Risk-Based Approach in the Implementation of Integrated Management Systems: A Systematic Literature Review

Abstract

The risk-based approach is one of the keys used in the implementation of management systems using requirements from the management standards. If the management systems are implemented separately, the risks are evaluated from only one perspective, but when two or more systems are integrated, the approach must take into account the synergetic effects of the risks due to system integration. The paper aims to highlight the specific risks encountered when implementing management systems in organizations, underlining the risks associated with systems management and integrated management systems. In this work, a synthesis was presented including an analysis of the risks that occurred during the implementation of management systems and those that occurred during their integration, the need and opportunity of risk management, the advantages, and barriers in the approach of risk management in the industrial sector. The review of the literature comprises the assessment of 190 papers, 11 books, and 5 standards. The content of the paper highlights a synthesis of risk-based thinking and the risks that can manifest in the implementation of quality, environmental, and occupational safety and health management systems in industrial organizations, as well as those which can manifest in the implementation of integrated management systems. In addition, the benefits and barriers in risk management and risk management strategies, with an emphasis on the presentation of the Deming approach to risk management, were evidenced. Some recommendations and proposals for future research were made.

1. Introduction

In recent years, the world’s economy has gone through important changes, both at the macro economical level and at the level of organizations. These changes, as argued by Di Noia (2016) [1], included an increase in previously known risks and an increase in new emerging risks, due to the advances in scientific research, new technologies, and changes in social and stakeholder perceptions. One of the important challenges facing the management of organizations is the shift towards risk-based thinking that appeared in the 2015s with the emergence of new quality and environmental management standards.

Risk management is found in all fields such as business, engineering, medicine, transport, energy, climate change, etc. For these areas, the following elements are taken into account, which consider risk control processes: risk assessment; risk perception and assessment; risk policies; and risk management [2]. Various problems and issues related to the quality, environment, and health and safety at work constitute risks that threaten a company’s sustainability, and for this reason, the management of risks must be the objective of the manager that integrates the systems.

The purpose of risk management resides in implementing sustainable development in the organizational culture, ensuring resilience to the action of disruptive factors, and reducing adverse effects due to hazards and risks that cause increased costs and reduced benefits. By implementing multiple management systems, the management wishes to increase the resilience and, as a consequence, the sustainability of the organization in a difficult and unpredictable environment in which the organization is acting.

Today, many managers are dealing with the implementation of several different management standards that are integrated, and the management of risks for these complex systems tends to become more and more difficult. The extent and integration of the management system should be related to the risks, and these create a new synergy that the manager must be faced with to increase the sustainability of the organization. The problems appeared during the integration of the systems are reflected also in the performance of the organizations. The challenge in global risk management consists in anticipating risks and find constructive solutions to satisfy stakeholders. To respond to such challenges, the implementation of management systems within any organization presents an opportunity for the organization to become emergent and resilient in a well-structured and comprehensive system of processes [3]. A strong organization based on processes and management systems will have considerable advantages over the competition and will be ensuring high-performing management through their successful integration, producing sustainable development [4]. For a sustainable development, the organization must avoid disruptions caused by turbulences originating from their operating environments [5]. Turbulence can threaten both the operation and the survival of the organization in an increasingly emerging and resilient market, combined with the new changes of Industry 4.0 [2,6].

The implementation of the integrated management system (IMS) in organizations is founded on thinking based on risks, emergence (durability and sustainability [7]), and resilience. The common objective of any IMS consists in helping the management of the organization in managing the relevant risks associated with the provision of products and services in the context of the customer’s requirements and relevant stakeholders [3]. In the same strategic direction, to implement high-performance management of the organization, the common objectives of an IMS have to take inyo account risk reduction [8,9,10], increasing profit [9,11,12,13,14,15,16,17,18,19,20,21,22,23], reducing documentation [9,22,23,24,25,26], identification of new customers/business card for future customers [11,20,22,23,24,27,28,29], strengthening the market position [11,20,22,23,24,27,28,29], facilitating staff training, continuous improvement [11,16,20,23,28], and the implementation of a vision for the next developments of the business.

In the specialized literature, there are several definitions of risk. For a common approach, the term “risk” must be understood according to the 2.1 clause of the ISO 31000 standard [30], as “the effect of uncertainties on the objectives that may have a positive or negative impact on the event”. Although risks can be defined as the uncertainty of the results, uncertainty analysis is important for risk management, especially for integrated management systems where each component of the system induces its own risks [31].

