Keywords

1 Introduction

The transportations systems are a very complex organizations composed of a wide array of infrastructures such as terminal facilities, travel ways, transportation fleets, and information systems. Such systems are decentralized and open, thus provide easy and reliable access for many users. As a result, transportation systems are exposed to many risks of external and internal nature [24, 25, 38].

Due to the negative consequences of such risks occurrence, it is crucial to recognize the sources of risks, helping to maintain continuity and timeliness of the transport process performance. Thus, transport companies should implement a risk management system and regularly carry out risk analysis, which is based on identification of potential hazards or situations or conditions that lead to threats. These risks are associated with the occurrence of events, both random and non-random ones [26, 42].

One of the most important problems in the area of risk management of any company is to acquire, maintain and aggregate data across diverse trading units. Thus, the design of an information system depends on a risk measurement methodology that a firm chooses [18]. Following this, there is a trade-off between the accuracy of the resulting measures of risk and the burden of computing them with the use of accurate IT technology [10].

Following this, in the article authors focus on the issues connected with risk management in road transport processes performance. The aim of the article is to analyse the problem of information needs that make possible a full risk analysis performance for freight transport companies. As a result, in the next Section, authors focus on the presentation of the issues on holistic approach in risk assessment for road transport companies. Then, there is provided a brief overview of the literature in the area of information systems and information needs for risk management performance. This gives the possibility to investigate the data reporting system being used in the chosen road freight transport company. The information system is analysed taking into account its usability in the area of full risk assessment process performance. The article concludes with a summary and guidelines, including directions for further research.

2 Holistic Approach in Risk Assessment for Road Transport Companies

Currently, there is no one, unified and commonly used definition of risk term [6]. We can even state that the underlying concepts of risk are hard to define and even harder to assess [22]. In recent decades, we have observed this term being applied to many research areas, like decision theory, management, emergency planning, or critical structures operation, including transport systems performance [41]. The historical development trends of risk concept are discussed e.g. in [3, 6]. The risk perspectives review and discussion are given e.g. in [5, 7,8,9].

One of the most often cited risk term definition is given in PN-ISO 31000 standard [31], where risk is defined as effect of uncertainty on objectives. A brief summary of classification of risk definitions is given e.g. in [6, 19]. Based on this, the same standard defines risk management as coordinated activities to direct and control an organization with regard to risk. The developed definition is very general. Thus, in order to effectively manage any organization, the new concept is introduced and promoted - Enterprise Risk Management. One of the most popular definitions of Enterprise Risk Management concepts (ERM) used in the literature is the one provided by COSO II standard. According to COSO II standard [13] Enterprise Risk Management is defined as a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. According to COSO II, an organization’s ERM system should be geared toward achieving the following four objectives: (1) Strategy: high-level goals, aligned with and supporting the organization’s mission. (2) Operations: effective and efficient use of the organization’s resources. (3) Reporting: reliability of the organization’s reporting system. (4) Compliance: organizational compliance with applicable laws and regulations.

The proper implementation of ERM conception also influences the risk assessment processes being performed in the chosen company. The risk assessment is an essential and systematic process that is a part of risk management which aims at identifying, assessing the risks and planning the actions to deal with the risks [36]. However, there is a diversity in risk analysis procedures and techniques that may be used in this area (for review we recommend reading e.g. [4, 16, 21, 28, 29]).

Referring to the previously presented definitions and taking into account the process perspective, the starting point for risk assessment performance should be to identify threats that may be the cause of failure to achieve the objectives in the passenger transportation services performance. A holistic approach assumes that the area of analysis will cover different levels of performed process, like e.g. technical elements, human resource, as well as legal and organizational issues. Risk assessment should therefore be preceded by a process analysis that allows identifying potential adverse events. The risk assessment is usually performed only at certain time points. The main challenge in this field is assessing all the risks in a system or organization what is determined by the proper information system support. Having timely information is a key issue to an effective ERM program and risk assessment performance.

Research conducted by the authors clearly show that for the transport company management processes, the current risk assessment models used in the area of transport processes performance are insufficient [42]. During operational business performance, the managers are exposed to the presence of various risks, which are different than those described in the scientific research. For the purposes of decision-making processes, it is necessary to build a model of a risk assessment taking into account the process approach, consistent with the concept of Enterprise Risk Management. This problem is also underlined in the current EU research projects focused on road transport networks security issues. The short overview of the current EU-funded research into transport security is presented e.g. in [12]. One of the interesting research projects is the SERON project [43]. This project is focused on the investigation of the impact of possible manmade attacks on the transport network (see e.g. [23, 43] for more information).

