# Risk Assessment and Mitigation for Industry 4.0: Implementation of a Digital Risk Quick Check

Julia Arlinghaus, Falko Bendik

► To cite this version:

Julia Arlinghaus, Falko Bendik. Risk Assessment and Mitigation for Industry 4.0: Implementation of a Digital Risk Quick Check. IFIP International Conference on Advances in Production Management Systems (APMS), Sep 2021, Nantes, France. pp.208-217, 10.1007/978-3-030-85874-2_22 hal-04030356

HAL Id: hal-04030356

https://inria.hal.science/hal-04030356

Submitted on 16 Mar 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Risk Assessment and Mitigation for Industry 4.0:
## Implementation of a Digital Risk Quick Check

Julia C. Arlinghaus¹, Falko Bendik¹

¹Otto-von-Guericke Universität Magdeburg, Universitätsplatz 2, 39106 Magdeburg, Germany
E-Mail address: julia.arlinghaus@ovgu.de

**Abstract.** While academics and professionals overwhelmingly agree that current advances in manufacturing present tremendous capabilities to advance manufacturing processes, their view and awareness of the related risk management varies widely. We have developed a method of classifying digital technologies, assessing risk factors and assigning situation-specific mitigation strategies to a variety of digital manufacturing applications. It is based on the analyses of over 350 digital manufacturing projects and over 40 in-depth interviews with academic and industry experts.

A classification of digital technologies and risk factors including fields of application serves as the basis for the web-based assessment and mitigation tool designed to evaluate digitalization projects in all areas of manufacturing and logistics as well as in all phases of development.

**Keywords:** Digital manufacturing, risk management, cybersecurity, digitalization

## 1 Introduction

Academics and professionals overwhelmingly agree that current advances in Industry 4.0 and manufacturing present tremendous capabilities. Risks associated with the implementation of digitalization technologies in all areas of production processes and logistics have largely been neglected or confined to so-called cyber risks. The corporate risks related to digitalization technologies harbor several positive and negative implications. Improved product traceability comes at the cost of greater technology dependence and vulnerability to technical failures. While visibility and integration on the business model level may improve inventory and service levels and permit segmentation and individualization of supply chain strategies, they can simultaneously increase complexity, jeopardize data ownership, and create new avenues for cyberattacks (see Fig. 1) [1]. Digitalization can generate risk factors that include vulnerability to technical malfunctions, data tampering, safety and security, health and motivation hazards, dependence on limited resources, coordination complexity, and potential additional costs after implementation [2] [3].
<figure><img src="image_3.png" /><figcaption>Fig. 1. Examples of technology risk situations</figcaption></figure>

Based on a set of 361 digital projects and 42 in-depth interviews with experts, we develop a method for assessing risks factors for and assigning situation-specific mitigation strategies to a set of assorted digital manufacturing applications. A classification of risk factors and fields of application serves as the basis for the web-based assessment and mitigation tool designed to prepare and evaluate digitalization projects in all areas of manufacturing and logistics. The web-based tool has value for stakeholders, ranging from small and medium-sized manufacturers, technology vendors and academics. It rapidly delivers a free and reliable overview of risks for specific combinations of technologies and processes along with the relevant mitigation strategies. Figure 2 provides an overview of company size and industry sectors compiled for the digital projects and interviews conducted with experts.

The remainder of this article is structured as follows: In section 2, we provide a survey of the theoretical background of digitalization in Industry 4.0 manufacturing applications and related digital risk management in order to identify the research gap. In section 3, we present the methodological approach applied. In section 4, we examine the study's main findings in a technology classification, a risk classification, and different risk types paired with mitigation strategies. In section 5, we present the structure and some screenshots of the method's implementation as a web-based tool and discuss some interesting facts we discerned.
<figure><img src="image_4.png" /><figcaption>Fig. 2. Company size and industry sectors of digital projects and interviews</figcaption></figure>

