Open University of Cyprus Hellenic Open University Master’s join degree/Postgraduate Programme Enterprises Risk Management (ERM) MASTER THESIS Risk Profile of Invest Cyprus, the Cyprus Investment Promotion Agency Christos Ioannou Supervisor Nikitas Koutsoukis May 2018 i    Open University of Cyprus Hellenic Open University Master’s join degree/Postgraduate Programme Enterprises Risk Management (ERM) MASTER THESIS Risk Profile of Invest Cyprus, the Cyprus Investment Promotion Agency Christos Ioannou Supervisor Nikitas Koutsoukis This thesis is submitted in partial fulfilment of the requirements Master’s join degree/post graduate programme “Enterprises Risk Management (ERM)” Faculty of Economics and Management Open University of Cyprus    Hellenic Open University  May 2018 ii    iii    Summary Risk management is of high importance nowadays, particularly following the recent global economic crisis and turbulent times that have changed today’s business world (Vlăduț-Severian, 2014). Corporations today face numerous challenges and need to have an effective risk management framework in place that will ensure their robustness, growth and sustainability. A comprehensive risk profile can and should be the starting point of a holistic risk management approach, assisting corporations to be predictive instead of reactive when dealing with risks (Pollard et al., 2004). The aim of this thesis is to create a risk profile of Invest Cyprus, Cyprus’ governmental agency responsible for the attraction and facilitation of foreign direct investment into the country. In this regard, qualitative risk profiling methods are being used. Through a questionnaire survey among the staff of the Organisation, the main risks the Organisation is facing are defined and presented graphically in relevant risk matrices, in regards to their impact and likelihood scores, and overall risk level. As per the results of the survey, the Organisation faces a number of medium and high-level risks under all categories examined (Hazard, Financial, Operational, Strategic, Compliance and Other predefined risks). The most highly ranked risks are Financial and Other risks, which include the lack of investment opportunities and the lack of incentives for international investors. Invest Cyprus currently has no comprehensive risk management framework in place, despite having risk-related processes, just not in a systematic, documented and integrative way. Creating such a framework would definitely be beneficial for the Organisation, especially due to continuously evolving and challenging political, economic and social circumstances. Investment promotion is an area which entails a number of risks which could endanger the business continuity of the Organisation, if not handled effectively. iv    Acknowledgements First of all, I would like to express my sincerest appreciation and gratitude to my supervisor Dr Nikitas Koutsoukis for his continuous support and insightful views throughout the process of researching and writing this thesis, as well as the process of conducting the empirical field study. His valuable comments and views, through systematic feedback and excellent communication were critical in the completion of this project. I would also like to express my warmest thanks to all my professors for sharing their vast knowledge and experience on this very interesting and highly important topic, as well as to the administrative staff of the University for their cooperation and assistance throughout my studies. Special thanks are due of course to Invest Cyprus’ management and staff, and especially to Mr Marios Tannousis, Acting Director General, for their positive attitude, excellent cooperation and prompt response during the empirical phase of the study. Without them, nothing would be possible. I would like to wish them all personally and to Invest Cyprus as an Organisation every success. Last but not the least, I would like to thank my family and friends for their support and patience during this time, and generally throughout my studies. v    Table of Contents Chapter 1 ................................................................................................................................................ 1  Introduction ....................................................................................................................................... 1  1.1. Key risk concepts .................................................................................................................... 1  1.2 Risk Management .................................................................................................................... 2  1.3 Risk Profile ............................................................................................................................... 4  1.4 Brief overview of risk profiling techniques ........................................................................... 6  1.5 Purpose .................................................................................................................................... 8  1.6 Structure ................................................................................................................................... 9  Chapter 2 .............................................................................................................................................. 10  Literature review ............................................................................................................................. 10  2.1 Benefits of inward FDI .......................................................................................................... 10  2.2 Investment Promotion Agencies (IPAs) .............................................................................. 11  2.3 Risks for Investment Promotion Agencies .......................................................................... 14  2.4 Invest Cyprus, the Cyprus Investment Promotion Agency ................................................ 18  2.5 Situational Analysis - Cyprus macroeconomic and FDI indicators .................................... 21  2.6 Cyprus’ value proposition and international competitiveness .......................................... 25  2.7 SWOT Analysis ....................................................................................................................... 27  Chapter 3 .............................................................................................................................................. 29  Methodology .................................................................................................................................... 