" | '''Organization'''
|- style="vertical-align: top;"
| Risk Management Working Group
| International Council on System Engineering (INCOSE)
|-
| Project Management Institute (PMI) Risk Management Specific Interest Group (RiskSIG)
| Risk Management Specific Interest Group (RiskSIG)
|-
| Environmental Risk Management Authority
| ERMA
|-
| Institute of Risk Management
| IRM
|-
| ISO 31000: Standards relating to risk management
| International Organization for Standardization (ISO)
|-
| RiskAoA - Risk Analysis of Alternatives
| United States Department of Defense (USDoD)
|-
| Risk Management Agency (RMA)
| U.S. Department of Agriculture
|-
| US Farm Policy and Risk Assistance
| ICTSD Programme on Agricultural Trade and Sustainable Development
|-
| Standard Risk Taxonomy
| The Open Group
|-
| ISO/IEC Guide 73:2009. Risk management - Vocabulary
| International Organization for Standardization (ISO)
|-
| Guide for Applying the Risk Management Framework to Federal Information Systems
| NIST - National Institute of Standards and Technology
|-
| Federal Emergency Management Risk concepts
| Federal Emergency Management Agency
|-
| Information Systems Security Risk concepts
| Information Systems Security Association - Risk concepts
|-
| Risk Governance
| International Risk Governance Council
|-
| Risk concepts
| Global Risk Forum
|-
| The United Nations Office for Disaster Risk Reduction
| UNISDR
|-
| Supply Chain and Transport Risk Concepts
| World Economic Forum Supply Chain and Transport Risk Initiative
|-
| Risk Governance
| International Risk Governance Council
|-
| ISO/PAS 28000:2007 - Specification for security management systems for the supply chain
| International Organization for Standardization (ISO)
|-
| Risk Management
| Risk Management Authority
|-
| Integrated risk
| Government of Canada
|-
| Corporate risk profiles
| Government of Canada
|-
| Risk statements
| Government of Canada
|-
| Risk taxonomies
| Government of Canada
|-
| Risk management capability model
| Government of Canada
|-
| A Taxonomy of Threats for Complex Risk Management
| Cambridge Centre for Risk Studies
|-
| Cambridge Risk Framework
| Cambridge Centre for Risk Studies
|}

Table 1: Overview of the key risk frameworks and concepts analyzed.