To ensure the satisfaction of stakeholders regarding the organization’s activities, Nunhes (2017) argues that they should implement as many management systems as possible to assess and manage as many risks as possible and to bring benefits to the organization. Assessing and managing risk in organizations, when the organization decides to implement several management systems in parallel, can cause a conflict of operations and management inefficiency [32]. For this reason, starting from the design of such a complex system that includes several management systems and that forms a structured and efficient IMS, the emphasis must be placed on the identification of risks related to quality (production and management), environment, health, and safety at work, given the need to assess the risks of implementing corrective actions [11,16,20,23,28] and to take into account the related costs [33,34,35,36].

An important step in the implementation of the IMS was the standardization of the structure of the reference standards used through the elaboration of Annex SL. Annex SL underpins risk-based thinking and risk approach [10]. The structure of the new standards reflected by Annex SL facilitates the alignment and integration of management systems, following the PDCA (plan, do, check, act) cycle, and reduces risks at the organizational level by introducing “risk-based thinking” [37].

Consequently, from the examination and analysis of the specialized literature, it was noticed that studies started to be published on risk analysis regarding IMS, and some researchers such as Badreddine (2009) [38], Livshitz (2017) [39], and Algheriani (2019) [10] even started to study very intensively the problem of risks. To identify specific risks as defined by Campailla (2019) [37], the objectives must be taken into account: risk identification; objectives (risk minimization); actions to eliminate the risk; designated managers; necessary resources; data for the completion of the plan; the probability of the defect occurring; data for closing and any remarks.

The most common risk analysis is the PDCA method, which is used in most organizations as the only analysis method that respects the main elements of Annex SL, i.e., planning, resource management, product realization and measurement, and continuous improvement [10]. As argued by Björnsdóttir et al. (2022) [40], ISO standards that consider risk management did not define the processes and did not describe them, which makes their implementation uneven, thus becoming a challenge for the organization. To support a unified global implementation of risk management, the ISO 31000 standard was developed. The risk management standard first edition was published in 2009, together with a new associated vocabulary in ISO Guide 73 [41]. Shirouyehzad (2017) [42] and Livshitz (2017) [43] researchers state that the safety management proposed by the ISO 31000 standard is a mechanism that is designed to enable the control of risks and hazards in an organization. The updated ISO 31000:2018 standard [30] presents a safe and simple way to think about risk management and begin the process of resolving the many inconsistencies and ambiguities that exist between the many different approaches and definitions. Thus, the standard becomes a referential tool that allows the application of risk-based thinking in all organizations [44].

To our knowledge, currently there are few studies on the management of risks related to the risk-based approach in the implementation of integrated management systems. In general, the studies have been focused more on looking at the aspects that include integration and not on the documented practices used to manage the risks in the process during integration. The studies carried out by Crovini et al. (2021) [45] and Björnsdóttir et al. (2022) [40] revealed that there is a rising need for understanding the risk-management process, the information from the literature being very limited. Identifying aspects for the managers in the form of risks is an area of interest now.

Taking into account all the considerations presented above, the objective of the paper was to identify the approaches regarding the management of risks that appear when implementing management systems within the organizations. The way in which particularities regarding risk management appear when implementing the main standards (quality, environment, and occupational health and safety (OH&S), as well as when implementing IMS, was investigated. Studying the literature regarding the management of risk and integration of multiple management systems, this review underlines and makes a synthesis, for the first time, of the specific risks that can occur for each implemented management system and the specific risks identified when implementing two or more management systems.

By synthesizing the existing information in the specialized literature, we presented in the “Results and discussions” section (Section 3) the specificity of the risk-based approach for the Quality Management System, Environmental Management System, Occupational Health and Safety Management System, and the risks identified when the implementation of integrated management systems takes place. Another aspect pursued in this review was the presentation of various strategies used in risk management by simultaneously highlighting the benefits and barriers and the use of the PDCA method for the management of the risks.

2. Research Methodology

2.1. Methodology

The research consists of the systematic examination and analysis of specialized literature on the risks that arise in the implementation of management systems, the opportunity in risk management, and the advantages and barriers in the approach of risk management in the industrial sector.

As Evangelista (2018) [46] states, “the review and analysis of specialized literature is an essential stage in any research work and its purpose is to analyze the knowledge about a certain topic, to detect areas for the development of future research”.

For the descriptive analysis of the materials regarding the risks in the implementation of the IMS, the method proposed by Seuring (2008) [47] was followed, which had adequate results in many types of research. This method is being used by numerous scientists and resides in planning; implementation; analysis, and presentation of the results.

After the identification and analysis of the keywords, we moved on to the search for the most conclusive articles in the 6 databases that are in agreement with the purpose and objectives of the research.

The search stage was carried out by entering keywords into the 6 databases, and after that, several materials (articles and books) resulted. Before downloading them, a brief analysis of the abstract was carried out to see if the purpose and the objectives agree with the chosen theme, those that did not agree with the theme were eliminated.