29  3.1 Survey design, Sample size and Data collection .................................................................. 29  3.2 Data analysis .......................................................................................................................... 30  3.3 Research Questions and Hypotheses ................................................................................... 31  3.4 Study limitations .................................................................................................................... 32  Chapter 4 .............................................................................................................................................. 34  Results .............................................................................................................................................. 34  4.1 Responses to Section 1 – Demographics and general knowledge ..................................... 34  4.2 Responses to Section 2 – Risk Mapping and Ranking ......................................................... 37  4.3 Responses to Section 3 – Risk Management Techniques ................................................... 41  4.4 Risk estimation and mapping ............................................................................................... 44  4.5 Discussion of findings ........................................................................................................... 46  Chapter 5 .............................................................................................................................................. 51  Conclusion ........................................................................................................................................ 51  References ............................................................................................................................................ 53  Appendix I ............................................................................................................................................ 60    vi    List of Tables and Figures   Table 1: Techniques used for risk identification, analysis and evaluation ....................................... 7  Table 2: Main economic indicators for Cyprus 2013-2019 (in %) .................................................. 22  Table 3: Results of Doing Business Report 2016 – 2018 (Source: World Bank) ............................ 27  Table 4: Risk levels and relevant definitions ..................................................................................... 31  Table 5: Hypotheses for pre-set research questions ........................................................................ 32  Table 6: Responses on likelihood of pre-defined risk categories and types ................................... 38  Table 7: Responses on impact of pre-defined risk categories and types ........................................ 39  Table 8: Responses on agreement with specific statements using a 5-point scale ........................ 43  Table 9: Impact score, Likelihood score and Risk score calculations .............................................. 45  Table 10: Evaluation of initial hypothesis and answers to research questions ............................. 50  Figure 1: Methods for managing risk types (Collier and Agyei-Ampomah, 2006) ........................... 2  Figure 2: Risk management framework as per ISO 31000:2009 ....................................................... 3  Figure 3: Comparison between Invest Cyprus, Malta Enterprise and IDA Ireland ........................ 19  Figure 4: FDI inflows into Cyprus 2013 – 2016 (Source: Central Bank of Cyprus) ........................ 23  Figure 5: Invest Cyprus’ contribution to reforms and initiatives 2013 – 2017 .............................. 24  Figure 6: Cyprus’ value proposition as an investment destination ................................................. 25  Figure 7: SWOT Analysis for Invest Cyprus ....................................................................................... 28  Figure 8: Risk matrix template used .................................................................................................. 30  Figure 9: Responses on Years of employment .................................................................................. 34  Figure 10: Responses on Familiarity with four (4) predefined terms ............................................ 35  Figure 11: Responses on Question: “Who has the responsibility of overseeing risk management?”  ............................................................................................................................................................... 36  Figure 12: Responses on three interconnected questions ............................................................... 37  Figure 13: Responses on whether the predefined risk categories are being dealt with via the established risk management framework or processes ................................................................... 40  Figure 14: Responses on risk appetite level as per pre-defined 5-point scale rating .................... 41  Figure 15: Responses on the use of risk management techniques by Invest Cyprus ..................... 41  Figure 16: Responses on effectiveness of risk management techniques ........................................ 42  Figure 17: Graphical representation of risk matrix showing categorisation of risk categories and types as per assigned impact and likelihood score ........................................................................... 45  Figure 18: Graphical representation of risk matrix showing categorisation of risk categories as per assigned impact and likelihood score .................................................................................................. 46  vii    viii    Chapter 1 Introduction In today’s highly competitive and continuously evolving global environment, organisations in all industries, face numerous risks in all facets of their activities, which can jeopardise their viability and the achievement of their strategic objectives. Change, progress and innovation, key elements of this era and key targets of the international business arena, bring about even more risk (Culp, 2001). Risk is everywhere and according to Borghesi and Gaudenzi (2013) it “cannot be eliminated”. It is, therefore, essential for companies to identify and effectively manage or mitigate the risks that could have a severe negative effect on business continuity. 