RISK MANAGEMENT IMPLEMENTATION PRACTICES IN RUSSIAN INDUSTRIAL COMPANIES: RESULTS OF AN EMPIRICAL STUDY

1. INTRODUCTION

Modern condition of economic management peculiar with the dynamically changing environment, increasing globalization, new markets appearing, complex economical and geopolitical situation in Russia, amplification of and appearance of new breakthrough technologies, change of consumers; behaviour and social demand of the society, require the rapid risks identification and management by the industrial companies.

Implementation of the risk-management system favours industrial companies to achieve the strategic and operational goals and effectiveness of management and may become the instrument of price creation both in short-term and long-term prospective.

2. IMPLEMENTATION OF RISK-MANAGEMENT SYSTEM IN RUSSIAN INDUSTRIAL ORGANIZATIONS

The level of risk-management system development in industrial organizations is under the influence of corporate culture of risk-management, which supposes the presence of certain company's policy in the sphere of risks management, values system and the development level.

In order to define the level of corporate culture of riskmanagement, the author of this article have conducted the questionnaire of Russian industrial companies of different sectors. There were sent 276 questionnaires to industrial companies, the response made 35 % (96 companies). The questionnaire offered to answer the questions and evaluate the effectiveness of risk-management within 6 aspects [Risk management practice …,, 2015]: the goals of riskmanagement system implementation, organizational structure of risk management in the industrial company, financing of risk management system maintenance, definition of risks evaluation methods, integration of risk-management into the key directions of company's activity, the level of risk management system automatisation.

1. The goals of risk-management system implementation. This aspect provides the identification of goals and tasks of risk-management system implementation [Risk management practice …,, 2015]. In the fig. 1 there are represented the results of the survey on finding the goals of risk management system implementation.

The results of the survey had shown that the main goals of risk-management system implementation for Russian industrial companies are the achievement of company's strategic goals, increase of company's value, increase of the efficiency and performance.

Figure 1. The goals of risk-management system implementation in industrial companies (% of the total amount of respondents)

2. Organizational structure of risk-management in an industrial company [Risk management practice …, 2015]. This aspect of the research provides definition of the place of risk-management in an industrial company, i.e. the answers to questions how and by whom risk-management function shall be realized in a company.

Availability of an organization unit realizing the riskmanagement functions. In the result of the research, we have received the results concerning subdivisions, performing risk-management functions in industrial companies (fig. 2).

Figure 2. Availability of an organization unit realizing the risk-management functions (% from the general number of respondents)

The most respondents – 42 % noted, that the control of risks evaluation and management is performed by the internal audit unit. Traditionally the internal audit unit perform the check of the internal systems as to efficiency of their realization of certain functions. This unit also performs the risk-management functions. The second place according to the survey results took financial and economic unit – it is 29 % of respondents. It is connected to the developed management practice in the sphere of financial risks; that is why other risks management is also delegated to financial unit. 10 % of companies have no unit performing riskmanagement functions.

Number of employees performing the risk managers functions. The results of survey on the number of riskmanagers in Russian industrial companies are presented in figure 3.

Figure 3. The number of employees performing risk-managers functions (% of the general number of respondents)

The most respondents – 38 % – note, that in their companies risk-manager's functions are performed by six to ten employees. It means, that these employees are responsible for risk coordination, evaluation and management in companies. The number of companies with one to five risk-managers made one third – 32 % of the respondents. Received data demonstrates that in industrial companies both individual units and the head officers of departments for main directions are responsible for risk management.

Risk management system diagnostics. In the fig. 4 there are represented the results of the survey on finding the unit performing diagnostics of risk management system.

Figure 4. Units, performing diagnostics of risk management system (% of the general number of respondents)

The most respondents note that risk management system diagnostics is performed by the internal services: internal audit service (46 % of respondents), risk-management unit (34 % of respondents), top-management (18 % of respondents). 30 % of the respondents stated that they involve external consultants for company's risk management system diagnostics. Company's risk management system diagnostics by internal or external specialists of a company allows getting more objective evaluation of risk management system efficiency.