Six databases were used in order to have the best possible accuracy on the extracted information for an examination and analysis of the specialized literature as fair as possible, having information from as many international databases as possible.

In the first stage of this research, the Google Scholar, Elsevier, Taylor, Emerald Insight, MDPI, and Springer databases were explored to find the necessary information. The search was carried out following the keywords “Risk”, “Risk-based thinking”, “Risk management”, and “Integrated Management Systems” between July 2022 and January 2023, and the number of references identified is shown in Figure 1.

Then, the titles and abstracts of the identified articles were analyzed, and a selection of duplicates was made using the function from Excel—Home—Conditional Formatting—Highlight Cells Rules—Text that Contains—of the documents identified in the 6 databases. After reviewing the abstracts, articles that were not consistent and did not fit the purpose of this research were eliminated. A selection of 190 documents (articles, reviews in magazines, conferences, and theses) was obtained, and 11 books and 5 standards were added to them. After the selection’s completion, the analysis phase of the information (190 documents) from the content of the papers was performed.

2.2. Bibliometric Analyses

The bibliometric maps offer a wide perspective over the studied articles in order to enhance the reader’s attention to the essential items [45,48,49,50,51,52,53,54,55,56].

After gathering all the necessary documents, the VOSviewer software (version 1.6.19, Leiden University, Leiden, The Netherlands) was used to perform the bibliometric analysis. To provide the bibliometric analysis, it was necessary to select the articles from platforms such as Google Scholar, Elsevier, Taylor, Emerald Insight, MDPI, and Springer using filters for specific periods and subjects. The following types of maps were generated using VOSviewer software: network maps, overlay visualization, and density visualization map. During the map generation, its type, the preferred extension, the counting version, the occurrences of an item, and the number of elements from the already refined ones can be chosen.

In this analysis, a map based on text data with data from reference manager files, respectively, with RIS extensions was selected, extracting information from titles and abstract fields through full counting restricting the minimum number of occurrences of an item to 5.

The generated maps are visually informing about the most important elements in the analysis: risk, performance, management system, organization, model, and so on, as it is shown in Figure 2. They are directly connected with the purpose of the paper and highlight the relevant links in the field. The map includes 167 items classified in 5 clusters represented through different color fields. The biggest class in this map is class 1 with 46 items, pictured in red, and contains the elements with the most occurrences in all the analyzed articles, followed by the second class in green which has 44 elements and has the co-occurrence elements of the first cluster elements. The third class is in blue with 29 terms; the fourth group has 27 terms in dark yellow; and the last class is presented in purple with 21 items.

Figure 3 shows the main authors that contribute to the topics of the present review. The main influence in the domain of integrated management systems is realized by Karaperovic [28,57,58,59,60,61]; Domingues [3,62,63,64,65,66]; and Santos [36,67,68,69,70,71], but it must be mentioned that not all the authors showed in the map are concerned about the management of the risks.

The bibliometric maps provide a theoretical view of the multitude of articles that study and discuss the subject “Risk-based approach in the implementation of Integrated Management Systems”, and they allow the structuration of the present paper.

3. Results and Discussion

3.1. Specific Risks Identified during the Implementation of the Quality Management System

With the revision of the ISO 9001 standard in 2015 [72], the international standardization organization tried to focus on improving processes and identifying and controlling risks [62,73,74]. Focusing on these objectives, any organization will benefit from risk management and, ultimately, stakeholder satisfaction. Regarding the ISO 9001 standard, Barafort (2017) [75] believes that, “Risk-based thinking is essential for achieving an effective quality management system” (0.3.3) and recommends that “The organization must plan actions to address risks and opportunities and how to integrate and implement these actions in its quality management system processes; and evaluate their effectiveness” (6.1.2). Moreover, Barafort (2017) [75] states that risk-based thinking is explicit in the ISO 9001 standard: “an organization must plan and implement actions to address risks and opportunities”. Approaching both risks and opportunities lays a foundation for “increasing the effectiveness of the quality management system, achieving improved results, and preventing adverse effects” (0.3.3).

On the other hand, Rybski (2017) argued that the main change in the ISO 9001 standard consists in the risk-based approach, which requires businesses to plan and implement risk management measures. In a study carried out in Germany, it was shown that service providers do not have a growing need to manage risks. Only 52% of respondents answered affirmatively compared to 65% in the field of manufacturing organizations, the risks for this category being more varied and specific. For the management of these specific risks, the studies show that the top manager must best manage these risks, the percentage being 59%. A percentage of 21% did not define a responsible person, and 15% showed that the whole team must participate in identifying and treating risks, the focus being on risk analysis and the likelihood of occurrence [76].

