1 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) ISSN (Print) 2313-4410, ISSN (Online) 2313-4402 © Global Society of Scientific Research and Researchers http://asrjetsjournal.org/ Application of Risk Management at an Ecuadorian Electric Company Eva Merchán Corderoa*, Diego Ponceb a,bUniversity of Cuenca, Av. 12 de abril s/n and Agustín Cueva Street, Cuenca and 010101, Ecuador aEmail: evamerchanc@hotmail.com bEmail: diego.ponce@gmail.com Abstract Risk management is an administrative tool that, through a comprehensive and systematic approach, promotes continuous improvement, efficiency and effectiveness, allowing organizations to make decisions and control uncertainty in relation to the assets that are most exposed. The objective of this technical article is to expose the knowledge and experience gained in the application of ISO 31000 Risk Management in the Empresa Eléctrica Regional Centro Sur C.A. (Centrosur), which by offering a public service is exposed to factors and influences internal and external that jeopardize its objectives. Given the multiple differences between the companies and the risks to which they are exposed, it is not possible to make recommendations that are universally accepted, in this sense; this article will become important as long as it is interpreted as a guide for those who are immersed in an implementation of ISO 31000 Standard. Answer the questions where am I with respect to risk? and what resources are available to adapt the organizational culture to ISO 31000 ?, involved the use of research methods such as surveys and direct observation, resulting in the identification of gaps, a necessary input for the development of an architecture (principles, management framework, risk management and treatment process) for risk management fully adapted to the institutional reality. In order to make the architecture presented as integral, consistent and sustainable over time, strategic components were incorporated, leaving aside informal and heterogeneous practices present in the organization. Keywords: Risk management; ISO 31000 recommendations; ISO 31010; Implementation of ISO 31000; Adaptation of ISO 31000. ------------------------------------------------------------------------ * Corresponding author. http://asrjetsjournal.org/ American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 2 1. Introduction Empresa Eléctrica Regional Centro Sur C.A., Centrosur is an Ecuadorian company that offers a public service related to the distribution and commercialization of electricity for the provinces of Azuay, Cañar and Morona Santiango. It is governed by state policies that seek to expand its system to meet the demands of electricity service with quality levels, in order to enhance social welfare, industrial and technological transformation [1]. Every activity involves a degree of uncertainty that can affect its normal development, provoking a positive or negative deviation effect; effect that can have repercussions of varied connotations: economic, political, legal, environmental, etc. Under this premise it is recognized that Centrosur is exposed to internal and external factors and influences that may risk its objectives, being necessary to manage them with methodologies of proven trajectory. Although there are several risk management frameworks, there is not specific methodology that fits the needs of the electricity sector. The current legal regulations [2] applicable to Centrosur, directs towards the use of ISO 31000 Risk Management; norm that by its generic character empowers the adaptation to the reality of each organization [3]. The contribution of this study is to make known the experience gained in the implementation of ISO 31000 in an institution of the Ecuadorian electric sector, which led to the design of a systematic and comprehensive for risk management architecture. Architecture that was fully adapted to the context of Centrosur by means of the implementation of: the principles, the management framework, risk management processes, and risk management treatment process. Additionally, it is hoped that this case study will serve as a reference for organizations and future implementers of ISO 31000, both for the proposed architecture and for the reference to the difficulties encountered in its initial implementation and the way in which they were solved. 2. Materials, methods and results Knowing the current organizational culture, related to the risk, is fundamental in the definition of gaps with respect to the ISO 31000 Standard. For that reason research processes were used corresponding to the methods of survey and direct observation that provided light on the current state of Centrosur. Using the method of direct observation on reliable documentation as contained in the Manual of processes and procedures [4], it was possible to determine the absence of a risk management policy in Centrosur. On the same source of data of the previous paragraph and using the method of direct observation was established if of the total (40) of the macro processes and processes in force explicitly registers the risk management. The quantitative data processing consisted of the separate summation of macro processes and processes