# Innovative Approach to Conceptual Design of Enterprise Risk Management Software
## 3 Software Solution RMS
### Reporting  
Based on the future and current risk values shown in Figure 9b, the relationship coefficient is calculated, which is also the basis of the Risk Score analysis. \[\text{Ratio coefficient}=\frac{\text{Future value of the risk}}{\text{Current value of risk}} \tag{1}\]  
The lower the value of the coefficient of the ratio of the future value of the risk and the current value of the risk, the more effective the proposed measures for the observed risk are. Figure 13 shows the results of Risk Score Analysis. Risk Score Analysis gives overall results across a variety of different risk types and this enables the satisfaction of specific organizational requirements. Namely, it is possible to determine which business areas/sectors/departments/processes (or any other of the adopted classifications) are critical from a risk perspective. This is a benefit of using ISO 3100 and COSO framework as two major risk assessment methodologies. Figure 13 shows an example of Risk Score Analysis, which allows us to structure risks from the highest to the lowest. This is done based on the position of the risk in the risk matrix, namely risk score. The order in the list of risks indicates those that are the greatest and therefore must receive priority in solving. However, this assessment alone is not enough; after determining the highest risks, the procedure for determining the Ie-factor (Investment effectiveness) analysis should be carried out, which is illustrated in Figure 14. This analysis shows which risks are worth investing in mitigation and according to which priority. The higher value this factor is, the higher the priority of investing in mitigating that risk, and at the same time the greater the expected effect. Figure 14 shows le-factor (Investment effectiveness) analysis as a method for determining the priority of investments in solving active risks. RMS classifies the obtained results of the Ie-factor analysis into:  
* Ie-factor > 1--these results are colored green (in Figure 14), i.e., they indicate that the difference between the future value of the risk and the current value of the risk divided by the total value of the recommended measures is positive, and it is profitable to invest in risk reduction activities. Figure 13: Risk Score Analysis. assessment of the value of the recommended mitigation actions; the overall prioritization of risks based on the COSM framework by elements of hierarchical structures yields valuable insights. The application of risk scores and Ie-factor analysis is very useful as well. There are legal regulations that prescribe the application of certain methods, such as the Kinney method, the application of which is mandatory, at least in Serbia. European (EN), ISO, or similar industrial standards, such as API, are widely accepted in practice. This is the reason that their application is built into the software. Among the advantages of RMS we can mention is that RMS supports different approaches in risk assessment thanks to an integral database in which all risks are located. The advantage of RMS is the scalability of the risk matrix, which facilitates the adaptation of this solution. Cyber security is ensured by data encryption and two servers in the enterprise (one for filtration, verification, and protection) for increased data security. RMS uses a secure version of the http protocol, i.e., https, and authentication is performed on the server side and not only on the client side. Cyber security could be improved by introducing multi-factor authentication and homomorphic encryption. Customizing the software usually requires making invasive changes to the application code, which means additional costs and additional risks are involved. Therefore, a configuration approach is used, and through the data structures that are part of the system, we enable changes in the behavior of the software and its adaptation to different requirements. Application behavior is data-driven, which positively affects durability and suitability for different organizations.