Risk identification approaches and the number of risks identified: the use of work breakdown structure and business process

The paper situates risk identification as a crucial first step in risk management, affecting success across industries and organizational types. Prior work underscores that many risk identification techniques are complex, require multiple participants, and can be subjective. The study introduces two practical, potentially single-practitioner approaches—business process (BP) and work breakdown structure (WBS)—and aims to determine which identifies more risks when controlling for contextual knowledge. The hypothesis is that the risk identification approach affects the number of risks identified, controlling for respondents’ knowledge of the context (accounting).

The authors review literature demonstrating the importance of risk management for value creation and performance, and note the centrality of risk identification in frameworks such as COSO and ISO 31000. Prior techniques (e.g., reinforcement learning-based proactive risk identification) can be complex and resource-intensive, and risk identification is often subjective and reliant on participant expertise. Business process-based approaches and WBS have been used in various domains for quality control, hazard analysis, safety planning, and project risk identification. Variations exist in procedures, and there is scope for practical, less complex methods that can uncover hidden risks.

Design: Experimental study with the number of risks identified as the dependent variable (Y), risk identification method as the treatment variable (X; three levels: BP, WBS, placebo/no treatment NT), and knowledge of context (C; accounting knowledge) as a controlled covariate. Sample: 86 business students from a top Indonesian business school were selected (convenience sampling), then randomly assigned to three groups (placebo, BP, WBS). Descriptive sample characteristics include 68% female, 32% male; most in the first semester. Table 5 reports N=28 per group. Interventions and procedure: - Placebo (NT): Read a short, common business case (accounting department context), act as accounting manager, and list as many relevant risks as possible. - BP group: Taught the business process approach before reading the case. Provided an answer sheet aligned to BP steps. - WBS group: Taught the work breakdown structure approach before reading the case. Provided an answer sheet aligned to WBS steps. After risk listing, all respondents completed a multiple-choice accounting test to measure contextual knowledge (covariate C). Risk identification procedures introduced: - Business Process (BP) approach (bottom-up): (1) Select a lower-level organizational unit; (2) Determine the unit’s objectives/KPIs; (3) List activities/processes to attain objectives; (4) Identify potential loss events (risks) in each activity; (5) Categorize risks first by activity; (6) Aggregate activities into functional categories. Treatment of risks occurs at the event level. - Work Breakdown Structure (WBS) approach (top-down): (1) Enumerate organizational functions; (2) Decompose each function into activities; (3) Map activities to organizational units; (4) Identify loss events (risks) per activity; (5) Ensure risks relate to the objective/KPI of the owning unit. Analysis: One-way ANCOVA (95% confidence) comparing methods on Y while controlling C; followed by Tukey’s HSD post hoc tests. Assumptions checked; no outliers or missing data were included in analysis. Eta-squared (η²) used for effect sizes.

- ANCOVA showed significant effects of risk identification method (F=12.72, p<0.001, η²=0.21) and knowledge of context (F=16.32, p<0.001, η²=0.13) on the number of risks identified. - Group means (Table 5): BP M=4.93 (SD=2.40, n=28); WBS M=3.14 (SD=1.58, n=28); NT M=2.46 (SD=1.32, n=28). - Tukey’s HSD pairwise comparisons (Table 4): BP vs NT mean difference=2.21 (SE=0.45, p<0.05); BP vs WBS mean difference=1.59 (SE=0.45, p<0.05); WBS vs NT mean difference=−0.63 (SE=0.44, p=0.34; not significant). - Magnitude: BP identified about 1.57 times as many risks as WBS and about 2.00 times as many as NT, on average.

Controlling for accounting knowledge, the choice of risk identification method materially affects performance. The BP approach significantly outperforms WBS and placebo, while WBS does not exceed placebo significantly. This supports the premise that a practical, structured, event-focused, bottom-up process that starts from unit objectives and activities helps reveal more (including hidden) risks than top-down decomposition. Knowledge of the context also meaningfully contributes to identification performance, consistent with prior literature. For practitioners, employing the BP approach can enhance completeness of risk registers, especially for uncovering non-obvious risks.

The study introduces practical, step-by-step procedures for two risk identification approaches and provides experimental evidence that the business process approach identifies more risks than the work breakdown structure or no specific method, even when controlling for contextual knowledge. This contributes actionable guidance for enterprise risk management practitioners seeking effective, single-practitioner-friendly techniques. Future research should test these approaches with organizational employees across sectors and compare against additional identification methods.

- Sample comprised business students from a single university; generalizability to working professionals may be limited. - Focus restricted to two identification approaches (BP and WBS); other methods were not examined. - The study context used a single business case (accounting), which may limit domain generalizability.