in which the risk management was explicitly mentioned and by means of a rule of three converting that value to a scale of 100. The observation was made by two different people and data processed in a spreadsheet. The results of Table 1 determined that in Centrosur both in macro processes and in processes there is no explicit record of practices in American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 3 which risk is managed. Table 1: Macro processes and processes of Centrosur, in which risk management is considered Type of document Total documents Percentage Macro processes 5 0% Processes 35 2.9% Using the survey technique with a margin of error of 10% and a confidence level of 90%, and a population of 605 workers, the technique was applied by means of software to a sample of 61 staff from Centrosur randomly chosen, and giving answer to: • To determine the use of formal and informal practices with which the risk is managed, • If there are formal practices, establish what methodologies are used, • Know about the existence of a study that identifies threats and opportunities (Yes, No), • Identify what approach the Administration promotes in risk management (none, preventive, detective, corrective, preventive – corrective, preventive – detective –corrective), • Determine the use of indicators for risk monitoring (Yes, No), • Establish the level of knowledge (Very well known, Little known, Unknown) on the 31 tools proposed by ISO 31010 for risk assessment. The processing of the answers was done automatically, adding up the answers that have coincided and then using a rule of three this value was converted to a scale of 100. The results in Table 2 show that 96.7% of its workers manage the risk; of them only 34.4% manage them based on a practice of proven trajectory record, while 62.3% run it without a methodology. Table 2: Methodologies applied by Centrosur in relation to risk management Methodologies used for risk management in Centrosur Percentage COSO 3.3% Risk management according to PMBok 19.7% ISO 14001 6.6% ISO 27001 4.9% Without methodology 62.3% The risk is not managed 3.3% The table 3 shows that 86.4% of risk management is carried out in an undocumented or informal manner. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 4 Table 3: Type of practices, formal and informal, related to risk management by Centrosur. Type of practice Percent Formal 13.6% Informal 86.4% All staff surveyed stated that there is a risk management approach, of which 48% indicate that the approach is Preventive-Corrective, 26% indicates Corrective, and 23% is Preventive-Detective-Corrective action at the same time, as shown in Table 4. Table 4: Perception of the approach to risk treatment applied by Centrosur Perception of the approach to the treatment of risk by Centrosur Percent None 0% Preventive 3% Detection 0% Corrective 26% Preventive - Corrective 48% Preventive - Detective - Corrective 23% Table 5 shows that only 13% of the respondents use indicators to monitor their risks. Table 5: Risk monitoring in Centrosur through the use of indicators. Use of indicator in Centrosur form the monitoring of the risk Percent Yes 13% No 87% On the tools provided by ISO 31010 for risk assessment, it can be deduced, based on the data in Table 6, that more than 51.6% of the techniques are totally unknown in Centrosur and that 29% of them can be used Table 6: Degree of knowledge of ISO 31010’s tools in Centrosur. Degree of knowledge of ISO 31000 tools in Centrosur Total tools Percent Very well known 9 29.0% Little known 6 19.4% Unknown 16 51.6% American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 5 The direct observation technique was used by the author in determining difficulties throughout the implementation process and recorded through a special form called "lessons learned", which will be discussed later in chapter 5. 3. Theoretical framework 3.1. ISO 31000 Risk Management Standard The ISO 31000 Risk Management Standard is a tool that, through high level principles and guidelines, allows the risk management in an organization of any type, giving a comprehensive and systematic approach. This standard considers risk as the effect of uncertainty on organizational objectives, regardless of whether this uncertainty corresponds to events favorable or unfavorable to the organization, or whether these come from internal or external sources [3]. The figure number and caption should be typed below the illustration in 10pt and center justified. Figure 1: ISO 31000 provides architecture for risk management, through the relationship between: the principles, the framework and the process for risk management. