A Systemic Approach to Risk Management: Utilizing Decision Support Software Solutions for Enhanced Decision-Making

The concept and practical implementation of risk management originated in the United States during the 1950s, primarily focused on financial protection through insurance. Over time, emphasis shifted towards preventive measures, leading to the professional reorientation of agents into risk managers. Consequently, risk managers were entrusted with the responsibility of establishing and overseeing comprehensive risk management within their organizations, with a focus on system quality. Risk, in this context, refers to the probability or possibility of an undesirable outcome resulting from an event.

A system-based approach to risk management necessitates monitoring the management process, which encompasses defined frameworks and content elements. The systematicity entails monitoring the flow of management functions and processes, identifying critical points, analyzing their impact on safeguarded values, and defining measures for effective treatment. Such a risk management system ensures continuous monitoring and facilitates effective prevention.

All risks, whether direct or indirect, bear an impact on the secure management of an organization's critical processes. This impact is influenced by the key dimensions of the organization, including complexity, formalization, and centralization, which are particularly pronounced in organizations with a dominant centralization element.

Risk management should enable decision-makers to systematize information and processes based on incomplete data. The relevance of establishing a risk management process lies in the ability to utilize information derived from incomplete data for decision-making. This study highlights the significance of this realm of uncertainty by posing a research question: Whether the establishment of an adequate quality of the risk management process based on software solutions ensures the quality of decisions?

The research aims to demonstrate that system quality, achieved through an appropriate model defined by methods, tools, and procedures, is pivotal in establishing a systemic approach to risk management. One potential solution to address this issue is the development of a software solution.

The prevailing risk management model is based on the ISO31000 Risk Management standard [1], which outlines general principles. In practice, the model is implemented in various ways, contingent upon the knowledge and experience of the practitioner. Consequently, selective application of specific parts of the risk management process occurs, with a greater focus on the parts that have more available information during processing [2]. Komazec conducted research on the quality of risk management processes in military organizational systems [2], analyzing numerous standards that encompass various risk assessment methods. The findings revealed that the inconsistency of the risk management system impairs decision quality. In particular, the risk management process is incongruent with the system management process, resulting in subjective selection of process components, which diminishes decision quality.

As a result of the research [2], the introduction of a risk planning phase was proposed to establish a context for the risk management process that aligns with the system management process. In practice, this necessitates transparent and accessible system management process functions for process owners, ensuring ongoing communication with the risk manager. All procedures must be defined and adhered to in a specific order. Such conditions enable a minimum level of system quality, guaranteeing the necessary consistency in the decision-making process.

The present study employed the following methodologies to conduct theoretical research, analysis, and draw conclusions:

Content analysis: A systematic examination of pertinent scientific literature was conducted to acquire comprehensive insights into the theoretical foundations and existing research findings concerning the systemic approach to risk management within the decision-making function. This method facilitated the acquisition of fundamental theoretical knowledge and the identification of existing approaches and models. Quality issues within the risk management process were investigated by exploring the application of recommended models from various standards [1], [2] and analyzing outcomes from research papers proposing decision-making solutions utilizing diverse operational research methods [3], [4], [5].

Empirical research: To ensure robust results, empirical research was undertaken, encompassing data collection from real-world scenarios or simulations. This involved surveys, interviews, research studies, or experiments to gather data on the attitudes, perceptions, and behaviors of relevant stakeholders engaged in the risk management process. The survey targeted risk managers or individuals involved in risk management within organizations. Additionally, individuals responsible for implementing quality systems in accordance with the ISO 9001 Quality Management System standard were included in the survey. Out of the total of 123 surveyed managers, a consensus of 99.2% affirmed the necessity of maintaining the quality of the risk management process to uphold system quality. Among the surveyed managers, 27% participated in various simulations supported by software solutions, with unanimous agreement that software support is an indispensable factor in ensuring a coherent risk management process.

Systems analysis: Systems analysis was employed to comprehend the intricate interplay among system elements, identify causal relationships and effects, and analyze their interdependencies. This method facilitated an understanding of the complexity inherent in the risk management process and identification of the key factors influencing decision-making. Systems analysis ensures consistency in aligning the system management process with the risk management process, thus establishing well-defined requirements for utilizing specific risk assessment methods within specific segments of the system management process.

By employing these methodologies, the study advanced theoretical research, empirical investigation, and systems analysis to examine the systemic approach to risk management, contributing to a deeper understanding of decision-making processes within this context.

