Integrating Sustainability into Risk Management through Analytical Network Process

Abstract

Sustainable risk management is becoming widely accepted, making the incorporation of environmental, social, and governance (ESG) issues into strategic planning areas crucial to a responsible business philosophy. This article aims to rank organizational sub-risks with a focus on sustainability, offering a methodology based on the analytical network process (ANP) method to improve decision-making and reduce misrepresentation in qualitative evaluation criteria. An integrated approach is presented, starting with the characterization of five risk typologies based on global reports and then prioritizing risks and sub-risks using the ANP method. The sustainability sub-risks with the highest level of prioritization for each risk typology are (1) massive data fraud or theft incident (technological risk), (2) deficit in economic growth (economic risk), (3) water depletion (environmental risk), (4) lack of ethics in the conduct of business (geopolitical risk), and (5) chemical safety (social risk). Finally, a cosine similarity analysis is developed to compare the results obtained with the results of a risk prioritization performed with the analytical hierarchy process (AHP) method. The differences between the methods generate a similar risk prioritization; the high similarity indicates the consistency of the relationships and the prioritization of the criteria showing convergence. It is essential to mention that the results should be interpreted cautiously, considering the specific context in which this methodology is developed, and we recommend a periodic verification of risks and sub-risks.

1. Introduction

Organizations have adopted various approaches to properly manage their risks based on sound policies, practices, guidelines, and procedures. In this way, a company can conform to current regulations and align its actions with corporate values and visions from an integral perspective, including environmental, social, and governance (ESG) issues [1]. Increased awareness at the enterprise level has generated more pressure on enterprise risk management (ERM) due to its relevance over the years. Therefore, ESG issues are now a more relevant topic, as they manifest themselves with greater speed and significance, involving the assessment of aspects such as internal supervision, strategic planning, and culture to manage risks with greater attention in the operation of organizations [2,3]. Risk management integrating environmental, social, and governance elements should be approached from an integral vision, where all those risks that are relevant to each type of organization are addressed, considering the complex interaction between them [4]. Organizational risks with a focus on sustainability must be considered as part of the same process, which is why the correct identification, evaluation, prioritization, and control must be carried out to enable effective decision-making, to respond correctly to each risk without affecting the integrity of the organization [2]. Based on a multidisciplinary approach, it is recommended that risk management professionals work together with other experts in order to establish more precise approaches and take faster actions, starting from needs according to the established scopes [5]. The constant evolution in the business environment, new regulations, and stakeholder expectations require greater rigor and effectiveness in the face of organizational risk management with a focus on sustainability [6].

Organizations operating at a global level face more complex challenges to fulfill their objectives, with more demanding requirements [1]. Among these requirements are the regulations in the international normative framework related to risk insurance, to reinforce the models for its adequate management [7]. On the other hand, the 2023 Agenda for Sustainable Development is a global call to action for sustainable development, addressing everything from poverty eradication to climate change mitigation and reducing inequalities. Based on this need, the 17 sustainable development goals (SDGs) and their targets, conceptualized as “integrated and indivisible,” are defined. The SDGs represent a global initiative to eliminate poverty, preserve the environment, and promote peace and prosperity, adapting to the various scientific disciplines to address specific challenges and exceeding the ambitions of the Millennium Development Goals as they focus on areas such as people, the planet, prosperity, peace, and partnerships [8,9,10].

As stated by Khan et al. (2023) [11], the adoption of sustainability reporting plays a crucial role in improving organizational transparency and accountability to its stakeholders. In this regard, the Global Reporting Initiative (GRI) standards encourage the preparation of such reports. These standards, recognized for their widespread acceptance, cover key sustainability areas such as governance, economic, social, environmental, and strategic issues. Beyond their contribution to sustainability disclosure, the GRI standards also positively impact the quality of reporting, generating an increase in the flow of capital and, consequently, improving the financial performance of organizations. The GRI standards provide valuable guidance for companies to achieve their SDGs. Several sectoral reports underline that the SDGs provide a robust framework for addressing environmental, social, and economic challenges [12]. However, not all SDG risks are equally significant in each organization, so it is essential to identify those that require specific attention in each dynamic [9]. This leads to the need for risk prioritization based on a sustainability approach, SDG standards, and internationally recognized reports such as the “Global Sustainable Development Report”, the “Enterprise Risk Management-Integrating with Strategy and Performance”, and the “Global Risk Report” [2,5,13].

To carry out the proper prioritization of criteria, in this case of organizational risks with a focus on sustainability, multi-criteria decision-making (MCDM) methods provide great advantages, as they allow one to take into account a large amount of data, relationships, and objectives, which are closely related to decision-making in real-world situations [14]. Studies such as Navarro et al. (2022) [15] show that MCDM methods have been increasingly used. One of the fundamental steps in their development is determining the weight of each criterion; this is defined by a group of experts who have an overview of the problem and, based on a linguistic scale, make paired comparisons of each criterion. Although it is stated that the weights obtained are entirely subjective, MCDM methods address uncertainty and subjectivity in decision-making, using techniques such as fuzzy logic or probabilistic models to handle uncertain information and allowing sound decisions even with incomplete data. Furthermore, they incorporate the subjective judgments and preferences of decision-makers, guaranteeing their adequate representation in the process [16]. In studies such as those by Reina-Usuga et al. (2018) [14], Martín-Gamboa et al. (2017) [17], and Hashemkhani Zolfani et al. (2023) [18], it is evident that the implementation of MCDM methods in sustainability-focused practices is very favorable, ensuring that they provide highly accurate and reliable resolutions.

The analytic hierarchy process (AHP), an MCDM method that provides a structured and systematic approach to decision-making, can be used to assign relative weights to various criteria based on their pairwise comparison at each level of the hierarchy, thus determining an arbitrary measure or index, whereby experts can change subjective judgments into objective measures [19,20]. The analytical network process (ANP) supports the resolution of complex situations, relationships, and interdependencies. This method, which is on the rise, allows the incorporation of qualitative, subjective, and intangible information into the same evaluation process using multiple criteria. For the above mentioned, the ANP is a tool that has been used in studies related to sustainability and, more specifically, in topics such as agriculture, food marketing, the evaluation of sustainability systems in the energy sector, and health systems, since this method provides valuable information with a deep focus on risk management and uncertainty [14,19,21].

Likewise, approaches combining AHP and ANP methods have been used, for example in the study by Daimi and Rebai (2023) [22] that combined AHP and ANP methods to evaluate 29 indicators of eight regional transit operators to propose a governance index of the sustainability of the transportation sector. In the study by Xiahui et al. (2021) [23], the authors combine the ANP method with the gray DEMATEL method to evaluate interactions for a product–service system. In both studies, the authors mention that, although the AHP and ANP methods proved to be very interesting, the latter has a great advantage over the results obtained with AHP from the perspective of priorities and the significance of the results. The authors mentioned above also emphasize that AHP is a general method to obtain criteria weights utilizing pairwise comparisons. However, if there are many criteria/alternatives, its comparisons become confusing and generate high levels of inconsistency. On the other hand, the ANP method can incorporate and quantify the interdependencies of the criteria without requiring a hierarchy; its judgments are based on inputs that will later be measured to obtain priorities. In this way, this method works under a network of elements to which a pairwise comparison is made [22,23,24,25].

This research work aims to prioritize organizational sub-risks with a focus on sustainability, offering the reader a high-value contribution to managing their risks. The ANP method is proposed as an innovative strategy for prioritizing risks and sub-risks, being a MCDM technique unexplored in the literature aimed at sustainability and risk prioritization. By providing a methodology for risk ranking, we seek to improve decision-making and reduce the distortion of qualitative assessment criteria, thus filling a gap in the literature that has not explicitly addressed this crucial aspect of organizational risk management. This research is developed in five parts: (i) specification of the methodology that will guide the entire research; (ii) characterization of organizational risks and sub-risks with a focus on sustainability; (iii) application of a survey using the 1AK tool (one-click survey) to a group of experts composed of senior executives from various industries; (iv) with the data obtained, it is proposed to prioritize sub-risks through the ANP method; and (v) finally, the study includes a comparison between the results obtained with AHP, according to the study by Yazo et al. (2024) [26], and the ANP results obtained in this research.