Proposed process approach, in accordance with ISO 31000 standards, implies a holistic approach to risk assessment in the company. This means that the identification of potential hazards is done by the way of a process analysis, which includes the analysis of used resources (elements at the input to the process), the course of the process and the expected final result. Process approach also assumes that the process is carried out in a certain environment, which affects its performance. For this reason, the sources of potential hazards are identified as both internal and external ones. Thus, the risk assessment takes into account financial, technical, informational, social and organizational issues.

In the case of road transport companies, the performed risk analysis is focused on the identification of the maximum number of possible adverse events, which may accompany the two defined above performed processes. The defined procedure involves the evaluation the main steps shown in Fig. 1.

Fig. 1.
figure 1

Risk assessment procedure for road freight transport companies

Full size image

In the case of a transport company providing services at international transport level, the risk assessment should be carried out for each direction of the movements separately. This is due to the fact that each export or import freight transport to defined countries is connected with the occurrence of general hazard events and specific risks associated with a particular direction. Not taking into account the specific nature of transport process performed on the given direction and reducing the risk assessment to the general level for all the movements, significantly reduce the complexity of the analysis and reduce its effectiveness. This will decrease its usability in managers decision-making processes by providing information needs are not fully met. The more detailed analyses, however, generates the need for more comprehensive knowledge base accumulated in the company and sets specific requirements for the reporting system. Following this, in the next Section, the comprehensive literature review in the area of information systems developed for risk management performance is given. This gives the possibility to define the basics for data reporting system for the needs of risk assessment in the selected road freight transport company.

3 Information Systems for Risk Management – Literature Review

The issue of the role of information systems in risk management is widely discussed in the current literature (see e.g. [17] for the review).

The problem of designing an information system for risk management is connected with providing managers with the data they need to make a proper business decisions. Currently, most managers want four things from their risk management information systems [17]: (a) calculate value at risk; (b) perform scenario analyses; (c) measure current and future exposure to each counterparty; (d) give the possibility to aggregate information across various groups of risks, product types, and across subsets of counterparties. The detailed risk management guide that investigates the main requirements in the area of properly defined information systems is given in [37].

Currently, widely analysed in the literature is a complex solution for effective risk management performance that regards to RIMS implementation. According to [15], RIMS is as a technology system that enables to capture, manage and analyse all organization’s risk and insurance data in a single, secure system. This solution is generally introduced in an insurance sector (see e.g. [18, 34]). Other research area regards to security risk management being focused also on the reliability and safety of stored data. The issues of information systems security risk management are overviewed in work [1], and the effectiveness of safety management systems is given in e.g. [40].

Moreover, the evolution of information technologies that will provide organizations with sufficient and reliable data in these fields is discussed in [30].

The current knowledge on the issues of risk and safety in the transport sector is reviewed in work [33]. Authors in their publication mostly focused on the safety issues in the transport sector and provide the introduction to the RISIT (risk and safety in the transport sector) research programme performed in Norway. However, the conclusions are more general and regard to any transportation system. Authors underline that little research has been done in this area, and a number of research subjects should be considered, including the information systems effective designing and implementation.

Information issues of risk and safety management in the transport sector mostly regard to the supply chain management (see e.g. [11, 20]), public transport performance (see e.g. [14]), or information safety (see e.g. [14, 35]). In [11] authors focus on LNG transportation systems vulnerability and resilience analyses performance. They focus on marine LNG transportation system taking into account the possibility of quantitative data about the cost of disruptions and the effects of mitigating measures. The problem is also analysed in [2], where authors also focus on marine transportation industry and discuss the possibility of ERM conception implementation. Later, in work [20], authors investigate the scope of information systems dedicated for transport logistics.

The public transit in the view of cybersecurity considerations is the authors’ topic of interest in recommended practice report [14]. In this work authors underline that control and management systems are dependent on information technology what causes their vulnerability to increasingly sophisticated direct and indirect cyberattacks. Following this, in the next work [35] authors describes a plan for improving industrial control systems cybersecurity across all transportation modes: aviation, highway, maritime, pipeline, and surface transportation. The main assumptions given in this plan are also satisfied e.g. in works [27, 32, 39, 44, 45].