1.1. Key risk concepts Various definitions and interpretations of risk have been expressed by different researchers and relevant organisations/stakeholders (Aveb and Renn, 2009; Sotic and Rajic, 2015). For the purposes of this research, the definition used in the ISO 31000:2009, one of the most widely used risk management international standards, will be used, which defines risk as “the effect of uncertainty on objectives”. Apart from the main element of uncertainty caused by risk, the consequences of each risk type can be both negative – referring to hazard risks - or positive – referring to opportunity risks (Borghesi and Gaudenzi, 2013). Risk does not always have to be a negative term; it can be seen also as an opportunity, which, if managed properly, can result in significant benefits for businesses (Culp, 2001). It can even be argued that greater risk involves greater return (IOD, 2012). This three-type of risk (Collier and Agyei-Ampomah, 2006) is a concept that is gradually gaining momentum in risk management (GRA, 2005). The figure below shows the relevant methods that are being used to manage these risk types: 1    Uncertainty •Disaster and emergency planning •Business continuity planning Hazard Opportunity •Safety and hazard management •Assessment of the techniques and possible positive or tools negative effects of risk Figure 1: Methods for managing risk types (Collier and Agyei‐Ampomah, 2006) 1.2 Risk Management Risk management has evolved as a concept and practice significantly in the past few decades, since its first inception in the 1950s (Dionne, 2013). Acknowledging the importance of this function, organisations today have progressed from the stage of “learner organisations with ad hoc approaches to risk management” to “adaptive organisations with a proactive and dynamic response to risk” (Sharp et al., 2002). Systematic risk management, applied with specific methodology, processes and techniques through all strategic and operational processes and considerations of any business, and embraced by all stakeholders at all corporate levels is essential for effective risk management, which is, on its part, a key tool for achieving business strength and success. Numerous benefits arise from implementing a systematic and structured risk management, while include, amongst others (GRA, 2005):  Enhanced communication, coordination and relationships between relevant stakeholders  Significant contribution in achieving strategic business goals and objectives  Increased productivity and efficiency  Increased quality of products/ services offered  Enhanced/ sustained competitive advantage 2     Better and well-documented decision-making  Avoidance of legislative issues The ISO 31000:2009 standard represents the basis for most companies in designing their own holistic, structured and responsive risk management framework, following the processes shown in the figure below: Figure 2: Risk management framework as per ISO 31000:2009   In order for risk management to be effective, it should be an iterative and dynamic process, easy to develop and change, integrated into the culture of the organisation and led by the highest hierarchy levels, with set responsibility and accountability at all levels. When all these elements coincide with systematic and consistent risk-related processes, the organisation does not only achieve higher resilience in adverse situations, but also optimises its operational efficiency, creates a safe and secure environment for employees, ensures a more efficient allocation of resources into its various activities, and protects its corporate assets and its reputation (IRM, 2002). Summarising all the above, Collier and Agyei-Ampomah have identified the four main features that form a “world class risk management”:  Risk management structure: to facilitate the identification and communication of risk  Resources: to support effective risk management 3     Risk culture: to strengthen decision making processes by management  Tools and techniques: to enable the efficient and consistent management of risks across the organisation 1.3 Risk Profile A key step in achieving holistic and systematic corporate risk management is creating a corporate risk profile. This is considered a complex, multi-dimensional process that attempts to produce an overall assessment of the most appropriate level of risk for either an individual or a corporation (Brayman et al., 2015). It represents a relatively new concept in Enterprise Risk Management and can be interpreted and performed in different ways. An organisation’s risk profile can be considered as the end of the risk assessment process, which involves risk identification, risk analysis and risk evaluation. Risk assessment constitutes the process of comprehending the nature of risks an entity is facing at a given period in time and defining their impact level and possible consequences to the strategic goals of the corporation (Lund et al., 2011). Risk profile is simply the “key deliverable of any well-structured risk assessment” (Aon, 2016). Risk identification requires good knowledge of the organisation itself, its operational processes/ activities and its strategic objectives, as well as a thorough understanding of its external environment and factors that could have an effect of any kind to its success. A SWOT analysis could be a good start from which to identify the strong and weaker points of an organisation’s function, as well as the opportunities and threats ahead. Following risk identification, a graphical presentation of risks identified should be pursued, providing a most accurate image of the situation at hand, followed by a risk analysis and evaluation using either quantitative or qualitative methods, or a combination of the two. Taking all these information into account, the risk profile of the organisation is being formed, attributing a specific rating to each risk and reviewing the processes already in place for its treatment, thus identifying gaps/ areas of improvement needed (IRM, 2002). Effective risk management does not only involve detailed and accurate identification, assessment and evaluation of risks in an effort to determine an organisation’s risk profile, but also an assessment on the level of acceptable risk and the level of risk an organisation can bear (IOD, 2012). This process is defined as determining an organisation’s risk appetite and risk tolerance. 4    Risk appetite is defined by the British Standard BS 31100 as “the amount and type of risk that an organisation is prepared to seek, accept or tolerate”, with risk tolerance being the quantitative expression of risk appetite (IOD, 2012). A corporate risk profile is considered the sweet spot between its risk tolerance and its risk appetite. There is constantly an increasing number of risk types that represent an organisation’s risk portfolio. The main risks an organisation might be facing today which form the basis of the research part of the study, can be categorised as follows:  Hazard risks: referring to risks that relate to physical damage that can be caused to the organisation due to natural disasters, human factors, and physical damage.  