2. Methodology

While risk management began in financial institutions, its evolution has led to the realization that its scope must be holistic and that all risks must be managed based on understanding their interactions and not just as individual threats [6]. Therefore, over time, organizations have approached a more comprehensive risk management, where organizational risks with a focus on sustainability (geopolitical, economic, social, technological, and environmental) play a crucial role in risk management in different business sectors [26,27]. Risk management is configured as a strategic process, following fundamental steps involving risk identification, assessment, prioritization, and control. This structure facilitates an alignment with strategic planning, allowing organizations to deal with risks proactively. It is important to emphasize the idea of recognizing that risks are not static and that they evolve over time. Thus, organizations must maintain constant vigilance to effectively adapt to dynamic changes and maintain the integrity of their risk management [13,28]. The methodology proposed for this study will be discussed in detail below:

Initially, it is crucial to characterize the highest-priority risks in the organizational context. For this purpose, three global reports are reviewed and studied: the “Global Sustainable Development Report”, the “Enterprise Risk Management-Integrating with Strategy and Performance”, and the “Global Risk Report”. These provide a more assertive input to define five organizational risks with a focus on sustainability (geopolitical, economic, social, technological, and environmental). It is important to emphasize that the documentation studied is significant, since it allows decision-makers in different organizations to identify risks focused on the objectives, productive areas, and activities of each organizational sector in which this methodology is required [2,5,13,29].

Once the risks, and their sub-risks, subject to study have been obtained, a survey is prepared and answered by a group of experts using the 1AK (one-click survey) tool. The selection of this group of people is a crucial step in decision-making. In the studies by Tzeng and Huang (2011) [30] and Rajabi et al. (2020) [31], the importance of selecting a group of expert professionals at the time of criteria assessment is emphasized. These people must have sufficient knowledge and experience of the organizational risks characterized, ensuring that forming a solid group can ratify the quality of the results. Group decision-making takes advantage of a diversity of knowledge, but in order to reach consensus, the wide range of opinions of the expert group is valued. This diversity provides the basis for processing ideas systematically, efficiently, and credibly [32].

After collecting the survey data, the application of MCDM methods is performed. This methodological framework is recognized for its effectiveness in planning and its wide range of classification methods, which are developed according to the designer’s experience [33]. Decision-making in MCDM methods is based on multiple and contradictory criteria, covering problems typical of everyday life; they are classified into multi-objective decision-making (MODM) and multi-attribute decision-making (MADM). MODMs focus on continuous decision spaces and MADMs on discrete decision spaces. Figure 1 shows a detailed classification of these methods [34].

In this research, the application of MCDM methods, focusing on MADM methods, is proposed. These models facilitate the choice of preferences among alternatives, especially when faced with multiple attributes that are often in conflict. It is essential to mention that MADM models are helpful in evaluation, prioritization, and selection situations, which justifies their implementation in developing this case study. The specific MADM models chosen are as follows: (i) AHP, which is based on the intuitive conceptualization of complex problems through the development of a hierarchical structure. AHP enables decision-makers to organize MADM problems using a hierarchy of attributes composed of three levels—the overall objective or problem focus, followed by multiple attributes (criteria) and competing alternatives [34]. (ii) ANP, which is widely used for the solution of real-world problems, both in research and in practice, since it considers the complex and interrelated relationships between decision elements, as well as having the ability to employ quantitative and qualitative attributes simultaneously [37,38]. In the research of Tzeng and Huang (2011) [30], it is mentioned that the success of AHP as an MCDM method forged the idea of proposing ANP, in order to extend AHP, releasing it from the restrictions of a hierarchical structure, i.e., with criteria independent of each other. With this, the super matrices can be raised to the limiting powers and obtain global priority vectors with a specific network structure. In this study, the ANP method will be developed for the prioritization of sub-risks, and these results will be compared with those obtained in the research of Yazo-Cabuya et al. (2024) [26], in which the AHP method was used. The cosine similarity method will draw significant conclusions regarding the methodologies used, the prioritization results obtained, and other relevant aspects, providing a new perspective and deepening the understanding of organizational risk management with a focus on sustainability.

The AHP method is based on decomposing a complex problem into a hierarchy of criteria and alternatives, then comparing these alternatives on a peer-to-peer basis to establish their priorities. The key features of AHP include the following: (i) Hierarchy: it divides the problem into a hierarchical structure of criteria and sub-criteria, making it easier to decompose the problem and identify the relationships between elements. (ii) Pairwise comparisons: experts compare alternatives in pairs against each criterion, using a preference scale to determine which is more important in each case. (iii) Comparison matrix: these comparisons are represented in a comparison matrix, which is used to calculate the relative weights of each alternative and criterion. (iv) Consistency: the consistency of the comparisons is assessed to ensure the reliability of the results [30]. On the other hand, the ANP method is an extension of AHP, which allows the modelling of more complex relationships between the elements of the hierarchy. Among its characteristics are the following: (i) Dependency networks: it allows the modelling of dependency relationships between the elements of the hierarchy, not only through a hierarchical structure, but also through influence and feedback networks. (ii) Supermatrices: it uses supermatrices to represent the interrelationships between elements at different levels of the hierarchy and between different criteria and alternatives. (iii) Flexibility: it allows for greater flexibility in modelling complex problems by considering the interdependencies between elements and the feedback between them. (iv) Wider applications: ANP is used in a variety of fields, including business management, strategic planning, group decision-making, and investment project evaluation [14,30].

This methodology contributes to the inclusion of an innovative approach to the ranking of organizational sub-risks with a focus on sustainability. The use of the ANP method addresses a gap in risk management and sustainability, providing a tool for improved decision-making, which helps to reduce disruptions in the qualitative assessment of criteria. Additionally, it represents a breakthrough in the integration of ESG issues into risk management at the organizational level. It aligns with current trends in responsible business management and the global sustainable development agenda.

3. Results

The implementation of the methodology described in Section 2 is shown below.

3.1. Characterization of the Organizational Risk with a Focus on Sustainability

The characterization of organizational risks with a focus on sustainability was performed, taking as a reference widely recognized global reports prepared by organizations specialized in the ESG field, such as the Global Sustainable Development Report of the WBCSD and COSO (2018) [2], the Enterprise Risk Management–Integrating with Strategy and Performance of the independent group of scientists appointed by the Secretary-General (2019) [5] and the Global Risk Report of the World Economic Forum (WEF) (2023) [13]. As shown in Figure 2, the following five typologies of organizational risks with a focus on sustainability have been identified and analyzed: geopolitical, economic, social, technological, and environmental. This characterization provides a solid and up-to-date framework for understanding the potential challenges faced by various organizations in their pursuit of sustainable practices.

Additionally, Figure 3 helps to enrich the proposed characterization of organizational risks with a focus on sustainability. After thoroughly analyzing each risk, a suggested segmentation is presented for each established risk typology, such as the geopolitical, economic, social, technological, and environmental [2,5,39]. Therefore, the specific details of this characterization, including the ID sub-risk and ID-specific sub-risk, are available in Appendix A 

Table A1. Characterization of geopolitical sub-risks.