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 6 The ISO in 2009 proposes architecture based on 11 principles, a management framework and the process for the risk management as can be seen in Fig. 1 and that, by its generic nature, the same Standard expresses in its Clause 1, opening to changes in light of the specific needs of each organization. ISO developed a family of Norms in relation to risk management, which is composed of: • ISO 31000:2009 Risk management – Principles and guidelines • ISO Guide 73:2009 Risk Management –Vocabulary • ISO 31010:2009 Risk management – Techniques and risk assessment 4. Design of an architecture for risk management For the case study, the proposed design is based on the architecture of the ISO 31000 Standard, thus guaranteeing all the benefits of a proven standard and enhancing them with the incorporation of new components adapted to the needs of an institution in the sector Ecuadorian electric, as is Centrosur. Figure 2 presents graphically the proposed architecture, adequate to the organizational reality of Centrosur. Principles: It corresponds faithfully to the 11 principles determined by the ISO 31000 Standard [3] as shown in Fig. 1. Centrosur's risk management framework: It provides guidelines that enable risk management throughout the organization, ensuring its adaptability, consistency and permanence over time, as well as its efficiency and effectiveness through the following components: President's intention and gap identification: The way to the implementation of the risk management framework in Centrosur begins with the initiative by top management to opt for a management tool to improve their competitiveness through better knowledge and Management of its risk portfolio, and needs to have its favorable opinion in order to gather information on the existence of formal and informal risk-related practices that take place within the organization in order to identify existing gaps with respect to indicated by the ISO 31000 Standard. The study of gaps, despite being an initial implementation, allows top management to have a diagnosis of the organization and to commit to this project knowing the real responsibility that their commitment entails (creating an organizational culture that contributes for risk management, policies, budget, resources, etc.), in addition to identifies approaches or practices that must remain intact, those that must face changes and those that must be eliminated from the organization. The analysis of gaps for Centrosur made it possible to determine, among the aspects that can be published without causing risks to the institution, the need for a risk management policy linked to ISO 31000, the documentary record of its management, the Monitoring and control through indicators, and the treatment of risk through an approach by: anticipation-detection-correction for each risk. In relation to the tools provided by ISO 31010 for risk assessment the existing knowledge gap is important, however it is not necessary for the personnel to know all of them, therefore it can be started with the ones that they currently know, although homologating their use. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 7 Figure 2: Customization of the architecture of the ISO 31000 Standard for risk Management in Centrosur through: principles, risk management framework, risk management process, and risk treatment process. Strategic approach: It seeks to establish a strategy for the implementation of risk management that is consistent and sustainable over time. Centrosur strategy is based on the 7S model [5] as can be seen in Fig. 3, based on an institutional diagnosis and the identification of the “stakeholders” and their interests American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 8 Figure 3: Basic factors for a consistent implementation strategy for risk management in Centrosur, based on the Model 7S. The implementation of the strategy was set out in two stages: i) the first involves the preparation of the ideal environment for a risk management framework; ii) the second stage is the execution of the risk management process throughout the company, making use of the tools, processes and documents defined in the first stage, with an annual goal of updating 33% of institutional processes and 100% of all new activities being developed, as can be seen in Fig. 4. Figure 4: Implementation strategy of the ISO 31000 standard for risk management in Centrosur American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 9 The strategy must be authorized by Management, evaluated and updated when it does not meet the stated objective, or when a change in the organizational environment justifies its revision as part of the continuous improvement process. Organizational context: It is to understand those elements, internal and external, that affects or could affect the achievement of its objectives [3]. This analysis in Centrosur following documentation was used: Strategic plan, Identification of “stakeholders” and their interests, Legal and regulatory framework, Organizational policies and processes, Labor climate, Function Manual, List of programs and strategic projects, risk map, If any, List of gaps in relation to ISO 31000, among others, to which it was used the tools: FODA1, PESTEL2 and expert criteria were used in order to define the organizational context. Management and commitment: The guidelines and commitment of top management must be reflected in the risk management policy [3]. The content of Centrosur’s policy was determined in relation to: a) Objective of the policy and its scope, b) To guarantee compliance with legal and regulatory requirements, c) To determine the methodology for risk management, d) Integration with the processes of the organization, e) Definition