3. Financing risk management system maintenance (fig. 5) [Risk management practice …, 2015]. Here we have considered the definition of the amount of organization's risk management system financing and a company's riskmanagement system financing direction.

Figure 5. The amount of financing for risk-management system maintenance per year (% of the general number of respondents)

The most of companies – 68 % respondents – spends in average less than 10 mil.rub. per year for risk-management system maintenance. Companies spending more than 30 mil. rub. per year for their risk-management system maintenance are in a minority – 9 % respondents. It may be connected with insufficient financing sources of company's riskmanagement, low substantiation of the risk-management system for provision of company's strategic stability.

4. Definition of risk evaluation methods, usage of certain methods for individual risk groups of an industrial company (fig. 6) [Risk management practice …, 2015].

Figure 6. Risk evaluation methods (% of the general number of respondents)

Industrial companies mostly use qualitative methods for evaluation of most risks; financial and engineering and manufacturing risks are evaluated with quantitative methods, because they have enough statistical information, which may be applied for mathematical calculations of the degree of risks influence and probability of their occurrence.

5. Risk-management integration into key directions of company's activity, i.e. definition the key directions of company's activity where the risk-management is performed (fig. 7) [Risk management practice …, 2015].

Figure 7. Risk-management integration into the directions of industrial companies' activity (% of the general number of respondents)

Most respondents noted that risk-management integration manifests itself the most in such directions, as financial and investment planning, project and innovation planning, that witnesses about the high value of the risk-oriented approach.

6. Automation level of the risk management system (fig. 8) [Risk management practice …, 2015]. This aspect of the research demonstrates to what extent digital technologies are used in the process of industrial companies' riskmanagement.

Figure 8. Automation level of the risk management system of industrial companies (% of the general number of respondents)

Automation level of the risk management system was estimated under the scale from 1 to 10 points, where 1 to 3 points shows the low automation level, 4 to 6 – average one, and 7 to 10 – the high level.

Most companies – it is 51 % respondent – stated the low level of risk-management system automation, 42 % – the average one. Only 7 % of industrial companies consider the level of risk-management system automation to be high.

Difficulties in risk management systems automation in industrial companies may be related to lack of financing allocated for the risk-management system development, to the necessity of staff training for using new informational systems in risk-management processes management.

Questionnaire of industrial companies also allowed to define the level of risk-management corporative culture on the basis of efficiency assessment of each system element. We offer to assess the level of risk-management corporative culture under the scale, given in table 1.

Table 1.
The scale for assessment of risk-management corporative culture level

The companies were offered to assess the efficiency of each aspect of complex risk-management system implementation under the 10-point scale, where 1 point – ineffective, 10 – effective. There were calculated the average arithmetic values of experts' efficiency assessment of riskmanagement corporative culture by each aspect in the sector (table 2).

Table 2
Questionnaire results on the level of risk-management corporative culture level (points)Source: composed by the author

It should be mentioned that companies of the mining and mechanical engineering sectors have the most developed level of risk-management corporative culture: it makes 8 and 7 points respectively.

Mining sector companies gave the highest scores to efficiency of the formed risk-management organizational structure, risk-management integration into the key directions of activity and the level of production automation. Mining companies recognize the necessity of risk-management implementation, understanding the importance of all the risk management aspects for creation of company's value and provision the strategical stability both in a short-term and long-term prospective. Organizations engaged in mechanical engineering, including electrical equipment, mentioned the high development level of organizational structure of riskmanagement and risk management system financing i their companies.

The average level of risk management corporative culture is peculiar to companies involved in production of consumer goods, food and drinks, chemical sector companies and metallurgical production. The level of risk management corporative culture makes 6,5 and 5 points respectively.

The companies producing consumer goods, food and drinks gave the highest score to the following risk management elements in their activity: correspondence of risk management system operation to the goals of its implementation, organizational risk management structure in the company, and the efficiency of risks assessment methods application.