Operational risks: referring to risks that can cause disruption to normal business operations (e.g. IT failure, lack of resources, information gap etc.). The most common sources of operational risks include the lack of well-established procedures as well as the lack of employees’ relevant training and skills required to be involved in an effective risk management process (Khatta, 2008).  Strategic risks: which refers to risk that relate to the organisation’s position in the market, its competitive or lack of competitive advantage against competition and its reputation, as well as its strategy’s inability to effectively achieve its goals. Reputational risk tends to be treated as a separate category in recent times, as a positive image is a highly important element in continuous business success (Dinu, 2012).  Financial risks: referring to risks that relate to the organisation’s credit and liquidity situation, economic factors etc. This category includes “vulnerabilities to change in market prices, the creditworthiness of contract counterparties and the risk of cash imbalances” (Culp, 2001).  Compliance risks: risks relating to compliance with relevant laws and regulations. Other risk categories have developed in the past years, with the most prominent one being cyber security. Global technological advancements, apart from their undeniable benefits, come with complex risks. “Network and system safeguards” against cyber-attacks are one of the main focus of today’s business world (IOD, 2012). Each company has a unique risk profile that contains the following elements (Kellysears, 2017):  Presentation of the main risks the Organisation is facing  Evaluation of said risks 5     A SWOT analysis of the Organisation  The Organisation’s risk tolerance and ability to effectively manage/mitigate risks  Suggestions for effective risk treatment Developing an organisation’s risk profile can be quite a challenging process. It should take place on a regular basis, on a bi-dimensional basis, i.e. in regards to the risks’ likelihood/probability and in regards to their severity/importance (Dey and Ogunlana, 2004). Specifying the number and type of risks, as well as their potential effects, allows entities to prioritize and take action to mitigate said risks through risk-aware decision making and business strategy. According to Palmer et al. (1996), high frequency but low severity risks can be retained without endangering the viability of the entity, while low likelihood but high severity risks should be mitigated as their effects can be catastrophic. 1.4 Brief overview of risk profiling techniques A variety of techniques and methods are available for creating a risk profile, which fall under the following categories: quantitative, qualitative and semi-quantitative. This review will deal with the quantitative and qualitative methods, as the semi-quantitative ones are not widely used today (Marhavilas et al., 2009). Qualitative methods usually visualise said risks in a relevant matrix, assessing them in terms of impact/severity and probability (Valis and Koucky, 2009) and involve brainstorming/interviewing techniques, while quantitative methods involve numerical methods, such as the Monte Carlo simulation, the Delphi technique, decision trees and sensitivity analysis (Altenbach, 1995; Prasanta and Ogunlana; 2004). Qualitative methods are mostly descriptive and do not involve exact quantification of risk, but rather a basis for further analysis, while quantitative techniques are mostly preferred for decision-making purposes, despite of their difficulty of use, as they require specific knowledge and skills both to be performed and to be understood (Vladut-Severian, 2014). Qualitative methods can be used in combination with quantitative analysis for more accurate results and a more holistic approach to risk profiling, thus increasing the ability of more effective risk management. In regards to the specific elements each category deals with, qualitative techniques assess and analyse risks in terms of likelihood (frequency of occurrence), severity (impact and importance of impact caused), timing (speed and duration of risk occurrence) and vulnerability (level of 6    preparedness to endure risk) (Fox and Hather, 2014). On the other hand, quantitative techniques measure risk expected value, variability and comparison ratios (Valis and Koucky, 2009). According to Lund et al. (2011), traditional risk analysis techniques should be supported by model-driven approaches, such as CORAS or the Bow-tie, to support the risk analysis process and appropriately handle evolution. Risk models, which are becoming more popular in the past years, represent a structured method of documenting and estimating risk through graphs, block diagrams and trees (Lund et al., 2011). There is no single model for risk assessment and management that can be used universally and effectively (Melko and Ievins, 2012). Each technique is considered more appropriate for a specific task, while different techniques are used across different sectors and industries. The table below shows the different techniques which are considered more appropriate for each of the three tasks involved in a risk assessment process. Task Technique Identification Brainstorming Surveys and interviews Checklists Analysis Severity/likelihood matrix Root cause Cause and effect analysis Influence diagram Bow tie analysis Monte Carlo simulation Fault/event trees Evaluation ALARP Solution effect analysis Force field analysis Table 1: Techniques used for risk identification, analysis and evaluation   As risk assessment phases move from identification to analysis and then evaluation, methods used move from qualitative to quantitative in parallel. Quantitative methods are usually time 7    consuming and costly, and, are therefore, used in situations where qualitative analysis has resulted in alarming conclusions that need further research (Curtis and Carey, 2016). Surveys are included in the qualitative approaches and represent one of the traditional and most widely used methods of creating a company’s risk profile. The use of questionnaires represents a useful tool in gathering the necessary information on an organisation’s risk profile. However, the effectiveness of questionnaires has been highly questioned in recent times, with experts indicating that more structured and concise approaches are needed, or at least be used in combination to questionnaires (Stammers, 2015). The main risks involved in the questionnaire approach are the possibility of low response rates, low quality of responses and the lack of verification (Curtis and Carey, 2016). Questionnaires can be proven useful however, as a supporting tool, in combination to a situational analysis, to proceed to risk prioritisation and risk mapping in relevant matrices, in a two-dimensional graphical presentation, as described above. 