of the criteria of importance and treatment of the risk, f) Roles and responsibilities of the work team for risk management, g) Use of tools for risk management, h) Training And incentives to staff, (i) Ensure the delivery of resources, (j) Tools for communication and consultation, and documentation, (k) Define criteria for continuous improvement. Planning: This component plans the necessary actions for the implementation of risk management [3] based on the elements defined in the policy, as well as the incorporation of the results of the study of gaps, related to the Approaches that must be created, modified and eliminated. This component is referred to in the ISO 31000 Standard as Design of the framework for risk management. Do: The objective of this component is to implement the previously planned, both for the management framework and for the risk management process [3], whether it corresponds to an initial implementation or product of continuous improvement. In The ISO 31000 Standard this component corresponds to Implementation of the framework for risk management. Verify: Compare planned with actual action; its purpose is to direct attention to what is considered of most interest by the organization [6]. Centrosur’s indicators were defined for the management framework as well as for risk management and treatment processes, as well as for assessing whether risk management is of high performance3. This component is nominated by the ISO 31000 Standard as Monitoring and Reviewing the Framework. 1 FODA is a tool used to study an organization based on its Strengths, Opportunities, Weaknesses and Threats, or also know by his acronyms as SWOT. 2 PESTEL is a tool used for the strategic study of an organization based on the factors: Political, Economic, Social, Technological, Environmental and Legal. 3 A high-performance risk management allows us to determine whether the organization has a correct and complete understanding of its risks and if the same remain within the tolerance criteria (ISO, 2009). American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 10 Act: The results of the verification stage determine whether the execution of a planned event is giving the desired result, otherwise an improvement plan should be developed [6]. For Centrosur, the documentation from which this analysis corresponds to: organizational context statement, monitoring results, both the framework and the risk management process and final risk audit report, which together with tools and techniques such as interviews, surveys, technique What if?4 , According to experts, will allow to determine the improvements that are pertinent. This component is called by the ISO 31000 Standard as Continuous Improvement of the Reference Frame. Risk management process: The ultimate goal of any implementer is to manage the risk on the daily action of your organization, regardless of the deviation effects that occur. For this purpose, the ISO 31000 standard uses the cyclic process, consisting of: Establishing the context of the organization, Risk identification, Risk analysis, Risk assessment, and Risk management, keeping constant communication and consultation, as well as monitoring and review with each of the process components [3]. For each of the components of the process it is possible to rely on more specific norms, as well as on its implementation guides, which bring light to risk management; By way of example, it may be pointed out that ISO 27005 provides: a list of threats and vulnerabilities, controls to be used, recommendations of tools and techniques [7]. Centrosur’s risk treatment process: The risk treatment proposed in Fig. 2 implements appropriate strategies and methods to ensure that each risk is maintained within the tolerance criteria of the organization, may include: acceptance of risk for its continuous monitoring, creation or modification of risk controls in a profitable way, avoid the risk or to enhance it according to its connotation. Identify risk treatment options: It consists of generating a list of practical initiatives about the controls considered as an option to treat the risk, and identify the objective that is pursued with each one of them: to avoid the risk, to change the probability, change the consequence, or increase the opportunity. For Centrosur, the initial documentation to fulfill this task corresponded to: a) Risk in question, b) risk management policy (risk treatment criterion), c) context of risk, d) lessons learned from similar projects, and by applying tools like: brainstorming, checklists, interview, survey, cause and effect diagram, technique what if?, judgment of experts, allowing to obtain a registry of options of treatment of the risk. According to the good practices of risk audit, the implementation of controls should have an approach that allows anticipating, detecting and correcting risk, preferably with a high degree of automation [8]. Select the options for the treatment of risk: Selection must take into account profitability criteria, comply with the requirements and expectations of the “stakeholders”5, and compatibility with the external environment, including legal, regulatory, social, environmental and cultural elements [6]. In Centrosur, the basic information for this selection corresponded to: a) keep a record of options for the treatment of risk, b) requirements: legal, regulatory, quality, stakeholders’s criterion, c) available resources, d) budget. Use tools such as: expert 4 The technique “What if?”, allows the identification of risks by means of the scenario scenarios that answer this question. 