Taking one step further, in the risk management concept the main role takes an undesired event occurrence. More detailed analysis requires also description of type of hazard, cause, consequence and way of removing the problem. In this approach, due to freight transportation system one may recognize:

  • hazard – possibility of developing an undesired event,

  • undesired event - not completing transportation task or delay greater than acceptable by a customer, any charm influencing freight/driver/environment in a negative way (e.g. health injury),

  • risk – possibility of running a hazard expressed by frequency of undesired event over given period or travelled distance multiplied by amount of losses.

Measures of undesired event relate to:

  • measure of possibility- frequency over given time of developing an undesired event,

  • measure of losses- mean number of fatalities regarding to undesired event, degree of disability, time of delay, monetary equivalent for lost time or delay or equivalence of not gained profit because of not completed transportation task.

In the approach described in the paper, the following variables are expected to collect:

  • date and time of an event, mileage, number of cycles, total transported goods since the previous event, etc.,

  • place of an event, terrain topography,

  • elements of transportation system and infrastructure taking part in the event, relations to other transportation systems,

  • number of casualties other losses (fatality, injuries, number of people delayed),

  • duration of disturbances for traffic: direct (closing a road), indirect (detour),

  • event consequences, loss of properties, loss of transportation mean, loss of technical infrastructure and environment,

  • event cause,

  • way of repair, clear away consequences.

Reliability and safety data concerning regional or national transportation system may be obtained at various levels of management. The highest level of administration provides general assessment of safety in form of reports or statements usually issued yearly.

According to road transportation there are several data sources, though data are processed and concerns statistical image of the process. The main are presented below.

Reports issued by Polish Police are ordered in months and years, concerns state regions, road users, distribution of accidents due to time, terrain, cause, consequence and severity (victims).

The national program concerning life protection of road users GAMBIT exists since 2001. Now it was introduced GAMBIT 2020 with main target as decreasing in half number of victims until 2020. Program GAMBIT is operated by State Board of Road Safety. This institution also announces annual and half-yearly reports covering cross sectional analysis of accidents and actions undertaken on road safety improvement.

Web service of GDDKiA (General Headquarters of Polish Roads and Highways) provides information about local traffic restrictions and disturbances, like road building and rebuilding or road and infrastructure failures.

State Fire Service collects data concerning all rescue actions involving fire brigades. Data are collected in form of very precise data base. Application of these data to reliability and safety assessment is possible after processing and being restricted to events developed in transportation system.

However, based on the given databases it is very difficult to achieve description of single accident to perform investigation directed on cause-consequence analysis that is valuable in reliability and risk/safety approach. In many cases data are fragmentary and do not provide important variables. Value of data is continuously improved but unfortunately very often still not credible due to reorganization and bad quality of informatics’ system regarding data exchange.

The presented databases are the external sources of information. In the next Section, authors focus on the data reporting system that stores the main internal data being necessary for risk assessment performance in the selected road freight transport company.

4 Data Reporting System for the Needs of Risk Assessment in the Selected Road Freight Transport Company

The main processes analysed in a transport company can vary greatly depending on, among others, the type of carried cargo, the entity performing the carriage, the required security of cargo, route. The data reporting system should take into account all the parameters of the process that requiring registration for future risk assessment. The scope of this article does not allow carrying out a detailed analysis of all cases to be assessed. For this reason, the presented results are limited only to the analysis at a general level, concerning risk factors of a universal nature that may arise in the implementation of each type of transport.

Data reporting system should be implemented to enforce data entry on a regular basis before, during and after the completion of the process. However, this caused the pressure on employees to shorten the time for data registration. Thanks to the IT tools used in a company, the reporting process should be automated as much as possible. However, this requires the prior definition of parameters that describe the processes, determination of the rules of their order, and above all, the collection of data in an electronic database (currently some of the information are the know-how of individual employees).

It is extremely important to organize data collection process in order to improve the further analysis performance and the proper distribution of results. Suitable systematization of the administered data should be performed in accordance with the accepted classification rules. For transport companies, the authors suggest the following groups of defined data for risk assessment performance: data (a) relating to drivers, (b) relating to freight forwarders, (c) relating the traders, (d) relating to subcontractors of transport services, (e) relating to customers, (f) regarding the vehicles, (g) relating to the implementation of the process, (h) relating to finance, including costs and revenues. The use of such classification allows for easy and non-confrontational assignation of responsibility for the collection of individual data by company’s departments (Table 1).