Chemical and metallurgical sectors companies emphasise the highest level of organizational risk management structure and correspondence of risk management system to company's goals.

To companies with low level of risk management corporative culture belong the enterprises in cosmetics and pharmaceutical sectors, building materials producing companies, as well as furniture, pulp and paper producing units. Their level of risk management corporative culture makes 2,5 and 3 points respectively. The least developed elements of risk management corporative culture in companies of these sector became the organizational risk management structure, financing risk management system maintenance and automation level of risk management system.

Table 3.
System of measurement of risk management implementation maturity levels in industrial organizationsSource: composed by the author relying on [RMS-FERMA, 2003; P3M3, 2006; Ekaterinoslawskyi et al., 2010; Domashchenko, 2015;
Domashchenko, 2016; Kapustina, 2016; Sokolov, 2016; ERM-COSO, 2017; Assessment of maturity level of risk management in Russia,
2018; ISO 31000:2018(E), 2018]

In such a way, industrial companies of all sectors need to increase the level of risk management corporative culture, which will allow to:

• increase the efficiency of risk management system, which is an obligatory condition for managing different external and internal factors, influencing the strategical stability of a company;
• provide the strategical stability of a company, which is needed for its competitive ability;
• to increase a company's value for different stakeholders.

Further we will present the assessment of the maturity level of the risk management system for its implementation into industrial companies' operation.

3. Risk management in industrial companies: methods of assessment of risk management system maturity

In the result of the study we have defined five levels of maturity concerning risk management implementation: absent, managed, quantitatively managed, optimized and advanced levels, each of which indicates to stage of risk management development in industrial companies.

Division of maturity system on risk management implementation into five levels allow:

• to define the stage of development of the risk management system in industrial companies;
• to form the program and stages of further development of the risk management system in industrial companies;
• to define the barriers preventing complex risk management system implementation.

Absent level of maturity of risk management system means that the company does not consider risks and there are totally no elements of risk management system. Therefore, such companies have the high probability of strategic stability loss as there is no understanding of what external and internal factors influence the stability, as well as there is no understanding of what mechanisms shall regulate the strategical stability.

Managed level of maturity of risk management implementation assumes that companies identify the risks that threat their business activity, reflect them in their strategies, though these risks are not quantitatively assessed. Therefore, companies have no idea of the stage of these risks influence on business activity, and their strategical stability. Such companies do not conduct strategical stability management via risk management system.

Quantitatively managed maturity level of risk management implementation is expected to consider the stage of influence and probability of appearance of risks affecting the strategical stability. Nevertheless, industrial companies on this level do not manage risks.

At the optimized level of maturity of risk management implementation, companies start understanding the necessity of strategical stability management via risk management system, that is why they develop programs of risk management, and implement the elements of risk management into the key directions of industrial companies’ activity. At this development stage, companies strive for minimization of risks influence on strategical stability.

Advanced level of maturity of risk management implementation tells about the complex approach of companies towards strategical stability management, which allows considering it from the point of view of three following directions:

• process approach, which manifests itself in the struggle with internal and external threats at the operative level for achievement of strategical stability via the risk management program development;
• system approach by risk management system implementation into all the levels and processes of company management, which provides the balanced management of different subsystems of an organization;
• time-oriented approach, manifesting itself by securing certain value of key aspects of economic entity activity, and by decrease of deviations from the targeted value via constant risks monitoring and residual risk assessment.

The full process of risk management makes it possible to provide complex approach to management of industrial companies’ strategical stability.

4. Methods of industrial companies clustering by the level of maturity of risk management implementation

In the article, we have made the cluster analysis of industrial organizations, which allowed identifying groups of companies, which are homogeneous in risk management implementation maturity level. It allowed to assess as precise as possible the level of their strategical stability, to define the barriers to risk management system implementation in industrial organizations.

To achieve the study goals we have conducted the questionnaire of industrial organizations in different sectors. There were sent 276 questionnaires to industrial companies, the response made 35 % (96 companies). By the results of the survey, we have conducted a cluster analysis with help of Statistica software package.