{| class="wikitable" style="text-align: left; width: 60%;"
|-
| style="background: #0b98d6; color: #ffffff; text-align: left; width: 30%;" | '''Title'''
| style="background: #0b98d6; color: #ffffff; text-align: left; width: 25%;" | '''Author(s)'''
| style="background: #0b98d6; color: #ffffff; text-align: center; width: 5%;" | '''Year'''
|- style="vertical-align: top;"
| Risk, Uncertainty and Profit, Chicago
| Knight, F. H.
| style="text-align: center;" | 1921
|-
| Man and Society in Calamity: The Effects of War, Revolution, Famine, Pestilence upon Human Mind, Behavior, Social Organization and Cultural Life
| Pitirim Sorokin
| style="text-align: center;" | 1942
|-
| The environment as hazard
| Ian Burton, Robert Kates, and Gilbert F. White
| style="text-align: center;" | 1978
|-
| Judged frequency of lethal events
| Lichtenstein, Sarah; Slovic, Paul; Fischhoff, Baruch; Layman, Mark; Combs, Barbara
| style="text-align: center;" | 1978
|-
| Judgment under uncertainty: heuristics and biases
| Daniel Kahneman, Paul Slovic, and Amos Tversky
| style="text-align: center;" | 1982
|-
| Risk and culture: An essay on the selection of technical and environmental dangers
| Mary Douglas, and Aaron Wildavsky
| style="text-align: center;" | 1982
|-
| A Philosophical Introduction to the Theory of Risk Evaluation and Measurement
| Rescher, Nicholas
| style="text-align: center;" | 1983
|-
| Acceptable risk
| Baruch Fischhoff, Sarah Lichtenstein, Paul Slovic, Steven L. Derby, and Ralph Keeney
| style="text-align: center;" | 1984
|-
| Normal accidents. Living with high-risk technologies
| Charles Perrow
| style="text-align: center;" | 1984
|-
| Lateral Asymmetry of Risky Recommendations
| Drake, R. A.
| style="text-align: center;" | 1985
|-
| Cognitive risk-taking after frontal or temporal lobectomy—I. The synthesis of fragmented visual information
| Miller, L.
| style="text-align: center;" | 1985
|-
| (1985). "Cognitive risk taking after frontal or temporal lobectomy II. The synthesis of phonemic and semantic information." Neuropsychologia, 23, 371–379.
| Miller, L., & Milner, B.
| style="text-align: center;" | 1985
|-
| Human System Response to Disaster: An Inventory of Sociological Findings
| Thomas E. Drabek
| style="text-align: center;" | 1986
|-
| An Introduction to Risk Management (2 ed.).
| Crockford, Neil
| style="text-align: center;" | 1986
|-
| An introduction to risk management
| Crockford, Neil
| style="text-align: center;" | 1986
|-
| Perception of Risk
| Paul Slovic
| style="text-align: center;" | 1987
|-
| Seven Cardinal Rules of Risk Communication.
| Covello, Vincent T.; Allen., Frederick H.
| style="text-align: center;" | 1988
|-
| Planning for earthquakes: Risks, politics, and policy
| Philip R. Berke, and Timothy Beatley
| style="text-align: center;" | 1992
|-
| Earth shock: Hurricanes, volcanoes, earthquakes, tornadoes and other forces of nature
| W. Andrew Robinson
| style="text-align: center;" | 1993
|-
| Taxonomy-based risk identification in software industry
| Marvin Carr , Suresh Konda , Ira Monarch , Clay F. Walker , F. Carol Ulrich
| style="text-align: center;" | 1993
|-
| At risk: Natural hazards, people's vulnerability and disasters
| Piers Blaikie, Terry Cannon, Ian Davis, and Ben Wisner
| style="text-align: center;" | 1994
|-
| RISK
| John Adams
| style="text-align: center;" | 1995
|-
| Against the Gods: The Remarkable Story of Risk
| Peter L. Bernstein
| style="text-align: center;" | 1996
|-
| Reduction and predictability of natural disasters
| John B. Rundle, William Klein, Don L. Turcotte
| style="text-align: center;" | 1996
|-
| Evolutionary hypotheses of risk-sensitive choice: Age differences and perspective change
| X. T. Wang
| style="text-align: center;" | 1996
|-
| Modern Society Shocked by Its Risks
| Niklas Luhmann
| style="text-align: center;" | 1996
|-
| Regions of risk: A geographical introduction to disasters
| Kenneth Hewitt
| style="text-align: center;" | 1997
|-
| The Challenger Launch Decision: Risky Technology, Culture and Deviance at NASA
| Diane Vaughan
| style="text-align: center;" | 1997
|-
| Who takes risks? Daring and caution in foreign policy making.
| Kowert, P.A., & Hermann, M.G.
| style="text-align: center;" | 1997
|-
| Dangerous earth: An introduction to geologic hazards
| Barbara W. Murck, Brian J. Skinner, Stephen C. Porter
| style="text-align: center;" | 1998
|-
| Paying the price: The status and role of insurance against natural disasters in the United States
| Howard Kunreuther, and Richard J. Roth
| style="text-align: center;" | 1998
|-
| Against the Gods: The Remarkable Story of Risk
| Peter L. Bernstein
| style="text-align: center;" | 1998
|-
| The Onset of the East Asian Financial Crisis
| Radelet, Steven; Sachs, Jeffrey
| style="text-align: center;" | 1998
|-
| Disasters and democracy
| Rutherford H. Platt
| style="text-align: center;" | 1999
|-
| Natural hazard mitigation: Recasting disaster policy and planning
| David Godschalk, Timothy Beatley, Philip Berke, David Brower, and Edward J. Kaiser
| style="text-align: center;" | 1999
|-
| Probabilistic Risk Assessment: What Is It And Why Is It Worth Performing It?
| Dr. Michael Stamatelatos
| style="text-align: center;" | 2000
|-
| Behaviour Research and Therapy, An International Multi-Disciplinary Journal
| Joseph I. Constans
| style="text-align: center;" | 2001
|-
| Acceptable Risk Processes: Lifelines and Natural Hazards.
| Craig Taylor and Erik VanMarcke
| style="text-align: center;" | 2002
|-
| "Environmental Risk Analysis: Problems and Perspectives in Different Countries"
| Gurjar, Bhola Ram; Mohan, Manju
| style="text-align: center;" | 2002
|-
| Risk, Uncertainty and Profit
| Frank Hyneman Knight
| style="text-align: center;" | 2002
|-
| The social amplification of risk
| Nick Pidgeon, Roger E. Kasperson, and Paul Slovic
| style="text-align: center;" | 2003
|-
| Megaprojects and Risk: An Anatomy of Ambition
| Flyvbjerg, Bent
| style="text-align: center;" | 2003
|-
| Enterprise Risk Management: From Incentives to Controls
| Lam, James
| style="text-align: center;" | 2003
|-
| Social Risk Management: The World Bank Approach to Social Protection in a Globalizing World
| Holzmann, Robert; Lynne Sherburne-Benz and Emil Tesliuc
| style="text-align: center;" | 2003
|-
| Targeted Transfers in Poor Countries:Revisiting the Trade-Offs and Policy Options
| Ravallion, Martin
| style="text-align: center;" | 2003
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|-
|
|
| style="text-align: center;" |
|}