1.5 Purpose The purpose of this thesis is to risk profile Invest Cyprus, the Cyprus Investment Promotion Agency, the country’s national body responsible for attracting and facilitating foreign direct investment into different key economic sectors that are aligned with the government’s growth policy and goals, using qualitative risk profiling methods. While firstly, identifying, reviewing and evaluating existing risk profiling techniques, in terms of their level of use and effectiveness, focused on the use of qualitative techniques, the research part of the thesis attempts a practical application of qualitative techniques and in specific a questionnaire survey and a graphical representation of identified risks and risk level in relevant risk matrices, in regards to their impact and likelihood scores. The case study deals with the following issues:  Identify and assess the risk profiling techniques employed by Investment Promotion Agencies (IPAs) in general and Cyprus’ IPA in specific  Create a comprehensive risk profile of the Agency, highlighting the main risks it is currently facing as well its preparedness and efficiency in mitigating said risks and ensuring smooth business continuity  Provide suggestions for enhancing risk management effectiveness 8    Evaluating the processes used by the Organisation towards this direction and forming relevant suggestions is an important step towards the improvement of risk management processes currently employed. The results of this study can be used as the basis for the creation of a comprehensive risk framework for Invest Cyprus, which would ensure the effective mitigation of risks that impede the growth prospects of not only the Organisation, but of the country as well. 1.6 Structure The thesis is divided into 5 main chapters, starting from the current chapter, Introduction. The rest of thesis is structured as follows: Chapter 2. Literature Review: This chapter is divided into two (2) main parts. The first part deals with a presentation, analysis and evaluation of the risk profile of Investment Promotion Agencies worldwide, and the second part with a presentation of the company profile, strategy and actions of Invest Cyprus. Chapter 3. Methodology: In this chapter, the methodology used in conducting the field study on Invest Cyprus is presented, in regards to Data collection, sampling process, survey tool used and procedure followed to establish the risk profile of the specific Organisation, through the eyes of its employees. Chapter 4. Results: In this chapter the results of the survey is presented, both in regards to the final sample and to the findings deriving from the answers of the participants, followed by a statistical analysis and discussion of said findings. The risk profile of Invest Cyprus is also being presented graphically through a risk matrix ranking risks in terms of impact and likelihood. Chapter 5. Conclusion: In this section the main findings of the study are summarised and replies are provided to the initially set research questions, evaluating the precision of the hypotheses formed, while identifying study limitations and forming suggestions both on improving the risk management framework and risk profiling techniques of Invest Cyprus as well as suggestions for future research on similar issues. 9    Chapter 2 Literature review In the current global economy, Foreign Direct Investment (FDI) is a key component of national strategies to achieve sustainable economic and social development (OECD, 2005; Alfaro et al., 2006), leading also to economic globalisation and integration (Rjoub et al., 2017). It has, in this sense, developed into a highly pursued element, thus leading to fierce competition at a global level, both by leading economies as well as by developing countries who actively seek a slice of the pie (Harding and Javorcikr, 2007; Anderson and Sutherland, 2014). Direct investment capital flows have rapidly increasing the past two decades, while international organisations such as the OECD, the UNCTAD, the IMF and others, have a number of techniques in place to better measure both the level and the effect of FDI (Patterson et al., 2004). 2.1 Benefits of inward FDI   Inward FDI refers to the value of foreign investment into a reporting economy and can be measured both in transactions and in stocks, as well as a contribution to a country’s Gross Domestic Product (GDP). USAID (2005) identifies four different types of FDI: 1. Natural-resource-seeking FDI: in cases of looking for access to natural resources which are unavailable in the investors’ country of origin 2. Market-seeking FDI: referring to cases where the investor is looking for access to a new market 3. Efficiency-seeking FDI: in cases of looking for a cost-benefit advantage in relation to material and/or labour costs and efficiency/ skills 4. Strategic-asset-seeking FDI: referring to investors looking to gain strategic assets of the host country, amongst others technologies and distribution channels 10    It can have both direct and indirect benefits for national economies. It is definitely an effective vehicle in driving economic growth, and thus a variety of economic and social benefits for the people of a country. It is a source of incoming funds that can be injected into various areas and not only the central economy. This issue is, however, according to Zanatta et al. (2008) a source of debate amongst researchers and academics, who argue that the spill-over effects of FDI cannot be easily measured and thus their direct effect cannot be effectively evaluated. Therefore, empirical evidence of actual indirect benefits rising from FDI inflows is weak, while research agrees on the multidimensional benefits of FDI (Alfaro et al., 2006; Rjoub et al., 2017). FDI, apart from the capital inflows into the economy of a country, can have further multiple positive effects. The input of new technology, know-how and skills to the host country is one of them and is highly important for the development of the host country as a centre of excellence in a variety of business activities and sectors (Rjoub et al., 2017). Technology transfer to the local market gives new impetus to create knowledge-based economies that can produce innovation and boost entrepreneurship (Blalock and Gertler, 2008; Markusen and Venables, 1999). Innovation, on its part, increases a company’s and a country’s competitive advantage, while creating new technologies, enhancing labour and overall productivity, contributing to a higher quality of new, and generally opening up a world of prospects (Anderson and Sutherland, 2014; Buck Consultants International, 2014). Moreover, FDI inflows can lead to much-wanted job creation, thus battling the global problem of unemployment, especially youth unemployment. Buck Consultant International (2014) argue that foreign companies/investors do not only create jobs, but also give higher remuneration in comparison to local employers, thus providing opportunities for better professional development. An investment can also lead to further investment opportunities, as FDI contributes to the overall development of the economy, and, thus to the creation of other opportunities (Hornberger et al., 2011). 