5 Stakeholders: Person or organization that may affect, be affected or perceive itself as affected by a decision or activity (ISO, 2009). American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 11 judgment, bow tie analysis6, technique what if? allowed to keep a record the reasons to select or reject an option. Prepare a risk management plan: The objective is to chart the sequence of activities to be carried out in order to control the risks, including secondary risks as a result of the treatment of the original risk. A carefully detailed plan allows simpler implementation with less uncertainty. For Centrosur, the enabling documentation corresponded to: a) selection record of risk treatment options, b) risk management policy (risk treatment criterion), c) internal and external context and list of “stakeholders”, d) list of requirements to be met, (e) list of constraints (time, cost, resources), and in set with the use of tools such as brainstorming, checklist, interview, cause and effect diagram, what if?, schedule and cash flow, allowed to obtain the detail required in the planning (requirements, constraints, assumptions , schedule, budget, indicators). Implementing the risk management plan: In Centrosur, the success of the implementation consisted of carefully executing the previously detailed plan and remaining alert to situations that could go unplanned, such as secondary risks. Monitoring and review: Monitoring and review is applicable to the whole process and focus on Centrosur, it has been placed on the effectiveness of the implemented controls as well as the identification of the secondary risks that may occur with its implementation. The enabling documentation corresponded to: a) risk management policy (indicators), b) identification of the original risk and its context, c) registration of the plan for risk treatment, d) implementation schedule of the plan and its progress, e) original budget f) projected and executed cash flow; g) secondary risks (analysis, evaluation and treatment) that together with the tools: inspection, checklist, interview, survey, expert judgment, allowed to record what was acted out and what stopped acting. Communication and consultation: Communication and consultation with the stakeholders in each of the phases of the risk treatment process is essential, allowing communication and consultation on the options for risk treatment, selection, planning and execution, as well as such as the results of monitoring and review [6]. In Centrosur keeping in mind the delicacy of the information that is handled, the communication and consultation must be properly planned and executed, leaving evidence of the action. The enabling documentation corresponded to: a) context of risk, b) risk management policy (communication and consultation plan), c) implementation schedule, d) result of the analysis of risk management indicators, e) monitoring of the risk treatment plan; f) monitoring result of the treatment of risk; g) several points of consultation. 5. Solutions to difficulties present during initial implementation When implementing the ISO 31000 Standard, companies find difficulties that focus on the initial implementation and its maintenance over time [9]. The difficulties presented at start Centrosur's implementation were solved as follows: 6 Bow tie analysis is a method of risk analysis that represents the relationship between causes and consequences of a risk, obtained at http://www.criptored.upm.es/descarga/Bow_tie_CarlosOrmella.pdf American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 12 Source of information: Acquiring the ISO 31000 Standard as the only source of information was not enough to achieve an adequate understanding of how to move from concepts to practice. In this aspect, the acquisition of additional bibliography recommended by ISO was very useful; this case was acquired ISO 31000 Risk Management - Practical Guide for SMEs [6]. Taking into account that the book is originally from Switzerland where an organization is classified as an SME (Small and Medium Enterprise) when its balance is in the range of 2 and 43 million euros [10], values in which the Centrosur adjusts. Validation of tools: The use of risk assessment techniques corresponds to those specified by ISO 31010, ranging from well-known and employed in the institution until totally unknown. In this sense it was decided to propose easy-to-use tools until the methodology of risk management is understood throughout the organization, and then the decision is made to evolve in the chosen tools. Risk importance criterion: At the time of defining the criterion of importance of risk, the Standard expresses the use of a combination of consequence and probability, leaving the organization the decision and form of application; much of the published documentation