Table 2: Overview of the key risk publications analyzed.

[[File:Best-Practice-around-Risk-Management---Figure-1.png|thumb|800px|Figure 1: Risk Management and the Natural Cocoon Phase.]]

'''Document:''' [[Media:Best Practice around Risk Management.pdf|Download the 'Best Practice around Risk Management' document.]]

[[Category: Best Practices]]
[[Category: Risk]]

@@ Line 10: / Line 10: @@
 [[Category: Value Management]]
 [[Category: Business Architecture]]
 [[Category: Performance Management]]

← Older revision		Revision as of 23:34, 19 January 2017
Line 10:		Line 10:
	[[Category: Value Management]]		[[Category: Value Management]]
	[[Category: Business Architecture]]		[[Category: Business Architecture]]
		+	[[Category: Performance Management]]

@@ Line 2: / Line 2: @@
 == Finance Operating Model - Value ==
-{| class="wikitable" style="text-align: left; width: 100%;"
+[[File:Finance Operating Model - Value - Figure 1.png|thumb|800px|Figure 1: Finance Operating Model - Value.]]
-|-
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Framework/Concept'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-| style="background: #0b98d6; color: #ffffff; width: 7%;" | '''Organization'''
-|- style="vertical-align: top;"
-| Risk Management Working Group
-| International Council on System Engineering (INCOSE)
-|-
-| Project Management Institute (PMI) Risk Management Specific Interest Group (RiskSIG)
-| Risk Management Specific Interest Group (RiskSIG)
-|-
-| Environmental Risk Management Authority
-| ERMA
-|-
-| Institute of Risk Management
-| IRM
-|-
-| ISO 31000: Standards relating to risk management
-| International Organization for Standardization (ISO)
-|-
-| RiskAoA - Risk Analysis of Alternatives
-| United States Department of Defense (USDoD)
-|-
-| Risk Management Agency (RMA)
-| U.S. Department of Agriculture
-|-
-| US Farm Policy and Risk Assistance
-| ICTSD Programme on Agricultural Trade and Sustainable Development
-|-
-| Standard Risk Taxonomy
-| The Open Group
-|-
-| ISO/IEC Guide 73:2009. Risk management - Vocabulary
-| International Organization for Standardization (ISO)
-|-
-| Guide for Applying the Risk Management Framework to Federal Information Systems
-| NIST - National Institute of Standards and Technology
-|-
-| Federal Emergency Management Risk concepts
-| Federal Emergency Management Agency
-|-
-| Information Systems Security Risk concepts
-| Information Systems Security Association - Risk concepts
-|-
-| Risk Governance
-| International Risk Governance Council
-|-
-| Risk concepts
-| Global Risk Forum
-|-
-| The United Nations Office for Disaster Risk Reduction
-| UNISDR
-|-
-| Supply Chain and Transport Risk Concepts
-| World Economic Forum Supply Chain and Transport Risk Initiative
-|-
-| Risk Governance
-| International Risk Governance Council
-|-
-| ISO/PAS 28000:2007 - Specification for security management systems for the supply chain
-| International Organization for Standardization (ISO)
-|-
-| Risk Management
-| Risk Management Authority
-|-
-| Integrated risk
-| Government of Canada
-|-
-| Corporate risk profiles
-| Government of Canada
-|-
-| Risk statements
-| Government of Canada
-|-
-| Risk taxonomies
-| Government of Canada
-|-
-| Risk management capability model
-| Government of Canada
-|-
-| A Taxonomy of Threats for Complex Risk Management
-| Cambridge Centre for Risk Studies
-|-
-| Cambridge Risk Framework
-| Cambridge Centre for Risk Studies
-|}
-−
-Table 1: Overview of the key risk frameworks and concepts analyzed.