# 2 Theoretical Background

## 2.1 Risk Management in Industry 4.0

In the past decade, Industry 4.0 has become synonymous with innovative products, services and business models that increase efficiency, sustainability, robustness and flexibility [4]. Risk management covering more than cyber risk has emerged in research only recently in the last few years. Two risk types in smart factories arising from technical failures, specifically errors and attacks get distinguished by [5]. Errors include human, technical and organizational failures as well as force majeure. Attacks comprise targeted or untargeted malicious threats (e.g., hacking or phishing). [6] similarly identify organizational and human factors as main issues in operational risk assessments. Different risk factors and their relation to the benefits of underlying digitalization projects were mapped in [7]. Furthermore, [8] developed a risk framework for Industry 4.0 that addresses the triple bottom line of sustainability. Moreover, [1] show the impact of the ripple effect on digitalization and Industry 4.0. While they focus on the opportunities of certain digitalization applications for manufacturing and logistics, the authors identify concomitant challenges and risk factors generated by them. Big data analytics related to technology risks have been explored in several studies of manufacturing and logistics, such as [3] and [2]. Knowledge about the risks in the digital technology landscape is scant, though. On the one hand, the current literature on digital technologies tends to overemphasize the positive impacts and transformational capabilities of digital technologies, while underestimating the potential risks connected with their implementation [9]. On the other hand, the literature on
manufacturing and logistics risk management provides numerous models and frame-
works for types and sources of risks as well as mitigation strategies. Recent studies,
e.g. [10] on the use of big data in customer research and manufacturing and [3] on big
data for demand planning and return management, [6] focus heavily on big data tech-
nologies and emphasize identifying potential applications for such technologies in
supply chain operations.

## 2.2 Research Gap

Systematic empirical evidence of risk factors associated with the implementation of Industry 4.0 technologies is absent in the current literature. Academics and professionals both need to understand risk systematically in order to be able to mitigate and minimize it in operations management [11]; [8]. Whereas businesses are quite aware of the benefits and capabilities of digital projects, the literature still treats specific technologies, related risk and potential mitigation strategies separately. Current studies largely stress potential risks associated with the final concept of Industry 4.0 but do not provide specific insight into different risk types that typically arise in different fields of application. Moreover, tools with which critical information can be assessed in an easily structured manner are lacking in industrial practice.

3 Methodology

The methodology adopted follows a five-step research approach (see Fig. 3).

<figure><img src="image_5.png" /><figcaption>Fig. 3. Five-step research approach</figcaption></figure>

First, current studies were analyzed systematically to develop a thorough understand-
ing of the current literature on Industry 4.0, digitalization technologies and risk man-
agement. The current studies provided an introduction to risk factors and uncertainties
inherent to Industry 4.0 technologies. In a second step, extensive primary and second-
ary empirical data were collected from 361 Industry 4.0 applications for digital manu-
facturing in Germany drawn from the “Plattform Industrie 4.0”<fnref n="1" /> [12], and 42 in-depth
interviews conducted with experts. In the third step, we developed a new taxonomy of
relevant digitalization technologies and risk factors in the manufacturing environment
based on the case analyses and interviews (see Fig. 4). In step 4, we paired the tech-
nology and risk classifications with fields of application and mitigation strategies and
devised a three-step method that guides users from processes and potential technology
applications to mitigation strategies for all areas of manufacturing and logistics. The
final step was the implementation as a web-based tool.

<figure><img src="image_6.png" /><figcaption>Fig. 4. Technology taxonomy example</figcaption></figure>

The “Plattform Industrie 4.0” is intended as a transfer/share of know-how and best
practices of Industry 4.0 project implementations. It contains structured information
on developmental stages of digitalization projects, examples of products/ applications,
regions and company sizes. Additionally it provides unstructured information on ap-
plied technologies, envisioned benefits; lessons learned and adopted project ap-
proaches. Interviews with experts in the database cases shall enable us to verify and
improve the information from our secondary data. Forty-three 25-50 minute inter-
views with experts involved in the online database use cases as well as with industry
practitioners and academics in the field of digitalization and Industry 4.0 were con-
ducted face-to-face or over phone in November 2018 and March 2019. The inter-
viewed experts primarily come from automotive, equipment, automated systems
manufacturing and electrical and electronics companies (see Fig. 2). The interview
guide consists of three main sections and follows a semi-structured approach: In the
first portion the expert shall describes the known Industry 4.0 use cases, naming all
relevant basic technologies, application/ functions and the desired goals. The second
portion contains questions about risk and mitization strategies. Interviews with ex-
perts in the database cases shall verify and improve the information of our secondary
data and shall give an additional perspective of the impact of specific technologies on
the risk situation.

<footnote n="1">¹ Created and managed by the German Federal Ministry for Economic Affairs and Energy in collaboration with the Federal Ministry of Education and Research.</footnote>
# 4 Findings

## 4.1 Industry 4.0 Technology Risks

The use case and interview data analyzed reveal several key risk factors for Industry 4.0 technologies, specifically workplace risks and industry-specific and company-specific risks. These risk types are drawn from established risk management frameworks, e.g., [13]; [14]. Since legal risks in the workplace frequently arise during the implementation phase and primarily involve aspects of workplace law, data privacy and data protection, many experts see a need in the operation phase to address cyber risks in previously unaffected areas. Direct and indirect dependences and a lack of flexibility can pose serious industry-specific threats to companies. Various solutions require vendor-specific hardware, software and expertise. Users who integrate vendors' Industry 4.0 solutions in their systems do not have full control of their own product's reliability and are dependent on vendors when they need to repair, replace or upgrade their Industry 4.0 components. Our data reveals several important company-specific issues related to human adoption, errors and attacks. Humans come into play as a risk source during the operation phase, albeit to a lesser extent than during the implementation phase. Figure 5 presents an overview of all workplace, industry-specific and company-specific risks factors emerging from the data.

