A risk management maturity model proposal for Brazilian public organisations

Abstract

Drawing on the literature concerning the contingency theory, maturity models, enterprise risk management and the fuzzy set theory, this thesis proposes a new maturity model to assess risk management (RM) implementation in Brazilian public organisations. In this sense, three main studies are presented. The first one explores RM implementation in Brazil through the support of government policymakers in 6 Brazilian states. Qualitative content analysis provides evidence that the policymakers employ strategies to approach public organisations with the aim to operationalise RM as contingent variables are perceived. These strategies are expected to attenuate the difficulties in progressing RM maturity due to some generally weak support from public top managers. The second study investigates which attributes and contingent factors are crucial to develop a public sector RM maturity model. Accordingly, a path of multivariate statistical techniques (CATPCA, K-modes, and multinomial logistic regression analysis) was used to analyse the data collected from 330 survey responses. Results reveal that 12 statistically significant variables explain 5 different levels of public sector RM maturity. The third study is a complement to the second one and proposes the PRisk-MM, a public sector RM maturity model that contains 5 levels of maturity and 23 maturity attributes related to 15 dimensions. The model was elaborated following the scientific rigour found in the literature on maturity models, being divided into 2 main phases: the development of the model and its validation in 3 public organisations of one state government. The assessment procedure of the model uses triangular fuzzy numbers to better treat the subjectivity and ambiguity of human judgement when analysing maturity dimensions and their attributes. This thesis has important practical implications as it demonstrates that RM is not always easily implemented in the public context, and higher levels of RM maturity are difficult to achieve. Therefore, the PRisk-MM was developed as a government tool that policymakers can use to assess the public organisations’ maturity status and compare their performance in implementing RM. Moreover, the PRisk-MM is adaptive to governments’ contexts and, once applied, presents prescriptions on what organisations must do to develop their RM practices.