2.2 Investment Promotion Agencies (IPAs)   In relation to the numerous benefits brought about to a country’s economy by FDI inflows, it is only natural that countries would implement specific policies to target FDI. Such policies include the establishment of investment promotion agencies (IPAs). The overall academic research on IPAs is quite limited (Anderson and Sutherland, 2014), it does however include analyses of the strategies and policies of IPA’s and attempts for evaluation of their effectiveness. 11    Investment Promotion is defined as the activities through which governments aim to attract FDI inflows (Wells and Wint, 2000). Investment promotion agencies (IPAs) are key institutions for delivering increased levels of welfare and progress, through the attraction of Foreign Direct Investment (FDI) and the enhancement of the country’s competitiveness (Guimon and Filippov, 2010). Research has shown a positive effect on FDI inflows in countries where IPAs are established, thus indicating a positive relationship between the two variables (Harding and Javorcikr, 2007; Trnik, 2007). FDI-assisted development is characterized by Narula and Bellak (2009) as “the most efficient option” for upgrading in global value chains. However, according to Harding and Javorcikr (2007), investment promotion is considered most effective when referring to emerging than highly developed economies (Ecorys, 2013). The 1980s saw a rise in the number of IPAs worldwide as well as a parallel rise in resources dedicated to this purpose, mainly due to the intense global competition environment to achieve the highest possible levels of FDI. The global trend of investment promotion through institutions dedicated to this purpose is also demonstrated through the establishment of WAIPA, the World Association of Investment Promotion Agencies, who now counts 205 members in 192 countries, while common practice is also the expansion of a national IPA through the establishment of offices in other countries (Zanatta et al., 2008). What is most important regarding this impressive rise in IPAs worldwide is the fact that this shows the level of consensus amongst policy makers regarding the importance of having such an institution. Most IPAs are primarily state-funded and are either governmental, or semi-governmental entities. This is highly important as it allows for IPAs to offer the services at no cost for the investors (BDF, 2011). IPAs are institutionally placed either within or under the control of Ministries of economy, industry, development or a relevant function (UNCTAD, 2001). It is, however argued that IPAs which have a semi-state status but have representation from the private sector record better performance than IPAs that are integrated within a governmental authority (ECORYS, 2013; Wells and Wint, 2000; Morisset and Andrews-Johnson, 2004). The role of IPAs revolves around four main pillars:  National branding: activities which aim at enhancing the country’s reputation/ image as an investment destination  Lead generation: activities aiming at identifying and targeting/approaching potential investors and pitching their country’s offering to them 12     Investor facilitation and after-care services: assistance and support activities provided to potential and existing investors at all investment phases: pre-, during- and post- investment  Reform advocacy: initiatives aiming at promoting the improvement of the country’s business environment, making it even more conducive to foreign investment Global organisations have published guidelines for effective FDI attraction; such guidelines include the OECD Policy Framework for Investment, the Guidelines for Investment Promotion Agencies of UNIDO and the Investment Promotion Toolkit of the World Bank/MIGA. However, most IPAs implement a sector-based approach, identifying key target economic sectors and forming action plans for their development and promotion (Harding and Javorcik, 2007). Sector- targeting is considered to be a most effective method and it is also a way to stay aligned with the governmental development goals. The shift from a general country marketing to a specific targeted marketing is positively correlated with higher FDI inflows (Ecorys, 2013), while also allowing for staff specialisation and strategic planning, thus, subsequently for a more professional and adequate investor management and facilitation. Having gone through a difficult global economic crisis, that shifted the priorities of IPAs and rendered their work even more difficult, current FDI data show a positive trend, as well as optimistic projections for the years to come. The economic crisis that crippled the global and specifically the European economy has receded, with FDI recording a strong rise in 2015 and 2017, with a slight decrease in 2016 (UNCTAD, 2017). According to the World Investment Report (2017), “elevated geopolitical risks and policy uncertainty for investors”, as well as social instability, could have a negative impact on the volume and level of FDI activity for 2017-2020. An overall renewed investor interest for investment into Europe, allows for optimistic forecasts for sustainable FDI inflows, in contrast to other areas such as the Latin America and the MENA region. Global economic growth, a prerequisite for FDI, is expected to reach a 2.7% in 2018, thus creating an environment of a pro-business and pro-investment climate. Current trends in the field show a shift towards attracting high quality FDI rather than quantity FDI, focusing on the technology and innovation sectors, as key contributors to a country’s further development (Guimon and Filippov, 2010). This international trend makes it even more difficult for IPAs today to achieve their goals not only for FDI attraction, but also for innovation accumulation. 