As affirmed by Martins (2022), the specific risks for the ISO 9001 standard are divided into sections: Organizational context—the organization must define the organizational processes (risks and opportunities); Leadership—highlighting top management responsibilities and team actions; Planning—Identifying risks and opportunities; Support—providing the necessary resources to implement the planned actions (risk action plan); Operations—The organization must manage operational processes and associated risks (risks and opportunities); Performance evaluation—monitoring, analyzing, and evaluating the effectiveness of actions carried out to address risks; Improvement—continuous improvement by correcting and preventing or reducing unwanted effects and updating risks (threats and opportunities) [48].

The specific risks of a quality management system (QMS) must be combined with the technologies and methodologies of Industry 4.0 [2] to streamline the risk analysis processes. There is a lack of integration between quality management and big data to cover the gaps of specific risks [49]. Quality management must embrace big data; it must be compatible with evolving technologies, and it needs to be built so that predictive analytics and multivariate analytics are included [77].

Collaboration between new technologies allowed the extraction of data from certain events and operations [78], thus enhancing traceability between the processes, products, and organizational systems of the organization [79]. The data can be used to improve the QMS, quality management as a unit, the audit process, and compliance and risk management [80].

The specific risks of QMS are detailed and structured according to certain criteria by several authors as follows:

• Organizational context—management is required to define the domain and the processes [48];
• Process approach—understand and plan the input-output sequence and interactions of processes in the system [67,81];
• Organizational culture—product quality and risk management should be part of the organization’s culture, and this should be supported by the organization’s management [63,68,82];
• Leadership—top management responsibility [76];
• Employee involvement—Strategic level—management involvement in risk management [83,84], Tactical level—involvement of managers and coordinators [85,86], Operational level—operators’ involvement [87,88];
• Terms for addressing risk—risks, opportunities, and threats—Positive and negative aspects of risks considered in the management process and negative aspects of risks considered as a defective product or dangerous situations for the user [89];
• Training and qualifications—Training on concepts related to risk management [87,90,91,92], product and technical user, and technical issues related to possible risks in product design, development, and use [93];
• Sources of risk—Tactical process—Tactical issues directly or indirectly related to production or product [94,95,96]; Business and Marketing Strategies—Strategic issues that can affect products and processes in the long term [92,97,98].
• Operational processes—reduction in the number of non-compliant products and delivering poor quality [99].

3.2. Specific Risks Identified during the Implementation of the Environmental Management Systems

The standard for the implementation of environmental management systems (EMS), ISO 14001 standard [100] guarantees that by implementing the requirements contained in it, the organization complies with certain rules to be more environmental-friendly and to reduce pollution, aspects needed for risk-based thinking and supporting investments into sustainable projects [101].

Through the standard for EMS, organizations calibrate their “tools” to respect certain environmental parameters and indicators to voluntarily reduce the impact of their activities [102]. When the environmental management system is implemented, it helps to improve the corporate sustainable development of the organization [103] and reduce the risks. The purpose of risk management for EMS is to control a group of risks arising from inadequate waste management, uncontrolled energy consumption, and emissions of pollutants into water, air, and soil [100]. The studies on the specific risks of EMS were divided into studies on the reduction of toxic substances [104,105,106,107], risks on environmental sensitivity [108,109,110,111,112,113], risks regarding the reduction of resource consumption and environmental pollution [35,104,106], risks on the improvement of production processes and the reduction of environmental risks [114,115], and risks determined by the increasing the number of legislations and regulations [116].

Following studies on specific environmental risks, it is shown that organizations have many benefits from risk analyses, the advantages being both external and internal [64,117]. Boiral (2007) [111] analyzed the risks and grouped them into three categories: the inherent value of the EMS proposed in the standard (rigor, monitoring, and effectiveness); better monitoring of human behavior and work practices that have a potential impact on the environment (compliance with all work procedures and instructions); socioeconomic developments arising from the implementation of the standard (an active approach to the future needs of clients). Another study of the importance of risk analysis developed and performed by Gavronski et al. (2008) [118] groups the benefits into four categories: benefits for production—reduced use of resources, reduced production costs, and increased staff motivation; financial benefits—access to different funds and lower rates at certain interest rates; market benefits (concerning stakeholders, customers, competition, suppliers), which can create competitive advantage, positive impacts on the market and customers, and encouraging the expansion of environmental awareness along the value chain [69]; social benefits (concerning social actors, e.g., government, companies, and non-governmental organizations) such as enhancing the image and better cooperation with environmental protection authorities [118]. A study by Pechancová et al., states that when implementing EMS, it must take into consideration the corporate environmental trends, environmental risks, and aspects through the whole product life cycle, and the managers must develop a long-term environmental strategy [101].