1	Geopolitical Risks DESCRIPTION: This Refers to the Categorization of Risks from the Geographical and Political Scope and How They Can Affect Organizations
ID	Sub-Risk	ID	Specific Sub-Risk
1.1	Lack of ethics in the conduct of business DESCRIPTION: Risk associated with lack of ethics by the organization’s employees in carrying out their activities and/or providing services.	1.1.1	Individual behavior related to intimidation, harassment, or misuse of media, among others.
		1.1.2	Behavior when working with clients related to inaccurate time recording due to fee pressures, inappropriate gifts, and entertainment that could be perceived as causing a conflict of interest, or requirements regarding client data.
		1.1.3	Commitment to third parties regarding hiring privileges or providing confidential information, among others.
		1.1.4	Behavior generated by the environment (political, cultural, regulatory) e.g., political donation pressure, social media behavior, or new laws and regulations involving the organization’s compliance with any new requirements, among others.
1.2	Anti-competitive practices DESCRIPTION: Risk associated with faults associated with unfair competition or monopolies on the part of the organization’s employees in carrying out their activities and/or providing services.	1.2.1	Exchanging or sharing information with competitors about products or services in which they compete.
		1.2.2	Routinely exchanging information on business issues (business information in a manner that allows adaptation to strategies) that may involve an information exchange agreement.
		1.2.3	Exclusion of small businesses from competition by adoption of rules or regulations.
		1.2.4	Attending industry meetings or industry groupings with competitors that may create the perception that competitors are sharing information.
		1.2.5	Using third parties or contractors to perform activities that are prohibited by law or guidelines.
		1.2.6	Agreeing with competitors on bids for specific projects, communicating or receiving bid prices from competitors, soliciting bid prices from customers, or using customers as intermediaries to discover competitors’ bids.
		1.2.7	To agree with competitors on the scope of services offered to the market, as well as on conditions related to price or other conditions, or to agree with competitors on the amount of compensation for personnel or on the conditions under which they can hire personnel from others.
		1.2.8	Abusing their position in the market by adopting conduct that may distort competition and that is not objectively justified.
1.3	Lack of transparency in taxation DESCRIPTION: Risk associated with lack of transparency on the part of organizations.	1.3.1	Tax evasion.
		1.3.2	Tax avoidance.
1.4	Non-compliance with regulations DESCRIPTION: Risk associated with failure to comply with legal requirements and other elements of the nature of organizations.	1.4.1	Non-compliance with legal requirements in environmental, health and safety at work, information security, or other areas, leading to sanctions.
		1.4.2	Failure to implement new or amended policies, procedures, and protocols.
		1.4.3	Lack of identification and/or inadequate assessment of risks or applicable legal requirements.
		1.4.4	Non-compliance with international or local regulations, leading to sanctions, including the prevention of further operations.
1.5	Corruption and instability DESCRIPTION: Risk associated with faults associated with acts of corruption on the part of an organization’s employees in the performance of their activities and/or provision of services.	1.5.1	Failure to meet the requirements of external independence and/or managing the complexity of, and ongoing changes to, independence regulations in the face of a growth agenda in new areas and changing expectations.
		1.5.2	Inadequate acceptance of a client due to reputational risk, money laundering, or a service due to lack of capabilities or non-compliance with the agreement.
		1.5.3	Inadequate acceptance of a supplier due to reputational risk, asset laundering, or a service due to lack of capacity or failure to comply with the agreement.
		1.5.4	Non-compliance with legal or professional requirements, including local policies and standards (including, where applicable, internal policies and standards), resulting in regulatory action and/or significant conflicts of interest.
1.6	Instability in state or government systems DESCRIPTION: Risk associated with failure associated with the instability of state or government systems that may affect organizations.	1.6.1	The failure of national governments to govern a nation of geopolitical significance as a result of weak rule of law, corruption, or political stalemate.
		1.6.2	Inability of regional or global institutions to resolve issues of economic, geopolitical, or environmental importance.
		1.6.3	A bilateral or multilateral dispute between states that becomes an economic (e.g., trade or currency wars, nationalization of resources), military, cyber, social, or other conflict.
		1.6.4	Large-scale terrorist attacks by individuals or non-state groups with political or religious objectives that successfully inflict large-scale human or material damage.
		1.6.5	State collapse of geopolitical importance due to internal violence, regional or global instability, military coup, civil conflict, failed states, etc.
		1.6.6	Deployment of weapons of mass destruction, nuclear, chemical, biological, or radiological technologies and materials, creating international crises and potential for significant destruction.
1.7	Customers, suppliers, and other stakeholders DESCRIPTION: Risk associated with faults associated with acts of corruption on the part of clients, suppliers, and other stakeholders that impact the performance of their activities and/or provision of services.	1.7.1	Practices associated with corruption by customers, suppliers, or other stakeholders.
		1.7.2	Anti-competitive practices carried out by customers, suppliers, or other stakeholders.
		1.7.3	Practices associated with illicit trade carried out by customers, suppliers, or other stakeholders.
1.8	Gender inequity DESCRIPTION: Risk associated with faults associated with gender inequality or discrimination that impact the performance of their activities and/or provision of services.	1.8.1	Laws and regulations that discriminate against women and LGBT populations.
		1.8.2	Insufficient representation of women and LGBT populations at political leadership levels.
		1.8.3	Gaps in legal frameworks that do not protect the rights of women and LGBT populations.
		1.8.4	Lack of laws regulating discrimination against women and LGBT populations.
1.9	Partnerships DESCRIPTION: Risk associated with partnerships that impact the performance of their activities and/or provision of services.	1.9.1	International alliances to support, for example, the generation of companies and employment, among others.
		1.9.2	National alliances that support, for example, the creation of businesses and employment, among others.
1.10	New policies DESCRIPTION: Risk associated with faults associated with gender inequality or discrimination that impact the performance of their activities and/or provision of services.	1.10.1	New international policies to support, for example, the generation of enterprises and employment, among others.
		1.10.2	New national policies to support, for example, the creation of businesses and employment, among others.

,

Table A2. Characterization of economic sub-risks.

2	Economic Risks DESCRIPTION: This Refers to the Categorization of Risks from the Economic Sphere and How They Can Affect Organizations
ID	Sub-Risk	ID	Specific Sub-Risk
2.1	Financial and commercial risks DESCRIPTION: Risk associated with financial risks that impact organizations in the performance of their activities and/or provision of services.	2.1.1	Non-compliance with minimum financial indicators required for the operation of the organization (includes profitability, no working capital).
		2.1.2	Loss of business opportunities due to the absence of certifications regarding management systems.
		2.1.3	Difficulty with collecting portfolio due to client insolvency.
		2.1.4	Insufficient resources to manage planned or new related activities.
		2.1.5	Difficulty with entering new business.
		2.1.6	Decrease in fees due to customer insolvency.
		2.1.7	Inadequate resilience of member companies to withstand a shock, whether economic, regulatory, or political, or inadequate contingency planning.
		2.1.8	Inability of a key territory to withstand a significant disruption caused by a major macroeconomic event, such as a major market correction, recession, political turmoil, or regulatory change.
		2.1.9	A significant failure in customer acceptance or continuity, or in the quality of management or service provision in existing and new services, with cross-border and global implications.
		2.1.10	Loss of market due to lack of supply of services required by the market (service innovation and competitive prices).
2.2	Instability in financial systems DESCRIPTION: Risk associated with the risks in the financial systems that impact the organizations in the accomplishment of their activities and/or provision of services.	2.2.1	Unsustainably overvalued assets such as commodities, housing, stocks, etc., in a major economy or region, causing, for example, economic bubbles.
		2.2.2	Prolonged near-zero inflation or deflation in a major economy or region.
		2.2.3	Collapse of a financial institution and/or malfunctioning of a financial system, affecting the world economy.
		2.2.4	Infrastructure networks (e.g., energy, transport, and communications) are not adequately invested in, improved, or secured, resulting in pressure or collapse, with consequences for the whole system.
		2.2.5	Fiscal crises in major economies due to excessive debt burdens that generate sovereign debt and/or liquidity crises.
		2.2.6	A sustained high level of unemployment or underutilization of the productive capacity of the employed population.
		2.2.7	Illicit trade in large-scale activities outside the legal framework, such as illicit financial flows, tax evasion, trafficking in persons, counterfeiting, and/or organized crime, that undermine social interactions and regional or international collaboration and global growth.
		2.2.8	Significant increases or decreases in energy prices that put further economic pressure on energy-dependent industries and consumers.
		2.2.9	Inflation: unmanageable increases in the general price levels of goods and services in major economies.
2.3	Socioeconomic risks DESCRIPTION: Risk associated with socioeconomic risks that impact organizations in the performance of their activities and/or provision of services.	2.3.1	Economic losses due to natural disasters.
		2.3.2	Economic depression caused by biological risk.
		2.3.3	High levels of unemployment caused by pandemics and/or political factors.
2.4	Poor academic level DESCRIPTION: Risk associated with the risks of educational failures that impact organizations in the realization of their activities and/or provision of services.	2.4.1	Low skills in education.
		2.4.2	Low-skilled human resources to compete in the labor market.
2.5	Water scarcity and sanitation DESCRIPTION: Risk associated with the risks of depletion of natural resources that impact organizations in carrying out their activities and/or provision of services.	2.5.1	Stagnation of economic development due to water scarcity.
		2.5.2	Lack of water sanitation.
2.6	Deficit in economic growth DESCRIPTION: Risk associated with the risks of lack of economic growth that impact organizations in the realization of their activities and/or provision of services.	2.6.1	Decrease in GDP growth rate due to pandemics or other social, political, or economic factors.
		2.6.2	Decrease in labor productivity due to pandemics or other social, political, or economic factors.
2.7	Low growth in industry, innovation, and infrastructure DESCRIPTION: Risk associated with the risks of lack of economic growth that impact organizations in the realization of their activities and/or provision of services.	2.7.1	Slow growth of industries due to pandemics or other social, political, or economic factors.
		2.7.2	Slow growth of industries due to lack of innovation.
		2.7.3	Slow growth of industries due to lack of investment in infrastructure.
2.8	Partnerships to achieve the objectives DESCRIPTION: Risk associated with partnership risks that impact organizations in the performance of their activities and/or service delivery.	2.8.1	Decrease in foreign direct investment due to the COVID-19 crisis.
		2.8.2	Collapse of world trade due to the COVID-19 crisis.