Table 1. The main group of gathered data with assigned departments being responsible for their collection
Full size table

The analysed company provides transport-forwarding services, mainly in road transport. It operates the cargo loads transported both in the domestic and international distributions. Currently, the company has 70 own vehicles, which are used primarily to serve regular customers. At the same time, it cooperates regularly with selected smaller carriers. The carriers are outsourced to other regular services (those that cannot be operated with company’s own fleet) and all additional appearing orders, usually of single nature. In the situation of inability to perform emerging additional orders by regular collaborators, such transports are subcontracted to other carriers, usually acquired through the freight exchange. The company belongs to the SME sector, but in the last three years one can observe its intense development. As a result, the carrier has enjoyed steady growth in participation in operated markets, accompanied by expansion of the organization.

With the development of the company, the Management Board saw the need to implement the risk management system. The first step in the implementation of this concept has become a verification of the existing reporting system and its evaluation in terms of the complexity of the supplied data, required for the risk assessment process performance. Currently, the company uses a dedicated class software TMS (Transportation Management System), but the Management Board is aware that not all information is recorded in this system. The reason is connected with the lack of appropriate procedures and limited measurement system, currently used to assess the effectiveness of the performed processes. Moreover, the current employee incentive system does not take into account the quality of the reported data.

On the basis of the conducted observations and accompanying interviews with senior managers in the audited company, there was defined the need for information to support the risk assessment process for freight forwarding activities and transport. Required data are grouped according to the classification rules and are shown in Table 2. At the same time, these data are ranked under heading of:

Table 2. The main data required for risk assessment performance in the analysed company
Full size table

  • the degree of control (control level) of the unwanted event occurrence described by the value (1 - lack of control; 2 - partial control; 3 - full control) - conducted grouping will impose further path for the risk assessment procedure performance,

  • nature of the data (nature), defining their use in the process of analysis (quantitative data (I) and non-quantitative (NI)). Quantitative data will serve to estimate the possibility of the adverse event occurrence likelihood, but also the estimation of its consequences. They are used for quantitative analyses and measurements associated with risk assessment performance. Non-quantitative data are primarily used to define the causes and consequences of the event occurrence.

Then, on the basis of the performed preliminary analyses, there is defined the current level of reporting system in the field of required data supply. The evaluation concerned the scope of collected data and the form of their registration. The data collection was assessed in a 3-point scale (the scope): 1 - not available, 2 - limited/insufficient number of data, 3 - range adequate to the needs. Registration forms are structured as follows: (a) complete knowledge database (BWS) – whole recorded currently in the database, regularly updated, standardized and reliable data; (b) relative knowledge database (WWS) - data entered into the system, but no indication of the person responsible for taking care of them, not standardized form of recording, unreliable; (c) employees knowledge database (WP) - data collected by individual employees, recorded in their notebooks or even unregistered, usually withheld to other employees without a clear order.

The analysis of the information needs defined 40 positions that require registration in the knowledge database used for risk assessment performance. The evaluation of the currently operated data reporting system showed that: (a) in the case of 10 data items, the necessary information are not collected currently, (b) in the case of 18 items, the data collection is insufficient from the point of view of the risk assessment performance, (c) only in the case of 12 items, the data collection is satisfactory from the managers’ point of view.

At the same time, it was found that the current form of the data collected is unacceptable from the point of view of analytical work performance. The complete knowledge database (BWS) is only valid in the case of data, the scope of which is satisfactory. They are at the same time the only data that meet the standard required in the risk assessment process. However, even in the case of this group of recorded data, there are 2 data positions that are occasionally entered into the system and they are unreliable. In the case of 2 other data positions, the data are collected only for the needs of the individual employee (no registration in the system). While incomplete data (called at level 2) are the knowledge of individual employees and in their case, information that are already registered in the system do not keep the required quality and reliability level.

5 Summary

The evaluation of the current data reporting system in the audited company has proven that the current scope and format of the gathered data do not meet the standards required for a knowledge base created for the purpose of risk assessment process performance. The company, in order to implement the concept of risk management for their operational business firstly is forced to make improvements in the current reporting data process. Defined by the managers the data that corresponds to their information needs, must be strictly recorded in the system supporting the activities of the company. The first stage has already been completed. The required data were organized and there was assigned the responsibility for their gathering process to the various organizational units. The evaluation of the scope and form of the gathered data showed gaps which currently exist and require immediate supplement. For this purpose, it is necessary to develop reporting procedures and links them with the employees’ incentive system. Only such a labour organization will provide the validity and reliability of the data entered into the system.

The results presented in this paper are the part of a research conducted by the authors and connected with the development of risk management model dedicated to road transport companies. The authors’ further research works will be focused on the adaptation of TMS systems to the needs of risk assessment processes performed in the transport companies.