<figure><img src="image_7.png" /><figcaption>Fig. 5. Risk factors for Industry 4.0 - empirical findings</figcaption></figure>

## 4.2 Risk Priorities, Recent Approaches and Mitigation Strategies: Empirical Findings

Specific risks of Industry 4.0 implementation and operation phases of were identified based on the empirical findings. Table 1 presents several interesting examples emerg-
ing from the data as well as the related risk priorities, risk management approaches and potential mitigation strategies.

<table><caption>**Table 1.** Overview of risk management approaches and mitigation strategies</caption><thead><tr><td>Risk priority</td><td>Recent risk management approaches</td><td>Potential mitigation strategies</td></tr></thead><tbody><tr><td>Lack of technological expertise</td><td><ul><li>Rejecting projects, maintaining the status quo</li></ul></td><td><ul><li>Screening of vendor markets</li><li>Use of outside consulting services</li></ul></td></tr><tr><td>Legal risk</td><td><ul><li>Consulting with the employee council as part of introduction</li></ul></td><td><ul><li>Inclusion of the employee council</li><li>Revision of employment contracts</li><li>Technical changes, certification</li></ul></td></tr><tr><td>Employee adoption</td><td><ul><li>Trial-and-error</li></ul></td><td><ul><li>Involvement of affected employees</li><li>Skills training</li><li>Intuitive solution design</li></ul></td></tr><tr><td>Cyber risk</td><td><ul><li>Blind trust in existing safeguards, such as firewalls</li></ul></td><td><ul><li>Employee awareness creation/training, whitelisting/blacklisting</li><li>Technical measures such as IDS/IPS</li><li>Network segmentation</li><li>Backup strategy</li></ul></td></tr></tbody></table>

## 5 Method Development and Implementation as a Web-Based Tool

We ascertained from the case analyses and the interviews with experts that the method ought to build on the idea that the situation-specific risk (mapping the risks and potential mitigation strategies) is contingent on two major impact factors: (1) the technology applied and (2) the process/operation. We therefore decided to make a combination of process and technology the main input for users. First, users can provide input related to the specific technology. A higher-order classification of available technologies was developed based on a combination of data and typologies in the literature, e.g., [15]; [16], in order to be able to cover a wide range of technologies and assess the specific risks. This step made it possible to develop a two-level typology of Industry 4.0 technologies. The rationale behind this classification is to ensure that practitioners can provide input based on simple, established technologies (level 1) while ascertaining the risk profile for technologies (level 2). The implicit assumption is that one group of technologies (e.g., wearables) will present identical types of risks in specific industrial contexts. Users of the tool provide input on both the technology and the target process for which the technology is or will be used. The output consists of situation-specific risk factors and potential mitigation strategies (see Figure 6 for input and output information).
<figure><img src="image_8.png" /><figcaption>Fig. 6. How the web-based tool works</figcaption></figure>

# 6 Discussion and Conclusion

This study presents key findings and maps risk factors associated with Industry 4.0 applications in manufacturing and logistics. An extensive literature review and the secondary and primary data collected deliver several key insights into the main risk factors in the phases of technology implementation and operation. These technologies may also pose additional risks to digitalization projects, however, namely, inflexibility, increased latency of the existing production system, increased complexity, difficult integration in current IT systems, and a lack of adequate knowledge and skills among key staff. Based on the empirical findings and current literature, we developed a web-based tool that maps and assesses risk factors related to Industry 4.0 applications. The proposed approach is rooted in the assumption that both the technology and the specific process determine the risk factors. The tool uses the individual application context and the technology as input and delivers potential risk factors together with possible mitigation strategies to the user. The new risk factor typology that emerges from the data reveals that several risk factors pose serious threats to digital projects, e.g., human factors, cyberattacks, legal issues, and dependences. This research study produced a valuable method for assessing risk factors related to Industry 4.0 applications quickly and accurately. It is intended to provide practitioners free and reliable input to assess risks and develop mitigation strategies. The tool has two novel features: its focus on “technology-process” combinations since the risks associated with certain digital technologies may arise from the characteristics of specific processes and the abstract technology classification that correlates certain risks with a given group of technologies (e.g., wearables) rather than a single specific technology. The
higher-order technology classification for assessing and mitigating risks enables the tool to cover a wider range of commercially available technologies. The web-based tool is valuable to stakeholders from small and medium-sized manufacturers, technology vendors and academics because it quickly provides a free and reliable overview of the risks of specific technology-process combinations along with relevant mitigation strategies. Even though this project can still be refined in many ways in the future, this study and the web-based tool developed already benefit industry and research now because they provide a new, empirically developed view of the risks of Industry 4.0 technologies and technology-process combinations. This study is intended to open discussion about and raise awareness of the risk associated with various Industry 4.0 technologies in certain application contexts among academics and professionals.