The process of decision-making, an intrinsic part of human existence, has garnered increasing attention as a specialized scientific discipline in recent decades, known as decision theory. Building upon the principles of decision theory, various decision support systems have been developed [6], [7], leading to two distinct approaches to decision-making:

1. Intuitive decision-making [8]: Rooted in ancient times, this approach relies on the decision-maker's experience, subjective assessments, and personal convictions. Intuitive decision-making remains the most prevalent approach in contemporary decision-making practices.

2. Scientific decision-making [8]: Within the realm of decision theory, a wide range of modern methods and models have emerged to provide decision-making support. By employing these methods, decision-making becomes increasingly objective, grounded in scientific foundations, and less reliant on the decision-maker's intuition.

It is obvious that the issue of decision-making, in general the matter of decision-making, represents an important thought-volitional activity that is becoming more and more important in organizations [9]. A large number of researchers have defined the concept of decision-making:

• Decision-making is a choice between several alternative possibilities for solving a problem [10].

• Decision-making is a process in which a choice is made between several alternative possibilities for changing the state of the system in order to achieve a goal [11].

• Decision-making includes all activities related to choosing one among various possibilities [12].

• Decision-making is a choice between possible alternatives [13].

Every decision-making is preceded by a decision-making process. This process is universal in its content and purpose and versatile for all levels and types of management. From this arises the need to first of all know this process, and then to master it [14]. The essence of decision science is system analysis, which uses a system approach and scientific method in its methodology.

Consideration of the decision-making process inevitably requires an overview and analysis of the stages that the process consists of. Different authors define the number and content of the stages that make up the decision-making process in different ways. Based on the presentation of the stages of the decision-making process given by Čupić and Tummala [13], Figure 1, Table 1 was created, which shows some risk elements that affect the quality of the process itself:

The decision-making process, depicted in Figure 1, features a smaller box encompassing three phases (prediction, model formation, and solving), as some authors do not treat them as distinct phases. The broader framework represents the comprehensive decision-making process applicable to diverse decision-making scenarios, with varying degrees of emphasis on individual phases, contingent upon the nature of the problem being addressed [12].

Decision-making can be formalized through an appropriate model [1]:

where in:

$\mathrm{A}=\left\{\mathrm{a}_{\mathrm{i}}\right\}_{\mathrm{i}=1, \mathrm{m}}$ – set of alternatives;

$\mathrm{S}=\left\{\mathrm{s}_{\mathrm{j}}\right\}_{\mathrm{j}=1, \mathrm{n}}$ – set of possible environmental states and their descriptions;

$\varphi: \mathrm{A} \times \mathrm{S} \rightarrow \mathrm{Y}$ – mapping the decision to the outcome;

$\mathrm{Y}=\left\{\mathrm{y}_{\mathrm{ij}} \mid \mathrm{y}_{\mathrm{ij}}=\varphi\left(\mathrm{a}_{\mathrm{i}}, \mathrm{s}_{\mathrm{j}}\right)\right\}$ – the decision outcome;

W – indicator of decision outcome quality;

P – decision selection rule (decision criterion).

Depending on the number of decision criteria, decision-making can be categorized as single-criteria or multi-criteria decision-making.

Management, in its broadest sense, has evolved in response to changing processes, technologies, levels of knowledge, and environmental dynamics. Consequently, the perception and management of risk, as well as the decision-making process itself, have undergone inevitable transformations. It is crucial to structure the decision-making process systematically, relying on objective information and risk analysis. Identification of pertinent risk factors, assessment of their likelihood and impact, and decision-making aimed at minimizing risk and maximizing benefits are imperative. Importantly, risk-related decision-making necessitates ongoing evaluation and adjustment. Decisions are not one-time events; their effectiveness is continually monitored, and corrective measures are taken to ensure appropriate risk management over time. Thus, the risk management process emerges as a critical component of decision-making. Table 1 provides a glimpse into selected risk elements monitored in each phase of the decision-making process. Further research can deconstruct each decision-making phase in more granular detail, comprehensively identifying all risk elements within. Such endeavors contribute to enhancing risk monitoring quality and formulating a basis for identifying future and derived risks. Future research in this domain holds potential for developing novel decision support methods and tools, thereby advancing the risk management process.

Contemporary organizations employ diverse methods, techniques, tools, and decision models to facilitate systemic risk management. Among these, the Analytic Hierarchy Process (AHP) method, developed by Saaty [16] and Pamučar et al. [17], is frequently utilized for risk assessment when precise, statistical risk quantification is unfeasible. The AHP method revolves around incorporating and leveraging expert knowledge and experience relevant to the problem at hand. It finds particular application in multi-criteria decision-making scenarios, where it aids in identifying the most favorable choice for each alternative based on a predefined set of criteria and attribute values, effectively establishing a comprehensive order of alternative importance within the model.