Looking at all the above studies it, seems that environmental management positively affects corporate performance [119], decreases the risks, and increases the sustainability of the organization.

3.3. Specific Risks Identified When Implementing the Occupational Health and Safety Management Systems

The new standard ISO 45001, Occupational Health and Safety (OH&S) Management [120] has been published to help and support organizations to prepare them to face emerging risks, which represent a major challenge for employers and organization management. In his work, Fernández-Muñiz (2007) [121] argues that a successful OH&S management system needs a safety policy; employee participation in OH&S training activities; development of staff skills, communication procedures, and information about possible risks at the work place; and measures of control, respectively, planning safety procedures, risk identification actions, risk assessment, and risk monitoring and control. As affirmed by Marhavilas et al. (2018) [122], introducing effective OH&S management systems in organizations is known to have a positive impact. The introduction of management systems has an important effect in reducing occupational hazards, accidents, and injuries, thus improving risk management and compliance with legal requirements, as well as productivity, leading to more efficient use of resources and an increased capacity to provide services and products of constant quality while improving financial performance. When an OH&S management system is mature and best practices are enforced, it is expected that the overall performance of the company will be improved. [123]. A system needs to reach maturity and the perception of specific risks, a fact that can influence risk behaviors which represent an important perspective for OH&S [124]. Thus, there are also several disruptive factors that influence the perception of specific risks, such as situational characteristics, personal factors, beliefs, values, experiences, feelings, and attitudes [125,126,127]. Risk perception represents paramount importance to develop an appropriate safety culture, studies by Rodrigues (2015) [128] demonstrating that risk perception is a predictive factor in an organization’s security climate. Some studies showed that the perception of risks is frequently wrongly reported, usually being risks that are considered technically complex, scientifically known where people are voluntarily exposed, and where the risk is controlled by another/others [9,31,129]. The risks that are underestimated are normally the risks of low severity [128] where the exposure is considered voluntarily accepted. In the case when the risks are well known from a scientific point of view, they can be treated responsibly, the consequences are reversible, and the risk is not dramatic or memorable. The results showed that these approaches focus more on feelings than on knowledge or risk assessments, and the prevention efforts need to take that into account [123].

In general, improvement of safety at work begins with a risk assessment, which consists in a series of measures designed to examine potential hazards. [130]. As Darabont (2017) [131] stated, any organization that has implemented an OH&S management system based on the standard must ensure periodic assessment of compliance with legal requirements and other requirements to which the organization subscribes, this being an obligation under the law for the organization.

To treat and assess risk, several factors must be taken into account, as shown in Chockalingam’s (2017) [132] study, namely that workers must be grouped into certain categories (women, older, young and migrant workers, disabled and low-skilled workers, temporary workers, workers, etc.), all these groups facing specific occupational health and safety risks.

Risk identification methods (Hazard and operability study—HAZOP, checklists, failure mode analysis—FMEA, fault tree analysis, event and cause tree analysis) have been studied by several researchers such as Aven (2016) [31], Etherton (2007) [133], and Anderson (2005) [134], who presented a coherent and concise description of the identified and risk treatment methods. For risk identification and treatment methods to be effective, Chaswa (2020) [135] showed that workers’ perception of risk has a significant effect on the applied methods, and entrepreneurs must integrate behavior analysis and workers’ risk perception to identify and treat risks correctly and to limit possible events.

The perception of hazards and risks has changed considerably over the last few years, as well as the economic context in which organizations must develop their processes and activities. The main issues raised by new and emerging risks are related to psychosocial hazards, the introduction of new technologies, globalization, or the aging of the population. In this context, the main role of the ISO 45001 standard is to serve as a useful and necessary tool to enable an organization to proactively improve its OH&S that it needs to perform, regardless of the type, size, and nature of the organization [131].

In his study, Górny (2019) proposes factors that are critical for the effectiveness of management of the OH&S management system: the environment and the context in which organizations operate; the scope; and the specific organization’s business risks [136].

3.4. Risks in the Implementation of Integrated Management Systems

Risk analysis starts from the identification of risks, for each management system. Subsequently, a concatenated analysis of these risks is necessary in order not to omit sources of risk that could be considered insignificant but which, by omitting them, would generate a chain of events that would reduce the resilience of the integrated management system. The practical implementation of integrated management systems (IMS) arose from the need to address a variety of stakeholder needs while efficiently using organizational resources [26,58,137]. Risk assessment and analysis for IMS represent one of the most difficult steps because there is no common risk assessment method that can be used to evaluate processes and interactions between processes within systems that in turn change their configurations. The risk assessment following the integration process must take into account all risk factors from all management systems, thus assessing the highest risks that bring the greatest damage [138,139]. When simultaneously integrating multiple IMS, Rebelo et al. (2016) [36] argue that integrated risk represents a systematic and explicit approach to risk management within the organization.