## References

1. D. Ivanov, A. Dolgui und B. Sokolov (2018) The impact of digital technology and Industry 4.0 on the ripple effect and supply chain risk analytics. In: International Journal of Production Research, No. 57, pp. 1-18.

2. S. Guha, S. Kumar (2017) Emergence of Big Data Research in Operations Management Information Systems, and Healthcare: Past Contributions and Future Roadmap. In: Production and Operations Management, Vol. 27, No. 9, p. 1724-1735.

3. B. Rossmann, A. Canzaniello, H. von der Gracht, E. Hartmann (2017) The future and social impact of Big Data Analytics in Supply Chain Management: Results from a Delphi study. In: Technological Forecasting and Social Change, Vol. 130, pp. 135-149.

4. McKinsey Digital 2015 - Industry 4.0 How to navigate digitization of the manufacturing sector, [Online]. Available: https://www.mckinsey.com/~/media/McKinsey/ Business%20Functions/Operations/Our%20Insights/Industry%2040%20How%20to%20navigate%20digitization%20of%20the%20manufacturing%20sector/Industry-40-How-to-navigate-digitization-of-the-manufacturing-sector.ashx. [Last access 05 April 2021].

5. M. Hertel (2015), Risiken der Industrie 4.0 – Eine Strukturierung von Bedrohungsszenarien der Smart Factory. In: HMD Praxis der Wirtschaftsinformatik, Vol. 52, No. 5, pp. 724–738.

6. F. Brocal, C. González, D. Komljenovic, P. Katina, M. Sebastián (2019) Emerging Risk Management in Industry 4.0: An Approach to Improve Organizational and Human Performance in the Complex Systems. In: Complexity, No. 2, pp. 1–13.

7. M. Zimmermann, E. Rosca, O. Antons und J. C. Bendul (2019) Supply chain risks in times of Industry 4.0: Insights from German cases. In: 9th IFAC Conference on Manufacturing Modelling, Management and Control, Berlin.

8. H. Birkel, J. Veile, J. Müller, E. Hartmann, K.-I. Voigt (2019) Development of a Risk Framework for Industry 4.0 in the Context of Sustainability for Established Manufacturers. In: Sustainability, Vol. 11, No. 2, pp. 384.

9. M. Flyverbom, R. Deibert, D. Matten (2019) The governance of digital technology, big data, and the internet: new roles and responsibilities for business. In: Business & Society, Vol. 58(1), pp. 3-19.

10. Y. Kuo, A. Kusiak (2018) From data to big data in production research: the past and future
trends. In: International Journal of Production Research Vol. 26 No.1, pp. 1-26.

11. J. Tupa, J. Simota, F. Steiner (2017) Aspects of Risk Management Implementation for Industry 4.0. In: Procedia Manufacturing, No. 11, pp. 1223-1230.

12. Plattform Industrie 4.0, Bundesministerium für Wirtschaft und Energie, [Online]. Available: https://www.plattform-i40.de/PI40/Navigation/Karte/Site_globals/Forms/Formular/karte-anwendungsbeispiele-formular.html. [Last access 05 April 2021].

13. S. Chopra, M. Sodhi, (2004) Managing Risk to Avoid Supply-Chain Breakdown. In: MIT Sloan Management Review, Vol. 46, No. 1, pp. 53-61.

14. S. Rao, T. Goldsby (2009) Supply chain risks: a review and typology. In: The International Journal of Logistics Management, Vol. 20, No. 1, pp. 97-123.

15. Xu, L.D., Xu E.L., and Li, L. (2018) Industry 4.0: state of the art and future trends. In: International Journal of Production Research, Vol. 56, No. 8, pp. 2941-2962.

16. E. Oztemel, S. Gursev (2018) Literature review of Industry 4.0 and related technologies. In: Journal of Intelligent Manufacturing, pp. 1-56.