Numerous authors have employed the AHP method in risk assessment [18], [19], [20], [21]. Saaty himself has applied the AHP method to assess uncertainty and risk in several papers. Mustafa and Al-Bahar [22] utilized the AHP method to identify, classify, and assess risks in construction projects. The AHP method has also found utility across various insurance domains. McCaley-Bell and Badiru [3] developed a fuzzy expert system to predict and quantify the risk of extremity injuries in the workplace. Their approach involved linguistic variable development and quantification based on phase sets, followed by the application of the AHP method to determine relative weights for identified risk factors. Chen et al. [10] proposed the introduction of a correction coefficient for premium rates in engineering project insurance, using the AHP method. Kumar and Singh [5] put forth a methodology that integrates data on life insurance products with the AHP method to facilitate decision-making processes.

The implementation of the AHP method entails four distinct phases [12]:

1. Problem structuring

2. Data collection

3. Evaluation of relative weights

4. Determination of the solution

In the problem structuring phase, the decision problem is decomposed into a hierarchical structure, with each level representing a smaller set of manageable attributes. These attributes are further decomposed into sub-elements corresponding to subsequent levels. This procedure continues until the entire problem is covered (a general case of problem decomposition is given in Figure 2). This hierarchical structuring approach effectively resolves complex real-world problems, allowing the identification of significant attributes essential to achieving the overall goal.

During the second phase, data is collected and measured. Decision-makers assign relative scores to attribute pairs within each hierarchical level, as well as to attributes at higher levels. This comparative process extends to criteria and alternatives. Attribute comparisons involve assigning relative scores using a nine-point scale (Table 1). The preferred attribute in a pair is assigned a score between 2 and 9, while the subordinate attribute receives a score representing the reciprocal of the preferred attribute's score (e.g., 5 and 0.2). If the decision-maker perceives equal importance for attributes, both attributes receive a score of 1.

When assigning scores to attribute pairs, the availability of objective initial data can aid decision-makers. Absent such data, assessments rely on personal beliefs, experience, and convictions. This process yields pairwise comparison matrices for each level of the hierarchy. The third phase of the AHP method involves estimating relative weights. Calculations are performed on the pairwise comparison matrices to obtain normalized and unique weight eigenvectors for all attributes at each level. Consider a hierarchy level with $\mathrm{n}$ attributes $\mathrm{A}_1, \mathrm{~A}_2, \ldots, \mathrm{A}_{\mathrm{n}}$ and a weight vector $\mathrm{w}=\left(\mathrm{w}_1, \mathrm{w}_2, \ldots, \mathrm{w}_{\mathrm{n}}\right)$. The objective is to determine w to establish the relative importance of $\mathrm{A}_1, \mathrm{~A}_2, \ldots, \mathrm{A}_{\mathrm{n}}$. If the decision-maker evaluates the weights by comparing each pair of attributes $\mathrm{A}_{\mathrm{i}}$ and $\mathrm{A}_{\mathrm{j}}$, with the degree to which $\mathrm{A}_{\mathrm{i}}$ dominates $\mathrm{A}_{\mathrm{j}}\left(\mathrm{w}_{\mathrm{i}} / \mathrm{w}_{\mathrm{j}}\right)$, a pairwise comparison matrix can be formed as shown in Eq. (2).

The normalized weight vector $\mathrm{w}=\left(\mathrm{w}_1, \mathrm{w}_2, \ldots, \mathrm{w}_{\mathrm{n}}\right)$ is obtained by solving the corresponding eigenvalue problem in Eq. (3).

where, A is a reciprocal matrix satisfying the properties: $\mathrm{a}_{\mathrm{ji}}=1 / \mathrm{a}_{\mathrm{ij}}$ and $\mathrm{a}_{\mathrm{ii}}=1$, for all $\mathrm{i}, \mathrm{j}=1, \ldots, \mathrm{n}$. If the diagonal elements of A are equal to 1 ($\mathrm{a}_{\mathrm{ii}}=1$) and A is a regular matrix ($\operatorname{det} \mathrm{A} \neq 0$), small changes in aij values maintain the largest eigenvalue ($\lambda_{\max }$) while the other eigenvalues approximate zero. Consequently, the values of the vector t can also be obtained through Eq. (4).

For a matrix to exhibit complete consistency between every three comparisons $\mathrm{a}_{\mathrm{ik}}$, $\mathrm{a}_{\mathrm{kj}}$, and $\mathrm{a}_{\mathrm{ij}}$, the condition $\mathrm{a}_{\mathrm{ik}} \times \mathrm{a}_{\mathrm{kj}}=\mathrm{a}_{\mathrm{ij}}$ must be satisfied (Eq. (5)).