Risk management in an IMS becomes more complex due to interferences between processes and newly formed interconnections. Studies of IMS integration show that there are several benefits and barriers when considering implementation and risk management,

Table 1. Benefits and barriers to IMS risk management.

Risk Management Benefits	Barriers to Risk Management	References
Continuous improvement of risks and their management Making better decisions Improving communication Creating a positive image of the organization More care for the environment	Lack of experience of employees Unforeseen technical aspects Uncertainties about some human aspects	[140]
Reducing the risk of work accidents Increasing the profit of the organization	Unforeseen human aspects Unforeseen technical aspects Natural calamities	[123]
Increasing the quality of organizational processes and products Reducing risks for health and safety at work Reduction of environmental pollution and continuous improvement	Unforeseen technical aspects	[141]
Reduction of costs and risks	Natural calamities Unforeseen situations	[142]
Improvement of products	Lack of experience in risk management	[143]
Stakeholder satisfaction Reduction of work accidents Reducing the risk of bankruptcy	Failure to take measures in decision-making	[59]
Continuous improvement of organizations’ processes Reducing pollution Reducing work accidents	Poor training of the personnel who carry out the risk analysis	[9]
Manage processes and systems	Employee resistance to culture change	[32]
Increasing productivity Reducing the rate of accidents	Poor training of top managers	[94]
Reduction of losses (waste elimination) Increasing product quality Reducing the pollution risk Reducing the risk of work accidents Reducing the bankruptcy risk	Top management’s perception of the benefits of risk management	[65,144,145,146,147]
Reducing environmental risks Reducing risks for health and safety at work Decreasing the risk of economic losses	Unforeseen events	[148]
Reducing the risk of losses due to retouching or discards Reducing the risk of delivery of non-compliant products to customers Reducing the risk to the environment (reducing the consumption of raw materials, energy, reducing waste) Reducing the risk for employees (as the processes are better understood, the risk of accidents will be reduced) Reducing the risk for consumers (a non-compliant product can be the source of an accident for the customer)	Top management lack of skills	[145]
Reduction of work accidents Reducing the risk to the environment Reducing the risk of bankruptcy	Weather phenomena Human errors	[149]
To mitigate the risk of pollution Minimize the risk of quality in the field of construction	Unforeseen technical aspects Poor staff training	[150]
Systematic identification of hazards Reduction of work accidents Reducing risk to quality, environment, and health		[14,151]
Increases the probability of achieving the proposed objectives Supports proactive management Improves awareness Improves operational efficiency and effectiveness Improves performance for quality, health, and environment	Lack of experience in performing risk analysis Unforeseen technical aspects	[39]
The ability to consistently deliver products and services that meet quality, health, and environmental requirements Achieving the organization’s goals	Natural disasters	[43]
Reduction of accidental interruptions of machinery Reducing the risk of work accidents Reduction of costs caused by unscheduled interruptions	Unforeseen technical aspects	[39]
Reducing the risk of paying compensation to the state in case of possible risks Reducing the risk to the environment	Unforeseen elements	[152]
Increasing product quality Reducing the risk of work accidents Reducing pollution	Lack of knowledge	[48]
Cost reduction Lasting development Stakeholder satisfaction Reducing professional risks Improving operational performance	Unforeseen technical aspects	[153]
Increasing the performance of organizations	Unforeseen technical aspects	[154]
Improve occupational health and safety risk and easily manage the company’s management process		[154]
Reducing the risk of accidents at work	Insufficiently trained staff	[155]
Improving the organization’s performance	Unforeseen aspects	[154]
Avoiding costs and safety issues	Unforeseen technical aspects	[36]
Cost reduction Adding value to processes Building an organizational structure and the mission assigned by the management of the organization	Poorly trained management Morally outdated management	[33,34,68,156]
Information and support from external consultants	Incompatibility between the consultants and the managers	[66]

.

The implementation of the IMS must take into account the specific risks of each management system to which is added another group of risks due to the interactions of the processes in the systems that make up the IMS (Figure 4).

The most common risks identified following the implementation of the IMS are selected in

Table 2. Risks of IMS implementation.