,

Table A3. Characterization of social sub-risks.

3	Social Risks DESCRIPTION: This Refers to the Categorization of Risks from the Social Environment and How They Can Affect Organizations
ID	Sub-Risk	ID	Specific Sub-Risk
3.1	Labor management DESCRIPTION: Risk associated with labor management risks that impact organizations in the performance of their activities and/or provision of services.	3.1.1	Failure to adequately plan for workforce-related changes (e.g., work automation); to attract, retain, and train the right talent to provide future leaders and serve customers; and to ensure that resources can be deployed quickly to take advantage of opportunities.
		3.1.2	Poor understanding of demographic changes and social and generational trends to attract and retain human talent.
3.2	Safety and health at work DESCRIPTION: Risk associated with occupational safety and health risks that impact organizations in the performance of their activities and/or provision of services.	3.2.1	Inadequate identification of the dangers and risks in safety and health at work that can materialize in the activities and projects developed.
		3.2.2	Inadequate evaluation of the risks identified in organizations.
		3.2.3	Insufficient actions to keep hazards and risks under control.
		3.2.4	Not having affiliations with the social security system or labor risks.
		3.2.5	Inadequate management to prevent work accidents and occupational diseases.
		3.2.6	Work-related deaths.
		3.2.7	Deaths associated with traffic accidents.
3.3	Human capital development DESCRIPTION: Risk associated with human capital development risks that impact organizations in the performance of their activities and/or service delivery.	3.3.1	Inability to conduct medium- and long-term talent planning for key positions.
		3.3.2	Lack of resources for the training of talent in key positions.
3.4	Labor standards in the supply chain DESCRIPTION: Risk associated with the risks of absence of work profiles that impact organizations in carrying out their activities and/or providing services.	3.4.1	Absence of profiles with the key skills or capabilities for the execution of activities and/or service provision.
		3.4.2	Lack of development of internal profiles with the key skills or capabilities for the execution of activities and/or service provision.
3.5	Safety and quality of products and services DESCRIPTION: Risk associated with safety and quality risks of products that impact organizations in the performance of their activities and/or provision of services.	3.5.1	Generation of non-conforming products or services without a clear flow in the process that involves non-compliance with the established scope or deliverables with clients or customers, who are dissatisfied with the services provided.
		3.5.2	Generation of products or services without safety standards or without a clear flow in the process, which involves non-compliance with the scope or deliverables established with clients or customers, who are dissatisfied with the services provided.
3.6	Chemical safety DESCRIPTION: Risk associated with safety and quality risks of products that impact organizations in the performance of their activities and/or provision of services.	3.6.1	Lack of assurance in the life cycle of the product and/or service.
		3.6.2	Lack of compliance with legal requirements regarding chemical safety.
3.7	Demographic and health risks DESCRIPTION: Risk associated with lack of associated demographic and health issues that may affect organizations.	3.7.1	Poorly planned cities, urban expansion, and associated infrastructure that create social, environmental, and health challenges.
		3.7.2	Poor conditions of public transport that increase the risk of infection.
		3.7.3	Inadequate urban planning that leads to the exposure of people to more dangers.
		3.7.4	Inadequate, unaffordable, or unreliable access to appropriate quantities and quality of food and nutrition on a large scale.
		3.7.5	Physical and mental health complications of overweight.
		3.7.6	Large-scale involuntary migration induced by conflict, disaster, or environmental or economic reasons.
		3.7.7	Social movements or major protests (e.g., street riots, social unrest) that alter political or social stability, negatively affecting populations and economic activity.
		3.7.8	Armed conflict.
		3.7.9	Bacteria, viruses, parasites, or fungi that cause the uncontrolled spread of infectious diseases (e.g., as a result of resistance to antibiotics, antivirals, or other treatments), resulting in widespread deaths and economic disruption.
		3.7.10	Conditions of poor health caused by environmental factors.
		3.7.11	A significant decrease in the quality and quantity of available fresh water, with consequent adverse effects on human health and/or economic activity.
3.8	Lack of well-being and health DESCRIPTION: Risk associated with the risks of lack of well-being and health that impact organizations in carrying out their activities and/or providing services.	3.8.1	Restrictions on access to essential health services.
		3.8.2	Health complications due to lack of care in the gestational and maternity process.
		3.8.3	Public health emergencies caused by disease outbreaks.
3.9	Controversial sources DESCRIPTION: Risk associated with the risks of lack of management and understanding in the communities that impact organizations in the realization of their activities and/or provision of services.	3.9.1	Lack of understanding and management in terms of agreeing with stakeholders such as communities or associations, among others.
		3.9.2	Ignorance of local regulations that affect communities.
3.10	Partnerships, welfare, and professional growth DESCRIPTION: Risk associated with alliances, well-being, and professional growth that impact organizations in the realization of their activities and/or provision of services.	3.10.1	Generation of alliances or support of non-profit entities that strengthen the social programs of the organization.
		3.10.2	Incorporation of programs or campaigns for the promotion of the health and well-being of the collaborators as well as channels of communication.
		3.10.3	New forms of work, like home offices, remote work, or working at home.
		3.10.4	Implementing professional growth programs.
		3.10.5	Attracting key talent to increase productivity and strengthen the competitiveness of the organization in a market as dynamic and diverse as the current one.
		3.10.6	Inclusive job offers with fair remuneration based on the functions and responsibilities of the position.
		3.10.7	Equal employment opportunities for women and men.

,

Table A4. Characterization of technological sub-risks.

4	Technological Risks DESCRIPTION: This Refers to the Categorization of Risks from Technology and How They Can Affect Organizations
ID	Sub-Risk	ID	Specific Sub-Risk
4.1	Information security risks and technological changes DESCRIPTION: Risk associated with information security and technological changes that impact organizations in the performance of their activities and/or provision of services.	4.1.1	Deficiency in adapting to the speed of technological change.
		4.1.2	Risk of not managing and maintaining company, customer, or third-party data to the highest standards of compliance and regulation.
		4.1.3	Failure to manage the security of company, customer, or other third-party information causes legal, reputational, or brand damage.
		4.1.4	Failure to respond to and prepare for business continuity.
		4.1.5	Failure to manage the availability of critical systems that affects the ability to provide services to customers and manage the business.
		4.1.6	Insufficient resources to manage IT functions, including information security and the help desk, among others.
		4.1.7	Leakage or loss of sensitive business information due to technological failures, obsolescence in information systems, or lack of awareness of human resources.
		4.1.8	Failure to respond adequately and quickly to an important issue with network-, security-, technology-, or customer-related implications.
4.2	The adverse consequences of technological advances DESCRIPTION: Risk associated with technological advances that impact organizations in the performance of their activities and/or provision of services.	4.2.1	Intentional or unintentional adverse consequences of technological advances such as artificial intelligence, geoengineering, or synthetic biology that cause human, environmental, or economic damage.
		4.2.2	Lack of identification and/or inadequate assessment of risks or applicable legal requirements.
4.3	Breakdown of critical information infrastructure and networks DESCRIPTION: Risks associated with critical information infrastructure and networks that impact organizations in the performance of their activities and/or provision of services.	4.3.1	Cyber-dependency that increases vulnerability to interruptions of critical information infrastructure (e.g., internet, satellites) and networks, causing widespread disruption.
		4.3.2	Lack of regulation in a country regarding infrastructure and networks.
4.4	Large-scale cyber-attacks DESCRIPTION: Risk associated with cyber-attacks that impact organizations in the performance of their activities and/or provision of services.	4.4.1	Large-scale cyber-attacks or malware that cause major economic damage, geopolitical tensions, or widespread loss of confidence in the internet.
		4.4.2	Lack of investment in cybersecurity in organizations.
4.5	Massive data fraud or theft incident DESCRIPTION: Risk associated with massive incidents of data fraud or theft of data that impact organizations in the conduct of their activities and/or provision of services.	4.5.1	The illicit exploitation of private or official data that takes place on an unprecedented scale.
		4.5.2	Lack of investment in cybersecurity in organizations.
		4.5.3	Lack of policies regulating the use of personal data.
4.6	Connectivity failures DESCRIPTION: Risk associated with connectivity failures that impact organizations in the performance of their activities and/or provision of services.	4.6.1	Weaknesses in connectivity infrastructure from home or exposure to computer attacks, among others.
		4.6.2	Lack of investment in connectivity infrastructure in organizations, including working at home.

and

Table A5. Characterization of environmental sub-risks.