The Consistency Index (CI) serves as a measure of deviation consistency from $\lambda_{\max }$ and is calculated using Eq. (6).

where, $\lambda_{\max }$ is the largest eigenvalue of matrix A:

A CI value below 0.10 is generally deemed satisfactory, indicating consistent estimates (for $\mathrm{a}_{\mathrm{ij}}$) and a close approximation of the ideal estimated value. In the fourth and final phase of the AHP method, a composite normalized vector is derived by multiplying the weight vectors of successive levels. This composite vector is then employed to ascertain the relative priorities of entities at the lowest level, effectively resolving the full ranking problem.

The application of AHP in systemic risk management offers numerous advantages. It mitigates subjectivity in decision-making, provides an objective foundation for prioritizing risk factors, and enables systematic consideration of complex interactions among elements. AHP facilitates the identification, assessment, and management of various risk aspects, tailored to the organization's objectives and stakeholder perspectives.

Employing the Analytical Hierarchy Process in systemic risk management serves as a valuable tool for informed decision-making based on reasonably accurate information. By quantifying priorities and ranking risk factors, organizations gain a solid footing for effective risk management and the attainment of sustainable development goals. The application of the AHP method ensures quality within the risk management process, even though challenges related to the availability of quality information persist. However, the process itself is well-defined, and consistency in mutual comparisons is established. Subjectivity, influenced by the participants involved, is reduced due to the presence of a defined process, making deviations from the research logic easily noticeable. Further research in this area holds the potential to enhance the AHP method and foster its broader acceptance in risk management practice.

Risk management plays a crucial role in ensuring system quality and is an integral part of effective quality management. It encompasses a structured process that involves the identification, measurement, selection, development, implementation, and monitoring of risks. Figure 3 illustrates the position and significance of risk management within the context of quality management, incorporating three approaches: planned, interactive, and retroactive management.

Figure 3 showcases the relationship between risk management and quality management [16].

Effective risk management, as outlined in the international standard ISO 31000: Risk management - Principles and Guidelines, is guided by the following principles [2]:

• Risk management creates and safeguards value.

• Risk management is an intrinsic aspect of all organizational processes.

• Risk management is an integral part of decision-making.

• Risk management explicitly addresses uncertainty.

• Risk management is systematic, structured, and timely.

• Risk management is tailored to the organization.

• Risk management considers human and cultural factors.

• Risk management is transparent and inclusive.

• Risk management is dynamic, iterative, and responsive to environmental changes.

• Risk management fosters continuous improvement within the organization.

The risk management process according to the same standard is shown in Figure 4.

A crucial element of risk management, concerning system quality, is the implementation of appropriate control and supervision systems. These systems establish mechanisms to monitor system quality, identify deviations, and take corrective action to ensure continuous progress and prevent quality deterioration [23], [24].

Furthermore, it is vital to establish clear procedures and guidelines for risk management within the organization, ensuring consistency and efficiency in addressing risks. These procedures should encompass the identification of responsible individuals, data gathering methods for risk analysis [25], [26].

The risk management process, from the perspective of system quality, necessitates continuous improvement and monitoring to enable organizations to respond to environmental changes and emerging risks. Adopting a systematic approach, applying relevant standards and methodologies, and engaging relevant stakeholders contribute to effective risk management and the achievement of a high level of system quality.

The establishment of consistent processes and procedures is a critical aspect in terms of risk management.

For organizations striving to deliver high-quality products or services, the risk management process from the perspective of system quality is indispensable. Through risk management, organizations can reduce failures, enhance security, increase customer satisfaction, and achieve sustainable market success. Commitment, resource allocation, and continuous monitoring are essential for ensuring the continuity of providing quality products and services.

The research problem regarding the impact of the quality of the risk management process on the decision-making process was addressed in this study. The research question, “whether the establishment of an adequate quality of the risk management process based on software solutions ensures the quality of decisions” was thoroughly examined. The findings unequivocally establish a causal relationship between the quality of the risk management process and the organization's process management. Given the influence of human factors on both processes, the support of software solutions becomes necessary. This study demonstrates the potential application of the Analytic Hierarchy Process (AHP) as a foundation for a software solution. Through the utilization of multi-criteria analysis, this method ensures the consistency of variable comparisons based on specific criteria.

