RISK ASSESMENT AND QUANTIFICATION IN MANUFACTURING ENTERPRISE

In this research first time in Latvia a multidimensional risk assessment is carried out in a manufacturing enterprise in the pharmaceutical industry according to the only international risk management standard ISO 31000:2018. The key multisided risks were identified and prioritized in the manufacturing pharmaceutical enterprise by applying the common metrics method: obtaining evaluations of risk occurrence and impact severity, made by the two highest levels of enterprise management, i.e. Board and senior line managers. A Top 10 of key risks was created from identified 64 different risks and the convergence and divergence in the risk rankings, evaluated by the enterprise’s Board and senior line management were obtained and analyzed. The main conclusion is that manufacturing enterprises in the pharmaceutical industry have specifics regarding exposure to multisided risks, where the main key risk is a regulatory risk and not different financial risks. Different rankings of enterprise operational risks, investment assessment risks, technological innovations risks made by the enterprise Board and senior line managers are signalling that exactly in these directions of the enterprise’s business activities it is necessary to review the strategic and operational planning with the aim to mitigate the potential risk impacts.


INTRODUCTION
There is no overall accepted definition of enterprise risk and enterprise risk management (ERM). The only international ERM standard ISO 31000:2018 (2018) defines: "ERM is a comprehensive and integrated system for managing risks, that helps an entity to meet its business tasks and achieve its objectives by minimizing unexpected profit deviations and maximizing the value of the business." Implementation of ERM in compliance with ISO 31000:2018 standard in industrial enterprises has started only after global financial crisis (2009) mainly in USA and is not widespread in Europe. There is no industrial enterprise in Latvia today, which has fully implemented ERM complying with ISO 31000:2018.
The risks to which industrial enterprise can be exposed are multisided (Hillson, 2016 Therefore a modern ERM has to be multidimensional (Lam, 2017a;2017b).

THEORETICAL APPROACH
According to ISO 31000-2018 the implementation of ERM consists of eight basic stages: 1.Stage -Establishing a risk context (What enterprise is trying to achieve in its business, exposing itself to impact of different risks?); 2.Stage -Risk identification (What kind of risks could affect enterprise in achieving its business objectives?; 3.Stage -Risk assessment (Which of enterprise parts (things, actions etc.) exposed to risks are most important?); 4.Stage -Planning risk responses (What enterprise shall do about the risks? ; 5. Stage -Implementing risk responses ( Haven taken action, did it work?) 6. Stage -Communicating about risk (Who and with whom in enterprise speaks about risks?) 7. Stage -Reviewing risk process (What has changed after risk impact?) 8. Stage -Learning lessons regarding risk (What has been learned regarding risk impact?) The organizational structure of ERM implementation process consists of four parts (Lam,

METHODOLOGY
In this research we have been concentrated on the second part of the whole ERM implementation process: risk assessment and quantification in manufacturing pharmaceutical enterprise. This second part is consisting of the following actions (Lam, 2017b):

26
-Identification of the key risks that can negatively hit enterprise business targets.; -Assessment of the key risks in terms of their probability to appear and the severity they can cause, by using common metrics approach.
-Prioritization of the key risks for its further analysis, quantification and mitigation.
To make these steps we have obtained information regarding different risk impacts on many business spheres of the pharmaceutical enterprise and compiled it in the single list of risks (risk register). After completing this we have made ranking of different risks inside risk register, based on the aggregated results of their potential impact. Each risk place in the ranking has been set as the combination of two main parameters: -Risk probability -with what a particular risk can occur; -Risk severity -how severe (big) can be potential impact from a particular risk.
Both parameters for each risk have been evaluated in the scale from 1 to 5 by : -Board members of the enterprise; -Board members plus senior line managers (directors of all departments of the enterprise).
The risk index was calculated by multiplying both parameters:

Risk index = Risk probability * Risk severity
The final values of key risk indexes have been calculated as the sum of indexes given by: -All Board members; -All Board members and all senior line managers.
To identify the key risks in the pharmaceutical enterprise we have used as the template one of the most developed risk model structure -the Protiviti risk structure model (The Protivity Risk Model..., 2008) ( Fig.1.).
We have created questionnaires to enterprise Board members and senior line managers regarding 64 different risks (taken from Protiviti risk structure model), which can impact the manufacturing enterprise in pharmaceutical industry and asked them individually to evaluate ( from 1 to 5) both risk probability and risk severity.
We have calculated common risk indexes for these 64 risks by applying equation (1) and then formed TOP 10 of the main key risks in the risk register of pharmaceutical enterprise.
To find out the possible convergences or divergences in risk assessment and quantification from two senior levels of enterprise management we have compared the results obtained from the enterprise Board members and from the senior line managers (department directors etc.).