5	Environmental Risks DESCRIPTION: This Refers to the Categorization of Risks from the Environmental Sphere and the Significant Impacts of Climate Change and How They Can Affect Organizations
ID	Sub-Risk	ID	Specific Sub-Risk
5.1	Carbon emissions DESCRIPTION: Risk associated with carbon emissions caused by organizations in carrying out their activities and/or providing services.	5.1.1	Generation of greenhouse gases from the use of non-renewable energy.
		5.1.2	Greenhouse gas emissions from the use of fossil fuels.
5.2	Carbon footprint measurement DESCRIPTION: Risk associated with measuring the carbon footprint of the impacts caused by organizations in carrying out their activities and/or providing services.	5.2.1	Lack of compensation for the carbon footprint emitted in carrying out activities and/or providing services.
		5.2.2	Inadequate identification of the environmental impacts that can materialize in the activities and projects developed.
5.3	Vulnerability to climate change DESCRIPTION: Risk associated with climate change impacts caused by organizations in carrying out their activities and/or providing services.	5.3.1	Major damage to property, infrastructure, and/or the environment, as well as loss of life caused by extreme weather events (e.g., floods, storms).
		5.3.2	Significant damage to property, infrastructure, and/or the environment, as well as loss of human life, caused by geophysical disasters such as earthquakes, volcanic activity, landslides, tsunamis, or geomagnetic storms.
		5.3.3	Natural disasters caused by climate change.
5.4	Water depletion DESCRIPTION: Risk associated with water depletion caused by organizations in carrying out their activities and/or providing services.	5.4.1	A significant decrease in the quality and quantity of water with consequent harmful effects on the environment.
		5.4.2	Lack of water quality regulation in the country.
5.5	Land use and biodiversity DESCRIPTION: Risk associated with land use and biodiversity caused by organizations in carrying out their activities and/or providing services.	5.5.1	Irreversible consequences for the environment, with the consequent depletion of resources for humanity and industries.
		5.5.2	Lack of identification and/or inadequate assessment of impacts or applicable legal requirements.
5.6	Sources of raw materials DESCRIPTION: Risk associated with the sources of raw materials used by organizations in carrying out their activities and/or providing services.	5.6.1	Raw material shortages and environmental damage.
		5.6.2	Ignorance of the life cycle of the product or service.
5.7	Toxic emissions and waste DESCRIPTION: Risk associated with toxic emissions and waste generated by organizations in the course of their activities and/or provision of services.	5.7.1	Failure to prevent major man-made damage and disasters, including environmental crimes, oil spills, or radioactive contamination, causing damage to human life and health, infrastructure, property, economic activity, or the environment.
		5.7.2	Lack of regulations associated with toxic emissions and waste in the country.
5.8	Materials used in packaging and waste DESCRIPTION: Risk associated with materials used in packaging and waste generated by organizations in the performance of their activities and/or provision of services.	5.8.1	Not considering the life cycle of the product in the waste produced from the realization of products and services.
		5.8.2	Not considering the life cycle of the product in the process of packaging of products and services.
		5.8.3	Increase in the generation of electronic waste.
		5.8.4	Inadequate infrastructure to manage electronic waste.
		5.8.5	Lack of participation in or inclusion of the sustainable development goals (United Nations—Agenda 2030) within environmental programs in order to reduce the environmental impact generated and create social awareness.

.

3.2. Group of Experts

This study is enhanced by the contribution of the diverse and solid experience of a group of experts comprised of executives from industries such as oil and gas, services, auditing, consulting, finance, and manufacturing, as detailed in

Table 1. Group of experts.

Type of Position	Number of People	Years of Experience
Accountants with specialization and/or master’s degree in auditing, digital transformation, and/or sustainability	22	20
Economists with specialization in risk management	18	15
Industrial engineers with specialization in occupational health and safety, sustainability, and/or risk management	12	15
Systems engineering professionals with specialization in cybersecurity	7	25
Psychologists with specialization in human resources	10	25
Environmental professionals with specialization in risk management	10	15

. The formation of this group focuses on organizational risk specialization with a focus on sustainability, encompassing economic, environmental, geopolitical, social and technological aspects, as well as corporate risk factors. These leaders are key decision-makers in their respective organizations and play a crucial role in risk management.

Once the group of experts was formed, their opinions were consolidated in a survey using the 1AK (one-click survey) tool, in which they selected the level of influence and relevance of organizational risks with a focus on sustainability. Considering the field in which the surveyed experts worked, accurate information could be obtained thanks to their experience and competence in risk management in their daily work. Using the scale shown in

Table 2. ANP method comparison scale.

Linguistic Scale	Value
No influence	1
Very low influence	3
Low influence	5
High influence	7
Very high influence	9

, a paired comparison was made between the previously defined sub-risks (see Figure 3), contributing to a comprehensive and accurate assessment of these critical aspects in their respective fields of expertise. The interdisciplinary nature of the selected group of experts made it possible to obtain a comprehensive view of the overall dynamics. Likewise, no sectoral biases were introduced, which provided an unbiased appreciation of the dynamics in question.

In this study, the ANP method was used to perform the calculations to obtain information related to the most preferred criteria (sub-risks). Once the expert opinions had been compiled through the paired survey, a comparison matrix was constructed, which was elaborated by comparing sub-risks of the same typology. For the weighting of criteria and options, matrix calculations with vectors and eigenvalues were used to generate the hierarchy of sub-risks. In order to appropriately aggregate the information gathered through the survey, individual comparison matrices were constructed as follows; for each pair of factors (i and j), where i and j represent the risk and sub-risk typologies (of the same risk typology), respectively, a comparison matrix (Cij) was created using the evaluations provided by the 79 experts.

$$Cij=\left[\begin{array}{cc}0& cij\\ 0& 1\end{array}\right]$$

(1)

The calculation of each Cij element was based on the application of the geometric mean method (GMM), integrating the opinions of the 79 experts [40]:

$$c_{ij}={\left(\prod _{p=1}^{79}{C}_{ij}^p\right)}^{\raisebox{1ex}{$1$}\!\left/ \!\raisebox{-1ex}{$79$}\right.}$$

(2)

where p denotes the valuation of each of the experts. Following Equation (2), this procedure was iterative, evaluating the different categorized sub-risks. Subsequently, the sum of all the individual comparison matrices was carried out to obtain a total matrix called $C_{total}$.

$$C_{total}=\sum C_{ij}$$

(3)

Finally, the preparation of the information for analysis with the ANP method included the normalization of the total matrix $C_{total}$, where each element was divided by the sum of the elements of its row, according to Equation (4):

$$N_{ij}=\frac{C_{total,ij}}{{\sum }_j{C}_{total,ij}}$$

(4)

3.3. Application of the ANP Model

The ANP method helps to analyze potential relationships and make group decisions. The structure of the components is analyzed according to the experts’ point of view and criteria, to prioritize sustainability sub-risks. Expert knowledge is examined and analyzed to contribute to a better understanding of the constituent elements and how they relate to each other. The development of the ANP method consists of two fundamental steps: the first is the structuring of the problem (network construction), and the second is the calculation of the priorities of the elements. To carry out the calculation of the ANP method, Google Colab was used, an online platform that provides free access to computational resources, making it easier to process data and execute complex algorithms. Refer to Appendix B.1, Appendix B.2, Appendix B.3, Appendix B.4 and Appendix B.5 for more details on the methodology and the results obtained. However, the steps to apply the ANP method are explained below [41,42,43].

Step 1: Analysis of the influence network. An interfactor dominance matrix is made, described by the influence or not between the criteria, on the following scale: 0 (no influence), 1 (influence). It is important to note that the diagonal of the interfactor dominance matrix will consist of zeros.

The terms aii, jj of block Rij of the interfactor dominance matrix shown in

Table 3. Interfactor dominance matrix.

		Rj
		rj1	rj2	rj3	rj4	rj5	rj6	rj7
Ri	ri1	0	ai1j2	ai1j3	ai1j4	ai1j5	ai1j6	ai1j7
	ri2	ai2j1	0	ai2j3	ai2j4	ai2j5	ai2j6	ai2j7
	ri3	ai3j1	ai3j2	0	ai3j4	ai3j5	ai3j6	ai3j7
	ri4	ai4j1	ai1j2	ai1j3	0	ai1j5	ai1j6	ai1j7
	ri5	ai5j1	ai1j2	ai1j3	ai1j4	0	ai1j6	ai1j7
	ri6	ai6j1	ai1j2	ai1j3	ai1j4	ai1j5	0	ai1j7
	ri7	ai7j2	ai7j3	ai7j4	ai7j5	ai7j6	ai7j7	0

represent the influence that the element rii of component Ri has on the element rjj of component Rj. In this case, a 1 is assigned when the element eii influences the element ejj and a 0 otherwise, or there is no influence at all. Once this step is completed, the matrix shown in

Table 4. Interfactor dominance matrix of the case study.