Clustering was conducted in three stages [Example of use…, 2020].

1. For cluster analysis we have chosen nine factors (variables), which are the elements of risk management system: risks identification, risks classification, risks statement in company's strategies, quantitative risks assessment, risks map formation, risk management program development, monitoring of risk management program, assessment of residual risk and management efficiency, implementation of risk management system in all the spheres of industrial companies activity..

2. We have standardized (set norms) the aspects in order to be able to compare the composition of the compared groups by the formula (1) [Example of use…, 2020]:

       (1)

where x_si – is a standardized value of i-factor, x_i – factual value of i-factor, х_i – average value of i-factor, _i² – meansquare deviation of i-factor.

3. Clustering by k-mean method was conducted.

5. The results of cluster analysis of industrial companies

In the result of cluster analysis, all the companies were divided into four clusters. In the table. 4 there are presented the results of cluster analysis and the main features of the corresponding groups (clusters) in points, calculated as average arithmetic in each companies cluster for each aspect.

Table 4.
The results of cluster analysis of industrial organizations (points)

Source: composed by the author

Cluster 1 includes industrial organizations of the absent level of maturity of risk management system implementation. These companies do not make risks identification, and do not implement any risk-management levels into management processes.

Cluster 2 includes industrial organizations of the managed level of maturity of risk management system. We conclude basing on the calculations, that these enterprises make risks identification (8,44 points), systematize and classify them (7,49 points), and reflect the risks in a company's strategies and annual reports (7,17 points).

Cluster 3 includes industrial organizations of the quantitatively managed level of risk management maturity. Following risk management aspects are peculiar for these industrial companies: risks identification (8,81 points), their classification (8,61 points), risks reflection in companies' strategies (7,81 points), quantitative assessment of risks (6,97 points).

Cluster 4 includes industrial organizations of the optimized level of risk management maturity. They note, that the following risk management system elements are implemented into their activity: risks identification (8,50 points), their classification (8,71 points), risks reflection in companies' strategies (9,00 points), quantitative assessment of risks (8,21 points), risks map formation (7,07 points), risk management program development (6,50 points), risk management system implementation into key directions of industrial companies activity (4,00 points).

To assess the efficiency of cluster analysis we have made the analysis of variance (table 5).

Table 5
Analysis of variance results
Source: composed by the author

Data presented in the table 5 confirm that the classification of industrial companies in four clusters is reasonable. It is proved by the following criteria [Example of use…, 2020]

1. F-criterion value inequation. The hypothesis on the inequation of variance between clusters and inside them is true. Therefore, the data is statistically heterogeneous and may be divided into groups.

2. Level of significance values (significance p < 0,05) tells about low probability of uncertainty of the received results. Therefore, division of industrial companies into four groups is reasonable.

Fig. 9 shows four clusters of industrial companies by the level of risk management maturity.

Fig. 9. Clusters of industrial organizations of different sectors

Basing on questionnaire and cluster analyses we have found out that there are no industrial companies of the advanced level of risk management maturity among the respondents.

In the table 6 there is given the information about the companies of different levels of risk management system maturity by the sectors of industry.

Table 6
Clusters of industrial companies by the level of risk management system maturity of different sectors (number)
Source: composed by the author

The most developed industrial companies in the field of risk management systems are enterprises in mining industry, mechanical engineering, as well as those engaged in the production of consumer goods. Twelve companies of fourteen fall into the fourth cluster of companies with optimized level of risk management maturity.

Companies with the least developed level of risk management include companies in the furniture, pulp and paper, producing building materials, as well as cosmetics, and pharmaceutical industries. None of these enterprises fall into the fourth cluster of companies of optimized level of risk management maturity, i.e. they do not develop the risk management program and do not monitor risk management program.

Industrial companies of all the sectors need to achieve the advanced level of risk management system; it means to provide the full process of risks management, and to engage with it all the horizontal and vertical management levels in order to achieve strategical stability.