RESULTS
The first part of results in identifying and prioritizing risks is obtained from the answers and evaluations provided by enterprise TOP management -all Board members (Fig.1.) These results clearly show that risks, which can impact the manufacturing pharmaceutical enterprise, are really multisided and they are consisting of: -Environment risks (regulatory, legal, customer wants), which by their nature are external risks; -Process risks ,which are internal risks and are consisting consisted of: o Operational risks (human resources, product development, knowledge capital, partnering); o Governance risks (planning). According to ISO 31000-2018 the impacts of all risks have to be calculated by applying the common metrics in financial means (Hutchins, 2018). However, our obtained results show, that the financial situation in this particular manufacturing pharmaceutical enterprise from the point of view of enterprise TOP management is strong and stable, while the Board is not ranking direct financial risks between TOP 10 risks (credit risk is only at 16th place).
The results of our research clearly show that the key risk in the pharmaceutical enterprise identified and prioritized by the enterprise's Board is regulatory risk (see Fig.1). This characterizes the specifics of pharmaceutical industry, where the existing pharmaceutical products have to be time after time reregistered by different state agencies and sometimes to be improved to align with changing regulatory rules and demands in particular country or countries. Moreover, for new products the procedure of their registration is even more complicated and is 100% depending on regulatory decisions. Therefore regulatory risk to certain extent matches with product development and planning risks, which are also in TOP 10 (Fig. 1.) The enterprise's Board has highly ranked also different operational risks (human resources, knowledge capital) (see Fig.1.). This means that Board is concerned about operational situation in the enterprise. The main obtained result from risk assessment and quantification in pharmaceutical manufacturing enterprise is that the key risk is remaining the same -regulatory risk in both cases of evaluation ( Fig.1 and Fig.2). This fact additionally emphasizes the specifics of pharmaceutical industry, where the manufacturing enterprises are very much exposed to risks coming from regulatory decisions in particular country or countries.
Results also show that enterprise's senior line management similarly to enterprise's Board is evaluating enterprise's financial situation as strong and stable, and therefore the direct financial risks (financial market risk, credit risk, liquidity risk ) have not been ranked between TOP 10 risks in both cases.
However, we have identified significant differences in risk assessment and quantification made by the enterprise's Board and by senior line management: -Line managers have ranked the investment assessment risk essentially higher (2 nd place) as Board members (12 th place), what could reflect that line managers, who are nearer to the situation on the ground , have expressed their position , that Board's made decisions about investment have already contained significant risks, and this could happen also in the future; -Board has identified between TOP 10 risks the enterprise's operational performance factors (human resources, knowledge capital), which have not even been included in TOP 10 by senior line managers. This shows that the assessment of enterprise's operational capacity, its efficiency is quite different on these two higher levels of enterprise's management, what could create problems in the future;

30
-Line managers have ranked enterprise's technological innovation risk, much higher (5 th place) as Board (20 th place). This shows that line managers, who are much closer to the different sides of production, sales etc. in the enterprise, are more concern about the necessity of technological innovation in the enterprise. The absence or delay in technological innovations could cause competitors risks, which line managers have ranked higher (3 rd place) as Board (8 th place).

CONCLUSION
The risks, to which a manufacturing pharmaceutical enterprise can be exposed, are really multisided: external (business environment risks) and internal (operational, governance risks).
The specifics of risk exposures in manufacturing pharmaceutical enterprises are that regulatory risk is the major key risk in pharmaceutical industry.
The financial situation in this particular pharmaceutical enterprise at the time of our research is enough strong and stable and the direct financial risks (credit, liquidity, financial market risks) are not ranked between TOP 10 risks by both senior levels of enterprise management.
Some convergence in risk assessment and quantification on both highest management levels in the enterprise demonstrates acknowledgeable common attitude regarding enterprise exposure to the main key regulatory risk.
However, the obtained divergence in the risk assessment and quantification regarding enterprise's exposure to the different type of operational risks, investment assessment risks, technological innovations made by enterprise's Board and senior line managers is signaling that exactly these enterprise's business processes and activities is necessary to review by making decisions in strategic and operational planning with the aim to mitigate the potential risk impacts in the future.
Results obtained from the risk assessment and quantification are not valid forever and according to ISO 31000:2018 this part of ERM has to be a permanent process to be performed on the regular basis with the objective to find out possible changes on the time scale.