		Rj
		rj1	rj2	rj3	rj4	rj5	rj6	rj7
Ri	ri1	0	1	1	1	1	1	1
	ri2	1	0	1	1	1	1	1
	ri3	1	1	0	1	1	1	1
	ri4	1	1	1	0	1	1	1
	ri5	1	1	1	1	0	1	1
	ri6	1	1	1	1	1	0	1
	ri7	1	1	1	1	1	1	0

is obtained.

Step 2: Calculation of priorities between elements (original supermatrix), developing an initial matrix described by scores (see Table 2). The described influence scales are established as follows: 1 (no influence), 3 (low influence), 5 (medium influence), 7 (high influence), and 9 (very high influence). The group of experts surveyed should be asked to make paired comparisons according to the influence and direction between the criteria. Once these paired comparisons are obtained, the paired comparisons matrix is constructed in which wij is denoted as the degree of influence on the criterion that i has on j; then the average matrix is obtained. This step has been developed with the answers obtained through the 1AK (one-click survey).

Step 3: Weighted supermatrix. The eigenvectors of the paired comparison matrices are found after verifying consistency. With the resulting vectors, they will be replaced in the interfactor dominance matrix (see Table 4). The values of the original supermatrix are weighted, and a supermatrix that is stochastic by columns is obtained, i.e., the sum of its values per column is 1 [44].

Table 5. Weighted supermatrix of geopolitical risk.

Weighted Supermatrix Geopolitical Risk
	1.1	1.2	1.3	1.4	1.5	1.6	1.7	1.8	1.9	1.10
1.1	0	0.1775	0.1843	0.1811	0.1868	0.1795	0.1697	0.1716	0.1738	0.1772
1.2	0.1295	0	0.1256	0.1268	0.1256	0.1179	0.1115	0.1152	0.1123	0.1109
1.3	0.1589	0.1465	0	0.1542	0.1512	0.1503	0.1441	0.1421	0.1414	0.1385
1.4	0.1667	0.1508	0.1575	0	0.1610	0.1463	0.1471	0.1472	0.1436	0.1448
1.5	0.1798	0.1701	0.1762	0.1743	0	0.1619	0.1559	0.1583	0.1532	0.1559
1.6	0.1196	0.1155	0.1146	0.1203	0.1224	0	0.1045	0.1043	0.1031	0.1025
1.7	0.0679	0.0647	0.0634	0.0646	0.0678	0.0651	0	0.0569	0.0593	0.0603
1.8	0.0706	0.0665	0.0687	0.0684	0.0708	0.0687	0.0659	0	0.0615	0.0607
1.9	0.0540	0.0533	0.0536	0.0547	0.0569	0.0544	0.0505	0.0514	0	0.0492
1.10	0.0531	0.0553	0.0562	0.0555	0.0575	0.0559	0.0508	0.0530	0.0518	0

,

Table 6. Weighted supermatrix of economic risk.

Weighted Supermatrix Economic Risk
	2.1	2.2	2.3	2.4	2.5	2.6	2.7	2.8
2.1	0	0.1011	0.0985	0.0851	0.0883	0.1031	0.0975	0.0897
2.2	0.1366	0	0.1554	0.1365	0.1509	0.1579	0.1653	0.1491
2.3	0.1007	0.1101	0	0.1144	0.1145	0.1315	0.1178	0.1149
2.4	0.1123	0.1180	0.1030	0	0.1141	0.1112	0.1136	0.1127
2.5	0.1520	0.1522	0.1474	0.1441	0	0.1543	0.1535	0.1514
2.6	0.1755	0.1988	0.1661	0.1961	0.1975	0	0.2079	0.1930
2.7	0.1723	0.1673	0.1817	0.1781	0.1842	0.1831	0	0.1893
2.8	0.1507	0.1526	0.1479	0.1458	0.1506	0.1590	0.1444	0

,

Table 7. Weighted supermatrix of social risk.

Weighted Supermatrix Social Risk
	3.1	3.2	3.3	3.4	3.5	3.6	3.7	3.8	3.9	3.10
3.1	0	0.0572	0.0601	0.0592	0.0580	0.0599	0.0627	0.0629	0.0601	0.0626
3.2	0.0875	0	0.0923	0.0888	0.0898	0.0940	0.0937	0.0887	0.0877	0.0917
3.3	0.1114	0.1113	0	0.1158	0.1145	0.1254	0.1197	0.1224	0.1117	0.1152
3.4	0.0774	0.0784	0.0796	0	0.0828	0.0809	0.0833	0.0860	0.0840	0.0852
3.5	0.0945	0.0952	0.0993	0.0923	0	0.1045	0.1046	0.1000	0.0986	0.0892
3.6	0.1690	0.1705	0.1703	0.1732	0.1690	0	0.1722	0.1704	0.1689	0.1674
3.7	0.1271	0.1304	0.1364	0.1327	0.1240	0.1462	0	0.1405	0.1364	0.1404
3.8	0.1205	0.1307	0.1262	0.1231	0.1288	0.1412	0.1329	0	0.1310	0.1379
3.9	0.1035	0.1091	0.1132	0.1016	0.1079	0.1174	0.1116	0.1121	0	0.1104
3.10	0.1092	0.1172	0.1227	0.1132	0.1252	0.1305	0.1193	0.1171	0.1215	0

,

Table 8. Weighted supermatrix of technological risk.

Weighted Supermatrix Technological Risk
	4.1	4.2	4.3	4.4	4.5	4.6
4.1	0	0.1490	0.1358	0.1774	0.2174	0.1563
4.2	0.0981	0	0.0910	0.1051	0.1235	0.0928
4.3	0.1142	0.0960	0	0.1203	0.1263	0.1006
4.4	0.3235	0.2965	0.2933	0	0.3719	0.2833
4.5	0.3351	0.3399	0.3582	0.4426	0	0.3670
4.6	0.1291	0.1186	0.1216	0.1546	0.1609	0

and

Table 9. Weighted supermatrix of environmental risk.

Weighted Supermatrix Environmental Risk
	5.1	5.2	5.3	5.4	5.5	5.6	5.7	5.8
5.1	0	0.1675	0.1901	0.1769	0.1814	0.1656	0.1641	0.1695
5.2	0.0603	0	0.0632	0.0627	0.0634	0.0595	0.0630	0.0606
5.3	0.1496	0.1460	0	0.1705	0.1673	0.1627	0.1639	0.1456
5.4	0.2001	0.1751	0.1830	0	0.1821	0.1844	0.1975	0.1895
5.5	0.1309	0.1207	0.1320	0.1467	0	0.1353	0.1498	0.1369
5.6	0.1323	0.1150	0.1181	0.1313	0.1247	0	0.1336	0.1218
5.7	0.1988	0.1666	0.1846	0.1903	0.1644	0.1741	0	0.1763
5.8	0.1279	0.1092	0.1291	0.1215	0.1165	0.1183	0.1282	0

show the weighted matrices of geopolitical, economic, social, technological, and environmental risks, respectively.

Step 4: Calculation of the limit supermatrix. This involves raising to successive powers the weighted supermatrix, as evidenced in Equation (5), until it converges to a certain value where the columns of this supermatrix are all equal and represent the influence that the different elements of the system have on the decision process, where k is the number of iterations performed until the matrix converges.

$$R_{Limit}=\underset{k\to \mathrm{\infty }}{\lim }{R}^{\left(k\right)}$$

(5)

Table 10. Supermatrix limiting geopolitical risk.