13    Another goal that is directly translated to high quality FDI is the regional headquartering concept, which refers to the establishment of a base in the reporting economy. The relocation of a company’s headquarters or regional base or back-office, does not represent a once-off benefit investment; it rather constitutes a substantial investment that can contribute significantly to a national economy, both short-term and long-term. Establishment and duration of corporate operations, extend of activities performed from the specific investment location and prospects for expansion of said activities are the main areas of focus of the concept of regional headquartering. It is not, therefore, only about getting corporates to establish a base in one’s country, but also to get them to maintain and expand their operations in order to contribute the maximum to the national economy (Guimon and Filippov, 2010). Acquiring additional input from existing investors is a far more complex task than attracting new ones and therefore needs careful planning and additional instruments/incentives. 2.3 Risks for Investment Promotion Agencies The main risks that Investment Promotion Agencies are facing are directly related to the main determinants of FDI attraction. FDI inflows depend on a number of variables, including macro- and micro-economic conditions, the existence of a business-friendly legal and regulatory environment, a modern and advanced infrastructure and the availability of a high quality human talent to cater to the investors’ needs (Moran et al., 2005). Identifying the determinants of FDI attraction is not a simple concept. It involves researching and analysing a number of factors that can affect an investment decision, while taking all necessary action to mitigate the effect of these factors. While market size greatly affects investment decisions, with the global leading economies managing to attract the highest levels of FDI, market growth potential can be quite important for emerging economies. Market growth potential is directly connected to the element of return on investment (ROI) (Hornberger et al., 2011). According to Zanatta et al. (2008), the higher the prospective ROI, the bigger the investment. However, Buck Consultants International (2014) highlights an FDI shift towards developing countries in the past decade, which could be explained by the lower cost of doing business in those countries that can lead to higher ROI. A comprehensive and effective strategy should also be in place, and monitored, evaluated and updated at frequent time periods. An IPA’s strategy is well driven by adequate and sufficient information on business and market trends and developments (UN, 2008). Information gaps in 14    this regard can lead to the wrong decisions on target sectors, target markets and/or companies/ individuals, choice of promotional activity types and timing, as well as wrong decisions on budget allocation, communication method and messaging/ offering prepared for each case. In this regard, the role of external consultants can be quite helpful and efficient, as they will have the primary role of monitoring and reporting on business and market data, in order for the IPA to have all the information needed to form a holistic and effective strategy (WAIPA, 2010). Formulating and implementing the right strategy is one of the most important factors in bringing about satisfying results. Apart from formulating the right action plan, a clear understanding of the investor’s state of mind and decision-making process, as well as their own country’s advantages and/or disadvantages can be determining factors in any investment decision. Understanding what investors want, can result in an effective messaging/ marketing strategy; in this regard, offering the right package, advantages and incentives. Targeting and offering tailor-made solutions to investors is fundamental in achieving high quality FDI. Amidst growing competition, providing specific incentives such as tax advantages to attract investors has become common practice, while the responsiveness of foreign investors to such incentives has grown as well (Moran et al., 2005). According to Hornberger et al. (2011), the availability of investment opportunities and the overall growth potential of the country are the most important factors in driving an investment decision. However, incentives of different kinds can play an important role in this direction and influence the final decision when other determinant factors are similar for competing jurisdictions (Zanatta et al., 2006). Incentives should be able to be offered on a case-by-case basis by IPAs to cater to the specific needs of foreign investors (WAIPA, 2010). A prerequisite for achieving high FDI inflows and maximising benefits is having a business- and investment-friendly environment in place, that encourages, fosters and facilitates FDI (Mukim and Nunnenkamp, 2010). Continuous reform is fundamental in this regard, while governmental dedication and commitment in combination with private sector cooperation are crucial to success (OECD, 2005; Estrin and Uvalic, 2013). IPAs do and should have a role in promoting and advancing structural reforms that would improve the country’s business and investment climate. Being the “champions of FDI”, IPAs should act as the one-stop-shop that can cater to the needs and demands of all investors, providing them with all necessary information practical assistance to convince them to proceed to an investment in their country, while being prepare to go the extra mile as part of their corporate culture and mentality, not only in the pre- and during- investment phase, but also post-investment (OECD, 2005). This, however, requires well-established political 15    backing, internal consensus on the importance of their role and effective cooperation both with the governmental authorities and the wider public and private sectors (Trnik, 2007). According to the OECD (2005), a country’s business climate is multidimensional element, affected by a variety of factors such as: degree of macroeconomic stability and growth in the country with respect to inflation, exchange rates and balance of payments, and economic expansion; political stability; progress in private sector reform and liberalisation, including privatisation and fiscal, financial and labour reforms. Resources are also quite important, both in regards to human and structural capital, as well as in regards to budget. Employing the right people with the right culture is key to achieving one’s strategic goals. The skill-set of an