Risks of Implementing IMS	References
More careful integration of a management system (IMS) concerning the other systems (paying more attention to a certain MS) Underestimating some requirements from a certain IMS The management representative’s lack of experience in IMS implementation Lack of information about the legislation in force in a certain area, regarding the particularities of IMS Economic losses due to not taking into account some integration factors	[8,9,138,145,157]
Internal and external risks have not been analyzed sufficiently	[154]
Lack of employees’ vision of current standards and motivation for new ones Lack of financial resources Lack of competence in carrying out integrated audits; Evaluation of audit follow-up is imprecise	[158]
Complex approach to which knowledge management and innovation are added	[70,159]
Radical decisions that include social responsibility, professional performance, and sustainable development	[160]
Deficiencies in the audit process	[161]

.

3.5. Strategies Used for Risk Management in Management Systems

After the related risks have been identified in the organization, management must plan actions to address these risks by using strategies that are based on appropriate methods and measures. The purpose of planning is to anticipate scenarios that can best respond when risks manifest and can cause negative effects. In any organization, the risk analysis must be decided by the top management, and they must constantly be attentive to changes in the external context and have the ability to manage risks sustainably [162]. Taking advantage of the opportunity for risk-based thinking, the organization must develop the principles of general sustainability, namely guaranteeing the quality of products and services, ensuring the protection and preservation of the environment, and ensuring the health of staff without neglecting ethical principles and risk-based thinking [163].

By implementing methodologies that promote risk-based thinking, the management process becomes more preventative, with an analysis of its long-term positive and negative impacts. As a result, the management can establish a strategic plan prioritizing the main threats and the fruition of opportunities that can occur [163].

Management systems are relevant, organized patterns that enable adaptability and responsiveness in risk management. Management strategies, as defined by Rademeyer et al. (2008) [164], represent the combinations of data collection schemes used to determine actions and evaluate management strategies. Following the studies made by Asif et al. (2009) [137], a common framework for objectives was proposed, thus aligning management objectives and strategic management, providing a mapping of the flow of values, costs, and implementation tools. Algheriani et al. (2019) [10] checked an integrated risk management strategy approach. In another study on risk management, Aven (2014) argued that the field of risk strategies has two main tasks [165]:

• To use risk assessments and management to study and treat risk and propose strategies;
• To carry out specific risk and research development related to concepts, theories, frameworks, approaches, principles, methods, and models to understand, evaluate, characterize, and communicate—that is to manage and propose—risk management strategies.

Risk management must be based on available strategies (risk-based strategies; precautionary strategies; discursive strategies), with Renn (2008) [166] and Aven (2014) [165] also considering the structure of the risk management process. The precautionary strategy is also called the resilience strategy, this being the combination of at least three strategies that are used together to bring benefits to the organization [165].

Resilience strategy for the sustainability of the organization plays a key role in dealing with risks, uncertainties, and potential surprises, and the level of resilience system or organization is related to the ability to sustain or restore its basic functionality following a disruptive factor. As described by Hollnagel et al. (2006) [167], a resilient system has the ability to respond to regular and irregular threats and hazards in a flexible way; monitor what is happening, including its performance; anticipate risk events and opportunities; and learn from experience. Resilient strategies applied with vigilance, rapid detection, and early response can avoid failures [168,169,170,171,172,173] and perform to the sustainability of the organization.

3.6. The PDCA Approach to Risk Management Implementation

Risk is an inherent factor in all aspects of a management system and can affect component subsystems, processes, and functions. Risk-based thinking creates the framework for these risks to be identified, assessed, monitored, and controlled from the design of the integration of management systems, and a successful implementation is achieved by using the PDCA method. As Algherian (2019) [10] argued that all the standards used in the Deming PDCA approach are mutually compatible with continuous performance improvement, the risk assessment method is also compatible with this cycle so that it is possible to develop the risk model in an integrated management system according to the requirements of the standards. Thus, when implementing risk management in IMS, the process approach can be used to define a scope encompassing all processes and systems in the organization, the interactions between policies, objectives, and their resources to monitor and mitigate as many types of risks as possible in an efficient and relevant way.

As argued by Jørgensen (2006) [9], three levels of integration have been defined for the development of a risk management model:

• Correspondence—which refers to increasing compatibility between standards to solve problems of bureaucracy, duplication of work tasks, and confusion between different standards;
• Coordination—which is based on a common understanding of the generic management cycle of processes and tasks PDCA to ensure synergies and compromises between standards;
• Integration—leading to interaction with stakeholders, continuous improvement of performance, understanding of internal and external challenges, and last but not least, culture change.