expresses it as Consequence X Probability; however, makes the important observation that "combining [outcome and probability assessments] and multiplying them will produce unreliable or illusory results ..." [13]. In which risks that require the greatest supervision and control by the magnitude of their consequences can be set aside. Table 7 presents the proposed alternative for Centrosur. Table 7: Criterion of importance of risk from Centrosur [6] Lack of historical data: It may be frequent that when starting the implementation of risk management in the organization historical data is not available or partially available which, in most cases, and it does not allow determining its consequences and probability by means quantitative. The difficulty arose in the identification of the qualitative criteria under which to determine the consequences of a risk; with this background, the starting point was to identify very broad criteria such as "Consequences to Legal and Regulatory Risks", which showed a marked disparity in the determination of the range of consequences. The solution was to go segregating this C O N S E Q U E N C E 5 (Highest) Very high Extreme Extreme Extreme Extreme 4 High Very high Very high Extreme Extreme 3 Moderate High High Very high Very high 2 Low Low Moderate Moderate Moderate 1 (Lowest) Low Low Low Low Low 1 (Lowest) 2 3 4 5 (Highest) PROBABILITY American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 13 criterion until arriving at the concrete theme that is the source of this risk as: "Internal Control Standards" of The General Contralory of the State [11] and with this perspective to define the possible sanctions if a fault was incurred [12]. This mechanism was then replicated it for various operational issues such as IT (information technology), environmental, and others. Table 8 presents an example of the work done for Centrosur. Table 8: Example of scale of negative consequences for Centrosur. Level Internal Control Standards 5 Extreme Non-observance to the Internal Control Rules of CGE that causes the establishment of evidence of Criminal Liability 4 Very high Non-observance to the Internal Control Rules of CGE that causes the establishment of evidence of Civil Liability with guilt 3 High Non-observance to the Internal Control Rules of CGE that causes the establishment of evidence of Administrative Liability with guilt for repeated nonobservance 2 Moderate Non-observance to the Internal Control Rules of CGE that causes the establishment of evidence of Administrative Culprit Liability 1 Low Minor non-observance of the Internal Control Rules of the CGE that causes correction of the misdemeanor 0 Insignificant Observance of all legal, norm and regulatory instruments Although this information will take much more time to be lifted in its entirety, however the contribution provided to the organization is very important as it will also allow the identification of the risks under prospects that the organization determines as possible sources of risk. Process for the treatment of risk: The ISO 31000 Standard describes the process for the treatment of risk in an understandable way, for that reason it was necessary to investigate methodologies [13] of equal purpose in order to establish the process more suitable for the organization and at the same time comply with what is indicated by the Standard as shown in Fig. 2 and expressed in the definition of the Centrosur’s risk management architecture. Controls: When the Standard deals with controls it does so in the sense of using them in order to keep the risks within the tolerance criteria of the organization; in that sense it was necessary to investigate the criteria under which the controls can be considered effective. The use of controls in the treatment of a risk must meet three conditions [8]: prevention, detection and correction, and which preferably correspond to automatic controls. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 14 Figures 5 and 6 present to Centrosur the proposal for controls to be used in risky conditions with negative connotations, where barriers must be lifted to avoid them, and positive ones, where barriers must be knock down to make them possible. Figure 5: Diagram of three controls (prevention, detection and correction) for risk of negative connotations in Centrosur. Figure 6: Diagram of three controls (prevention, detection and correction) for risk of positive connotations in Centrosur. 