Supermatrix Limiting Geopolitical Risk
	1.1	1.2	1.3	1.4	1.5	1.6	1.7	1.8	1.9	1.10
1.1	0.1523	0.1523	0.1523	0.1523	0.1523	0.1523	0.1523	0.1523	0.1523	0.1523
1.2	0.1089	0.1089	0.1089	0.1089	0.1089	0.1089	0.1089	0.1089	0.1089	0.1089
1.3	0.1303	0.1303	0.1303	0.1303	0.1303	0.1303	0.1303	0.1303	0.1303	0.1303
1.4	0.1338	0.1338	0.1338	0.1338	0.1338	0.1338	0.1338	0.1338	0.1338	0.1338
1.5	0.1443	0.1443	0.1443	0.1443	0.1443	0.1443	0.1443	0.1443	0.1443	0.1443
1.6	0.1030	0.1030	0.1030	0.1030	0.1030	0.1030	0.1030	0.1030	0.1030	0.1030
1.7	0.0606	0.0606	0.0606	0.0606	0.0606	0.0606	0.0606	0.0606	0.0606	0.0606
1.8	0.0637	0.0637	0.0637	0.0637	0.0637	0.0637	0.0637	0.0637	0.0637	0.0637
1.9	0.0510	0.0510	0.0510	0.0510	0.0510	0.0510	0.0510	0.0510	0.0510	0.0510
1.10	0.0520	0.0520	0.0520	0.0520	0.0520	0.0520	0.0520	0.0520	0.0520	0.0520
CI	0.0103	0.0139	0.0141	0.0131	0.0133	0.0113	0.0123	0.0125	0.0138	0.0108

,

Table 11. Supermatrix limiting economic risk.

Supermatrix Limiting Economic Risk
	2.1	2.2	2.3	2.4	2.5	2.6	2.7	2.8
2.1	0.0870	0.0870	0.0870	0.0870	0.0870	0.0870	0.0870	0.0870
2.2	0.1318	0.1318	0.1318	0.1318	0.1318	0.1318	0.1318	0.1318
2.3	0.1041	0.1041	0.1041	0.1041	0.1041	0.1041	0.1041	0.1041
2.4	0.1010	0.1010	0.1010	0.1010	0.1010	0.1010	0.1010	0.1010
2.5	0.1313	0.1313	0.1313	0.1313	0.1313	0.1313	0.1313	0.1313
2.6	0.1615	0.1615	0.1615	0.1615	0.1615	0.1615	0.1615	0.1615
2.7	0.1524	0.1524	0.1524	0.1524	0.1524	0.1524	0.1524	0.1524
2.8	0.1308	0.1308	0.1308	0.1308	0.1308	0.1308	0.1308	0.1308
CI	0.0267	0.0324	0.0261	0.0341	0.0412	0.0292	0.0349	0.0403

,

Table 12. Supermatrix limiting social risk.

Supermatrix Limiting Social Risk
	3.1	3.2	3.3	3.4	3.5	3.6	3.7	3.8	3.9	3.10
3.1	0.0570	0.0570	0.0570	0.0570	0.0570	0.0570	0.0570	0.0570	0.0570	0.0570
3.2	0.0833	0.0833	0.0833	0.0833	0.0833	0.0833	0.0833	0.0833	0.0833	0.0833
3.3	0.1051	0.1051	0.1051	0.1051	0.1051	0.1051	0.1051	0.1051	0.1051	0.1051
3.4	0.0760	0.0760	0.0760	0.0760	0.0760	0.0760	0.0760	0.0760	0.0760	0.0760
3.5	0.0896	0.0896	0.0896	0.0896	0.0896	0.0896	0.0896	0.0896	0.0896	0.0896
3.6	0.1454	0.1454	0.1454	0.1454	0.1454	0.1454	0.1454	0.1454	0.1454	0.1454
3.7	0.1200	0.1200	0.1200	0.1200	0.1200	0.1200	0.1200	0.1200	0.1200	0.1200
3.8	0.1163	0.1163	0.1163	0.1163	0.1163	0.1163	0.1163	0.1163	0.1163	0.1163
3.9	0.0997	0.0997	0.0997	0.0997	0.0997	0.0997	0.0997	0.0997	0.0997	0.0997
3.10	0.1077	0.1077	0.1077	0.1077	0.1077	0.1077	0.1077	0.1077	0.1077	0.1077
CI	0.0217	0.0239	0.0230	0.0199	0.0177	0.0197	0.0219	0.0209	0.0236	0.0157

,

Table 13. Supermatrix limiting technological risk.

Supermatrix Limiting Technological Risk
	4.1	4.2	4.3	4.4	4.5	4.6
4.1	0.1518	0.1518	0.1518	0.1518	0.1518	0.1518
4.2	0.0960	0.0960	0.0960	0.0960	0.0960	0.0960
4.3	0.1037	0.1037	0.1037	0.1037	0.1037	0.1037
4.4	0.2464	0.2464	0.2464	0.2464	0.2464	0.2464
4.5	0.2760	0.2760	0.2760	0.2760	0.2760	0.2760
4.6	0.1261	0.1261	0.1261	0.1261	0.1261	0.1261
CI	0.0056	0.0232	0.0151	0.0178	0.0093	0.0224

and

Table 14. Supermatrix limiting environmental risk.

Supermatrix Limiting Environmental Risk
	5.1	5.2	5.3	5.4	5.5	5.6	5.7	5.8
5.1	0.1484	0.1484	0.1484	0.1484	0.1484	0.1484	0.1484	0.1484
5.2	0.0583	0.0583	0.0583	0.0583	0.0583	0.0583	0.0583	0.0583
5.3	0.1375	0.1375	0.1375	0.1375	0.1375	0.1375	0.1375	0.1375
5.4	0.1590	0.1590	0.1590	0.1590	0.1590	0.1590	0.1590	0.1590
5.5	0.1212	0.1212	0.1212	0.1212	0.1212	0.1212	0.1212	0.1212
5.6	0.1124	0.1124	0.1124	0.1124	0.1124	0.1124	0.1124	0.1124
5.7	0.1537	0.1537	0.1537	0.1537	0.1537	0.1537	0.1537	0.1537
5.8	0.1095	0.1095	0.1095	0.1095	0.1095	0.1095	0.1095	0.1095
CI	0.0165	0.0327	0.0202	0.0315	0.0220	0.0315	0.0235	0.0306

below show the limit super matrices for each of the risk typologies:

4. Discussion

The results presented in this research, considering the characterization of the proposed sustainability risks and through the application of the ANP method, show that, considering the judgment of the experts consulted, it was possible to analyze the structure of the components of each of the risks such as the geopolitical, economic, social, technological, and environmental. In this case, as part of the presentation of the results, the sub-risk prioritizations were obtained for each of the sustainability risks, as presented in

Table 15. Prioritization matrix.

Item	1. Geopolitical	Item	2. Economical	Item	3. Social	Item	4. Technological	Item	5. Environmental
1.1	0.1523	2.1	0.0870	3.1	0.0570	4.1	0.1518	5.1	0.1484
1.2	0.1089	2.2	0.1318	3.2	0.0833	4.2	0.0960	5.2	0.0583
1.3	0.1303	2.3	0.1041	3.3	0.1051	4.3	0.1037	5.3	0.1375
1.4	0.1338	2.4	0.1010	3.4	0.0760	4.4	0.2464	5.4	0.1590
1.5	0.1443	2.5	0.1313	3.5	0.0896	4.5	0.2760	5.5	0.1212
1.6	0.1030	2.6	0.1615	3.6	0.1454	4.6	0.1261	5.6	0.1124
1.7	0.0606	2.7	0.1524	3.7	0.1200			5.7	0.1537
1.8	0.0637	2.8	0.1308	3.8	0.1163			5.8	0.1095
1.9	0.0510			3.9	0.0997
1.10	0.0520			3.10	0.1077

.

With the data shown in Table 15, the following sub-risk prioritizations were obtained:

• Those sub-risks with the highest priority in the geopolitical risk typology are 1.1 Lack of ethics in the conduct of business, 1.5 Corruption and instability, and 1.4 Non-compliance with regulations.
• Those sub-risks with the highest prioritization in the economic risk typology are 2.6 Deficit in economic growth, 2.7 Low growth in industry, innovation, and infrastructure, and 2.2 Instability in financial systems.
• Those sub-risks with the highest priority in the social risk typology are 3.6 Chemical safety, 3.7 Demographic and health risks, and 3.8 Lack of well-being and health.
• Those sub-risks with the highest prioritization in the technological risk typology are 4.5 Massive data fraud or theft incident, 4.4 Large-scale cyber-attacks, and 4.1 Information security risks and technological changes.
• Those sub-risks with the highest prioritization in the environmental risk typology are 5.4 Water depletion, 5.7 Toxic emissions and waste, and 5.1 Carbon emissions.