Organizational risks are also analyzed after the PDCA cycle, the analysis being influenced by the promotion of the concept of continuous improvement [174]. More and more researchers such as Chiarini (2017) [175], Ezrahovich et al. (2017) [43], Sitnikov and Bocean (2015) [176], Wijethilake et al. (2018) [177], Guenther et al. (2016) [178], Sartor [179,180], and Johnstone (2022) [50] supported the implementation of IMS according to the PDCA model, including risk analysis, quality, OH&S, etc., establishing some simple and common objectives from the standards, namely developing policy and continuous improvement; identifying all processes and activities that affect the organization and then focusing on the most significant; setting objectives and targets; developing control procedures and measuring impact and performance; training employees on all the procedures; demonstrating interest in complying with rules; performing internal audits; and periodic review of management systems [43,50,175,176,177,178,179,180].

4. Conclusions

The study of risk analysis in the implementation of an integrated management system was performed in concordance with the literature [145,181]. Integration generally concerns aspects such as quality, the environment, and health and safety at work, even though there is no common sense of integration [8]. A variety of integration strategies [182] and different management systems were considered [58,60]. Integrating management systems involves assessing costs and benefits [23] and hostility toward new models and procedures [13]. Integration of MS could include all processes for systems in the entire organization or not [9]. There are numerous case studies in different domains and countries [26,183], with different approaches [61], integration levels [59], and enterprise dimensions [71]. Nowadays, it is possible to observe an increasing interest in sustainability. As a result, emerging social considerations are being integrated into more traditional management considerations [103,184,185,186].

Although the benefits of integration are obvious [187], its impact on company performance is not obvious [188,189,190].

As a result of this research, additional considerations on the potential for integration are provided in terms of the risk, resilience, and sustainability of the organization. The opportunities of the new updates of ISO standards bring some key changes in terms of concepts, terms, and definitions for the risk-based approach. The specific risks of each organization must be identified from the early stage, such as the areas of risk and impact, the events and their causes, and last but not least, the potential consequences that the specific risks can generate. At the same time, the organization analyzes the monitored and measured data, thus managing the effectiveness of the actions undertaken, and when a risk arises, it must update that new specific risk.

New concepts such as risk-based thinking, control change, stakeholder satisfaction, management, and leadership change offer the possibility of IMS integration easily through the process of risk analysis. Ultimately, the main objective is to satisfy stakeholders, the need for planning, management actions knowledge, and risk management. In the context in which risk-based thinking represents one of the trump cards for the implementation of IMS in organizations, the emergence and resilience of management systems are strengths in an increasingly competitive global environment. An analysis of the opportunities and needs of risk-based thinking, providing a detailed view for top managers, consulting organizations, and certification bodies about the most used risk analysis methods, the advantages obtained from the analysis but also the barriers that stand in the way of risk analyses were highlighted in this study.

The risk assessment strategies and the methods used are considered as basic components for structuring integrated systems. The purpose of integrated systems is to provide a single open system in which all the component systems that are integrated contribute to their own risks. For this reason, it is necessary to present the risk of each management system and the strategies in use to evaluate the risks that occur when integrating the systems.

The changes in the standards from recent years carried out according to the PDCA cycle are useful for organizations worldwide to integrate management systems into one system. The top management must make the transition to the circular economy. Thus, for emerging risks, they must be treated with resilient management, which must involve employees, the organizational culture, setting timelines for addressing risk, opportunities, threats, training employees on the concept of risk, and training employees on sources of risk. Top managers must be aware that risk analysis is a necessary process for their organization, opportunities, and needs contributing to a sustainable future of any organization with the ultimate goal to satisfy stakeholders.

The sustainable development of the organization and the increase of resilience, in the context in which various socio-economic factors with a negative effect act, are conditioned by the integration of several management systems and the correct identification of the risks associated with the implementation and the synergy with which the risks can act.

The review carried out highlighted how it is necessary to approach some methods and strategies that allow an efficient and effective management of risks when integrating two or more management systems according to the existing requirements. The study took into consideration the most important aspects reported in the literature so that, through this presentation, information is provided to the interested managers. This information contributes to the achievement of the success that guarantees the existence of a company with high resilience.

An important aspect arising from this review is also the fact that a series of further research directions that would allow the accumulation of solid knowledge for achieving the integration of management systems was identified. In this sense, the following new research directions are proposed: a study on the difficulties encountered by the management of the companies when they went through the stages for the implementation of an integrated management system; a study on the establishment of advanced methods for assessing the combined effect of risks on the organization’s resilience; a study regarding the complexity of the internal auditing process when it is used to evaluate the management integrated systems; a study on strategies for the use of artificial intelligence in the integration of management systems.

When a management system is implemented in the organization, and the risk assessment is desired, a new strategic approach is necessary, which requires the integration of the basic system with the risk management system.

The findings provided by this study enable organizations, consulting firms, and certification bodies to use this information to minimize risks, improve processes, increase the sustainability of the business organization, and not ultimately, satisfy stakeholders.