6. Conclusions All business and even personal activity carries a degree of uncertainty, which is called risk, which can affect its normal development, causing a positive or negative deviation effect, and that may have repercussions of varied connotations. To embark on an ISO 31000 implementation project is not a simple task, but the way forward, although described in the Standard, contrasts with the reality in which we may encounter some ambiguity, incomplete information, risk taking decisions. Experienced guides should be sought and if it is not available, it is advisable to acquire the ISO-recommended guide texts on their website (http://www.iso.org). In spite of this, an architecture based on a proven methodology offers high guarantees of effectiveness. In this sense, the http://www.iso.org/ American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 15 proposed architecture for risk management in Centrosur intends to leave aside the informal and heterogeneous practices, in order to provide a methodology of an integral nature to all the levels of the organization that is fully adapted to its context, allowing to focus actions on the assets that are most exposed, while serving as a tool for decision making. Including to the architecture the components of the President's intention and gap identification and strategic approach are of paramount importance in order to make risk management integral, consistent and sustainable over time, and still be adaptable to the changing context of the Ecuadorian electricity sector. Likewise, the incorporation of Centrosur’s risk treatment process to the architecture seeks to define by its activities, avoiding any kind of ambiguity and allowing closing the cycle of attention to risk. The particularities, difficulties and design decisions taken at the time of defining the different themes should be documented in a roadmap. Although this methodology is adapted to the context of an institution in Ecuadorian electricity sector, it can serve as a reference, and even be applicable, to organizations that are in an initial stage of implementation or have a similar situation. 7. Recommendation This study recommends conducting new research in the field of industrial safety in the Ecuadorian electricity sector, especially in what relates to: teleworking, operation with smart grid, and SCADA (Supervisory Control And Data Acquisition) systems, as a risk management strategy. Acknowledgements The authors express their cordial and sincere thanks to the Empresa Eléctrica Regional Centro Sur for the opportunity granted to carry out this study. References [1] Empresa Eléctrica Regional Centro Sur C.A. “Strategic Plan 2014-2017.” Internet: www.centrosur.gob.ec.Mar.23, 2015 [Jan. 04, 2017]. [2] Constitutional Court of Ecuador (CCE). “Official register N ° 280”. Internet: www.registroficial.gob.ec, Jul.02, 2014 [Oct. 27, 2016]. [3] ISO (International Standard Organization). “ISO 31000 Risk management - Principles and Guidelines” Switzerland, 2009. [4] Empresa Eléctrica Regional Centro Sur C.A. Manual of Processes and Procedures. Cuenca, Ecuador: Centrosur, 2009. American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2017) Volume 36, No 1, pp 1-16 16 [5] McKinsey, Tom, P., & Robert, W. “Model of the 7 S of McKinsey”. Internet: managersmagazine.com/index.php/2009/05/las-7-s-de-mckinsey/, May. 09, 2009 [Mar. 22, 2017]. [6] ISO (International Standard Organization). ISO 31000 Risk Management - Practical Guide for SMEs. Switzerland, 2015, pp. 46-82 [7] ISO (International Standard Organization). “ISO-IEC 27005 Information Technology - Security techniques - Risk management in information security”. Switzerland, 2011, http://nsa.wkall.se/litteratur/iso_iec_27005-2011.pdf [8] AUDISIS. “Integral audit.” Internet: www.audisis.com, Apr. 05, 2017 [Apr. 23, 2017]. [9] ISOTools Excellense. “ISO 31000 STANDARD. The value of risk management in organizations.” Internet: www.isotools.org/pdfs-pro/ebook-iso-31000-gestion-riesgos-organizations.pdf., 2009 [Feb. 10, 2017]. [10] European Commission of UE. “Micro-enterprises, small and medium-sized enterprises: Definition and scope”. Internet: http://eur-lex.europa.eu/legal-content/ES/TXT/?uri=URISERV:n26026., 2003[Jul. 11, 2017]. [11] CGE (Comptroller General of the State). “Rules of internal control for entities, public sector organizations and legal entities of private law that have public resources.” Internet: www.contraloria.gob.ec/Normatividad/BaseLegal, Nov. 16, 2009 [Feb. 20, 2017]. [12] CGE (Comptroller General of the State). “Agreement 004-CG-2016 Regulation of Responsibilities.” Internet: www.contraloria.gob.ec/Normatividad/BaseLegal, Feb. 18, 2016 [Feb. 17, 2017]. [13] Standards Australia International. “SA / SNZ HB 436 Risk management guideline.” New Zealand, 2004. http://managersmagazine.com/index.php/2009/05/las-7-s-de-mckinsey/ http://nsa.wkall.se/litteratur/iso_iec_27005-2011.pdf http://www.audisis.com/ http://www.isotools.org/pdfs-pro/ebook-iso-31000-gestion-riesgos-organizations.pdf http://eur-lex.europa.eu/legal-content/ES/TXT/?uri=URISERV:n26026 http://www.contraloria.gob.ec/Normatividad/BaseLegal http://www.contraloria.gob.ec/Normatividad/BaseLegal Eva Merchán Corderoa*, Diego Ponceb Abstract Table 1: Macro processes and processes of Centrosur, in which risk management is considered Table 2: Methodologies applied by Centrosur in relation to risk management The table 3 shows that 86.4% of risk management is carried out in an undocumented or informal manner. Table 3: Type of practices, formal and informal, related to risk management by Centrosur. Table 4: Perception of the approach to risk treatment applied by Centrosur Table 5: Risk monitoring in Centrosur through the use of indicators. Table 6: Degree of knowledge of ISO 31010’s tools in Centrosur. Figure 4: Implementation strategy of the ISO 31000 standard for risk management in Centrosur Table 7: Criterion of importance of risk from Centrosur [6] Acknowledgements References