In this study, an analysis was conducted to compare the risk prioritization results of the ANP method developed in this research and the AHP method performed by Yazo-Cabuya et al. (2024) [26]. To perform this comparison, the cosine similarity analysis method was employed. This quantitative approach measures the similarity between two data sets based on the orientation of their vectors in a multidimensional space [45]. In this context, each data set represents the priorities assigned to the risks by AHP and ANP. This cosine similarity analysis allows for an identification of agreement between AHP and ANP in risk prioritization. A high degree of similarity would support consistency between the models, while discrepancies could point to significant differences in risk assessment. Cosine similarity analysis is widely used to assess the similarity between two vectors, the characterized risk and sub-risk typologies. We can provide an objective measure of the semantic relationship between the analyzed information by determining the cosine similarity between two data sets by applying Equation (6), defined below [46,47].

$$similitary=\frac{A·B}{‖A‖·‖B‖}$$

(6)

where:

• A∙B is the dot product (scalar) between vectors A and B.
• ‖A‖∙‖B‖ are the Euclidean norms of vectors A and B, respectively.

The steps to perform the cosine similarity calculation are described below:

Step 1: Calculation of the dot product. This is calculated by adding the product of its corresponding components through the following formula:

$$A·B={\sum }_{i=1}^n(A_i·B_i)$$

(7)

where n is the length of the vectors.

Step 2: Calculate Euclidean norms. Considering the following formulas:

$$‖A‖=\sqrt{{{\sum }_{i=1}^n(A_i)}^2}$$

(8)

$$‖B‖=\sqrt{{{\sum }_{i=1}^n(B_i)}^2}$$

(9)

Step 3. Calculate the cosine similarity through Equation (6).

The cosine similarity metric results in a scalar in the range of −1 to 1, where a value of 1 denotes full similarity, 0 implies no similarity, and −1 indicates inverse similarity. Values close to 1 in the results suggest a high correlation between the ANP and AHP results. A coefficient close to 1 suggests that the AHP and ANP provide consistent and similar results in the assessment and prioritization of risks. This reinforces the reliability of both models and the consistency in the perception of the importance of the assessed risks and indicates a reciprocal validation between both models. This finding reinforces confidence in the choice of both models for risk prioritization, as they are converging in their results. To carry out the cosine similarity analysis calculation, Google Colab was used. Refer to Appendix B.6 for more details on the development and the results obtained.

In the cosine similarity analysis between the vectors obtained using the ANP and AHP models, (see Figure 4) we observe results that provide valuable insight into the consistency between the two methodologies. Overall, the results suggest a high agreement between the risk prioritizations derived from ANP and AHP. It is important to note that high similarity does not guarantee a perfect match, as the methodologies may address different aspects and complexities of the risks.

The result of this analysis indicates that, despite methodological differences between the two approaches, the assessments generate similar risk prioritizations. The high similarity suggests that both models consistently capture the relationships and weightings of the criteria, converging in the identification of priority risks. A similarity close to 1 does not guarantee a perfect match, due to possible limitations or inherent biases in the methodologies. These findings highlight the robustness of the models used, supporting the validity of the conclusions derived from both approaches in risk assessment.

Overall, to address the results shown in this study and in the research of Yazo-Cabuya et al. (2024) [26], it is suggested that specific action plans that address the identified economic and technological risks be developed as a priority. Additionally, the main limitation of this study focuses on the dynamics of the organizational environment, which triggers the constant evolution of risks; the stability of those risks initially identified may be altered over time. Organizational realities are complex and can represent a challenge, so it is recommended that those who apply this methodology perform a periodic verification of their risks and sub-risks, according to their respective economic sector and the changes in their environment or dynamics. On the other hand, it would be interesting to continue with the proposed analysis through a complete methodology, highlighting the importance of a continuous follow-up of risks and sub-risks through monitoring and assurance controls, through internal audits that function as a continuous supervision, contributing to adaptability and management in dynamic environments.

According to the study by Daimi and Rebai (2023) [22], the importance of assessing and improving sustainability, in this case in the transport sector in Tunisia, is reaffirmed. They further indicate that the use of MCDM methods presents strengths, due to their comparison, for the measurement of the importance of criteria. However, for the application of an absolute measurement approach, they point out the need for further research and exploration to develop more appropriate aggregation approaches that can effectively address specific challenges according to the application context, in order to provide long-term sustainable solutions. Additionally, in the study by Nejad et al. (2023) [21], where they employed a hybrid AHP/ANP model for decision-making in health system management in public hospitals, they indicate that these methods can improve the efficiency and reliability of health system management, helping to maximize the available resources in complex decision-making. The study by Mir (2021) [25], where they employ a hybrid AHP/ANP method to assess the relative importance of different thematic layers in mapping groundwater potential, highlights the complexity of the interrelationship between thematic layers and uses ANP to discern these relationships. It emphasizes the need for the implementation of comprehensive methods and the importance of prioritization in informed decision-making.

Finally, it is suggested that future research should cover ensuring long-term sustainability by adopting the best available practices, building on the thrust of this study, i.e., integrating ESG issues into organizational strategy as well as assurance reporting. This will help to reduce losses and identify opportunities related to sustainability. To this end, senior management must adapt by developing realistic models and approaches to broaden the view of risks, based on a comprehensive methodology that helps organizations to proactively address these risks through early identification, the implementation of monitoring controls, and an alignment with corporate strategy.

5. Conclusions

The results of this research, achieved through the characterization of organizational risks with a focus on sustainability and the application of the ANP method, allowed the effective ranking of sub-risks for each of the risk typologies addressed. The cosine similarity analysis between the ANP and AHP methods reinforces the validity of the models used. This high similarity between the two approaches indicates that both models are consistent in capturing relationships and criteria weights, which converge in the identification of priority risks, thus reinforcing the usefulness of the ANP method in risk prioritization. The contribution of ANP is highlighted, as it allows for improved decision-making and reduced modifications to the qualitative assessment criteria.

The use of the ANP model has proven to be an effective tool for the prioritization of organizational risks with a focus on sustainability, allowing for a comprehensive and weighted evaluation of sub-risks. The importance assigned to each of the prioritized sub-risks in the typologies of geopolitical, economic, social, technological, and environmental risk highlights the need for proactive strategies in these areas. Flexibility in risk management and the ability to adjust strategies according to environment changes are key to ensuring business resilience. The use of the ANP model facilitates weighted decision-making by allowing it to assign weights and priorities in a structured manner, avoiding biases or decisions based on subjective perceptions, which is essential when facing multiple dimensions of organizational risks with a focus on sustainability.

The ANP and AHP are multi-criteria decision-making methods developed by Thomas Saaty. However, they differ in the way they handle the structure and relationships between criteria. Hence, the proper selection of one of these methods for implementation in future studies requires the reader’s choice, considering the characteristics shown in

Table 16. Comparison of characteristics of MCDM methods of case study.

Characteristics	MCDM Method
	AHP	ANP
Approach	Hierarchical.	Networks and hierarchies.
Use	Prioritization of criteria and alternatives.	Modelling of complex relationships between criteria and sub-criteria.
Structure	Organizing the criteria and alternatives in a hierarchy.	It allows network relationships, not just hierarchical ones.
Comparisons	It is based on peer comparisons to establish priorities.	Allows direct comparisons and dependencies between elements.
Limitation	It does not directly manage the interrelationships between criteria.	It requires more calculations for its resolution, which implies a detailed explanation to the decision-maker to establish relationships and preferences.
Characteristics	Hierarchical.	Networks and hierarchies.

.

While AHP focuses on hierarchical structures and pairwise comparisons, ANP extends this approach by considering the interrelationships between elements, which makes it more suitable for situations where criteria are not independent and their influence is mutual, excelling in more complex scenarios where the relationships between criteria are significant for decision-making.

The consistency in risk prioritization between the approaches demonstrates that both models consistently capture the relationships and weightings of the criteria, identifying priority risks in a convergent manner. A similarity close to 1 underlines the robustness of the models; however, it is crucial to interpret these results with caution, considering the specific context of the analysis being developed. These findings support the validity of the conclusions obtained and suggest the exploration of an additional MCDM method to evaluate the stability of both approaches against the data collected in the group of experts.

Despite the advantages of the ANP model, it also has some limitations. One of these is the complexity in data collection and the construction of the dependency network, as it may require a significant amount of time and resources to identify and adequately model all the interrelationships between the problem elements. Another limitation is its sensitivity to the quality of the data and the accuracy of the inputs provided by the experts; if the data used to construct the dependency network are incomplete or inaccurate, this can lead to biased or inaccurate results. In addition, the process of assigning weights and structuring the network may be subjective and vary according to the interpretation of the experts involved, which could influence the results. In addition, ANP may require a significant level of experience and expertise for effective implementation, which could limit its accessibility to those unfamiliar with the methodology. These limitations may affect the usefulness and applicability of the ANP model in certain contexts and highlight the importance of diligence and careful validation of the data and modelling processes.