6. BARRIERS TO COMPLEX RISK MANAGEMENT SYSTEM IMPLEMENTATION

Review of Russian literature enabled us to reveal the barriers to complex risk management system implementation in Russian industrial companies [Avdiyskiy et al., 2019; Galieva, 2011; Omarova, 2019; Current issues of risk management…, 2018].

1. No national standards of risk management and certain state policy in the sphere of risks management, which could allow increasing the level of risk culture at enterprizes in the country in general;

2. No legislative regulation of the risk management sphere. In Russia there exist requirements on risk management in the contest of corporative management, which are provided by the rules of listing of PJSC "Moscow Exchange MICEXRTS" and the Corporate governance code approved by the letter of Russian Bank, but these requirements are not enough as they cover only issuing companies. For the rest companies risk management system is not obligatory and is not legislatively regulated.

3. Lack of professional stuff in the sphere of risk management able to integrate the system of risk management into industrial companies’ activity.

4. Risk management at Russian enterprises has more of formal nature and is implemented for meeting the requirements of supervision bodies, but not for the real risks management.

5. Lack of understanding by chief executive officers of risk management importance for strategical stability.

6. Low level of risk culture at Russian enterprises, employees’ opposition to changes in the sphere of risk management.

7. No financial resources for complex risk management system implementation in Russian industrial organizations.

8. Companies have no units performing the risk management functions; that is why risk management has a spontaneous nature.

9. Adaptive style of risk management is peculiar for Russian companies. It means that risk management takes place only when they have already appeared and it is necessary to liquidate their consequences. Adaptive risk management approach cannot provide the strategical stability of industrial organizations; to make this it is necessary to implement the complex risk management approach, which allows to manage not only already existing risks, but also those which may appear in future.

To achieve the study goals we have conducted the questionnaire of industrial organizations in different sectors. Each company was offered to assess the significance of each barrier of complex risk-management system implementation under the 10-point scale, where 1 point – not significant, 10 – the barrier is highly significant. We have calculated the mean values of experts' assessment of barrier significance for complex risk management system implementation by each sector (table 7).

Table 7
Barriers to complex risk management system implementation of Russian industrial organizations (points)
Source: composed by the author

In such a way, in the course of the study we have revealed the most significant barriers to complex risk management system implementation at Russian industrial organizations:

• lack of professional stuff in the sphere of risk management;
• formal nature of risk management;
• lack of understanding by chief executive officers of risk management importance for strategical stability;
• low level of risk culture at Russian enterprises;
• lack of financial resources for complex risk management system implementation;
• lack of a unit performing the risk-management functions;
• adaptive style of risk management.

Mining mineral resources is the most developed among the industrial sectors regarding complex risk management system implementation, as mean values of barriers to risk management implementation is significantly lower;

Building materials production, cosmetics and pharmaceutical industries, furniture, pulp and paper industry belong to those sectors, where the mean values of barriers to complex risk management implementation exceed other sectors.

7. CONCLUSION

The study deals with several important aspects of risk management.

1. The levels of risk-management corporative culture were revealed: high, average and low. It should be mentioned that companies of the mining and mechanical engineering sectors had shown to be most developed regarding the level of risk management corporative culture. Companies involved in production of consumer goods, food and drinks, chemical and metallurgical sectors are attributed to companies with average level of risk-management corporative culture. To companies with low level of risk management corporative culture belong the enterprises in cosmetics and pharmaceutical sectors; building materials producing companies; furniture, pulp and paper producing companies.

2. There were defined and considered the levels of maturity of risk management implementation. Five levels of risk management implementation maturity were formed: absent, managed, quantitatively managed, optimized and advanced levels.

3. There were identified the main barriers to complex risk management system implementation in industrial companies, which allow defining the main company's issues in the sphere of risk management.

The presented study directions in the sphere of risk management are necessary for further improvement of methods for risk assessment and management in industrial companies, as they enable us to mark modern tendencies of risk management culture development and to define the main problems of the risk management process.