The study yielded the following results:

1. Identification of key issues within the risk management system pertaining to process quality. The existing standard [1] offers general principles and a risk management process, yet the application of this process by managers varies in quality and level of detail based on real circumstances. Such variations lead to subjectivity and a decline in overall process quality. Decisions made under these conditions lack a solid basis of information.

2. Contribution to the understanding of the risk management process's importance within the decision-making process. The identification of risk factors, goal setting, analysis of alternatives, and decision-making are pivotal steps in effective risk management. The introduction of the “Risk Planning” phase proves particularly significant as it establishes the process, principles, and working methodology for each specific risk management case. Surveyed managers unanimously agree on the necessity of establishing a universally applicable risk management system with risk planning as its initial phase [27].

3. The application of a quality-based systems approach enabled a broader perspective on risk and facilitated an understanding of the interconnectedness of system elements. This holistic approach enhances the efficiency and effectiveness of decision-making processes [28]. Surveyed managers concur that the quality of the risk management system is a fundamental element of the organization's quality management.

These results shed light on the importance of adopting a quality-based systems approach in risk management and underscore the significance of making sound decisions for successful organizational management.

Based on the identified critical points within the risk management process, future research in this field should encompass:

1. In-depth exploration of decision-making methods in risk management, such as multi-criteria analysis and fuzzy logic, to enhance the efficiency of decision-making processes.

2. Investigation of new approaches for managing specific types of risks (e.g., technological, environmental, financial) to develop tailored risk management strategies.

3. Monitoring and evaluation of the effectiveness of the risk management system through case studies or comparative analyses of different organizations to identify best practices and enhance existing systems.

4. Integration of emerging technologies, such as artificial intelligence, data analytics, and automation, into the risk management process to improve speed, accuracy, and efficiency.

5. Research on the impact of regulatory frameworks on risk management and the development of new models and guidelines for compliance with risk management regulations and standards.

These proposed avenues of research have the potential to contribute to advancements in the understanding and application of a systemic approach to risk management while improving the efficiency and effectiveness of the decision-making process within the risk context.

Contemporary management within complex systems is characterized by the inherent turbulence of the business environment, where information abundance and rapid change prevail. Technological advancements occur at such a pace that comprehensive analysis of past situations becomes challenging. Consequently, uncertainty spaces expand, compounding the complexity of managing uncertainty over time.

The system, as an interconnected web of cause-and-effect relationships, perpetually interacts with its environment. This constant interaction gives rise to ongoing spaces of uncertainty, capable of triggering system instability and entropy. Risk management within the system management process aims to identify critical points and proactively address their occurrence and repercussions. Access to high-quality real-time information is essential for effective risk management.

The results of this study unequivocally demonstrate the interdependence between the quality of the system and the quality of the risk management process. While the study presents a comprehensive overview of the problem and its implications, it does not seek to solve a specific issue. Instead, it establishes a foundation for future research by highlighting the elements of risk within system management processes.

The application of software solutions based on multi-criteria decision-making methods and principles, including those incorporating artificial intelligence, plays a pivotal role in maintaining the quality of the risk management process. As the modern business environment continues to experience heightened dynamics and changes, researchers must increasingly leverage specialized software tailored to the needs of the risk management process. Such software solutions prevent or minimize biases in problem-solving and reduce subjectivity while ensuring the system's quality adheres to the required standards. A high-quality system serves as the fundamental prerequisite for quality processes within the system. By establishing quality-based processes, the number of areas of uncertainty decreases, facilitating the identification of critical points.

Future research in this domain should concentrate on reducing dependency space and enhancing the quality process. The application of various multi-criteria optimization methods enables the maintenance of system quality. The information obtained through these methods allows for a more rational observation of environmental phenomena, risk assessment, and the formulation of appropriate decisions. Software solutions grounded in multi-criteria optimization methods enable detailed analyses of interdependencies concerning risk-causing phenomena. Notably, subjectivity arising from the human factor represents a significant challenge in the risk management process across various domains. Therefore, software-based solutions that mitigate or minimize subjectivity make substantial contributions to the quality of system risk analysis and, consequently, the quality of final decisions.

To advance the understanding and practice of risk management, further research should focus on reducing dependency space and improving the quality process. By integrating advanced methodologies, such as multi-criteria optimization, researchers can maintain system quality, gain deeper insights into risk elements, and enhance decision-making. Additionally, exploring the role of software solutions in mitigating subjectivity will contribute to more robust risk analysis and decision-making within complex systems.

In conclusion, this study highlights the critical relationship between the quality of the risk management process and system management, emphasizing the importance of software solutions, multi-criteria optimization, and reduced subjectivity in achieving high-quality decisions within turbulent business environments.