IPA’s staff should match its focus, while enhancing its staff’s skills and knowledge should be included in the upper management primary objectives. Structural capital, i.e. the internal organisational processes and approaches used by the Agency should also be aligned with its strategy (Guimon, and Filippov, 2010). Human capital also has another aspect, as it is a key element of a country’s “enabling business environment” (OECD, 2002). One of the greatest challenges which can inhibit and IPA’s work, is the lack of appropriate budget allocated to this purpose. IPA’s dependence on governmental funds often results in limited capabilities in implementing a well-designed and well-thought strategy (Trnik, 2007). Therefore, agencies which have small budgets are considered “unable” to efficiently attract major investors (Morisset and Andrews-Johnson, 2004). Budget can have an effect both on the activities, but also on the human capital employed by the organisation; attracting high quality individuals requires a high monetary investment on the part of the agencies (UNCTAC, 2001). One of the most prevalent risks faced by IPAs worldwide is the doubt on the effectiveness of their achievements. This is partly due to the lack of clear key performance indicators (KPIs), qualitative or quantitative, to measure and evaluate their work. IPA evaluation is a key challenge for most IPAs throughout the world. As resources dedicated to investment promotion increase, expectations rise as well in regards to deliverables, especially taking into consideration the fact that IPAs are primarily state funded, and the use of public money should be well justified and accompanied with objectively positive results, based on “sound economic rationale” (UN, 2008). Moreover, regulatory limitations on restricting foreign investment have been implemented in some countries, such as the US, for better FDI regulation (Marchick and Slaughter, 2008). 16    There are numerous challenges that render effective evaluation of IPA work a difficult task. Amongst others, many external factors affect their results, such as the national, regional and international geopolitical and economic context and developments, as well as the country’s legal and tax framework, the availability of incentives, the country’s size, location and infrastructure level and, most importantly the development of economic sectors and opportunities in which investors can and would want to invest in. Moreover, most IPAs do not have clear KPIs in place, while information is not available on time and is depended on other institutions’ collection methods and timing. According to information provided by IPAs themselves, two of the most important challenges in this regard, is the lack of a standard format/way of evaluating their performance at an international level (UN, 2008), as well as the lack of sufficient resources that can be allocated towards this direction. The debate on IPA effectiveness is expected to continue as FDI gets attributed more and more importance in their role in economic growth (Morriset and Andrews-Johnson, 2010). As technology advances daily, it is critical for IPAs to integrate digital tools into their investment promotion strategy, in order to ensure reach of mass audiences in a cost-effective way and be up- to-date with all current trends in the business world (Ecorys, 2013). The use of modern IT systems and communication methods are a prerequisite in effective investment promotion and will be a priority consideration for IPAs worldwide (UNCTAD, 2001). As already stated above, fierce competition is currently underway among nations to attract the highest level and volume of FDI, that has value add for the economy of the country in the long- term. The bigger the competition, the more important the role of the IPA and the implementation of a sophisticated and holistic strategy for investment promotion (Zanatta et al., 2006). The biggest challenge for IPAs worldwide, however, is the ultimate goal of achieving sustainable investment (WAIPA, 2010). Sustainable investment consists of the following four main dimensions:  Economic development  Environmental sustainability  Social development  Sound governance According to the above analysis, the main risks faced by IPAs nowadays are the following:  Market realities at national, regional and international level 17     Fierce competition  National challenges, eg. Economic/political crisis etc.  Local regulatory framework – non-conducive to investments  Lack of resources  Lack of executive role  Lack of incentives  Lack of investment opportunities  Lack of political backing  Lack of consensus on their importance and role In regards to risk management in investment promotion as a field, a gap in the literature has been traced, which should be addressed by future researchers. 2.4 Invest Cyprus, the Cyprus Investment Promotion Agency   Invest Cyprus, is the national IPA of the Republic of Cyprus, established in 2005 with a Council of Ministers decision. Invest Cyprus first launched operations in 2007, as a registered not-for-profit company limited by guarantee, with the Government of the Republic of Cyprus, through the Minister of Energy, Commerce, Industry and Tourism, as its sole member. Invest Cyprus is a 100% state-funded organisation, receiving an annual budget of 2 million euros and employing 10 permanent staff members along with a contracted Director General, on a 5- year term, while being governed by its Board of Directors, which includes representation from both the public and the private sectors. The Chairman and the Board of Directors are appointed by the President of the Republic of Cyprus. Invest Cyprus directly reports to the Minister of Energy and the Ministry of Finance in regards to budget considerations, while cooperating closely with both governmental and private authorities and bodies. Invest Cyprus is a member of WAIPA, the World Association of Investment Promotion Agencies and of ANIMA, the Mediterranean Investment Network. The small size of the Agency does create some drawbacks as it lacks the necessary specialization as well as the minimum required personnel to maximize efficiency. The human capital of the Agency is directly related to its funding. The figure below shows a relevant comparison between 18    Invest Cyprus and two of the most successful IPAs of Europe, Malta Enterprise and IDA Ireland, which are Invest Cyprus’ counterparts in two countries that represent two of Cyprus’ main competitors within Europe (Guimon and Filippov, 2010): Malta Enterprise •Staff: 120+ employees•Budget: €17m IDA Ireland •Staff: 320+ employees•Budget: €130m Invest Cyprus •Staff: 10 employees•Budget: €2m Figure 3: Comparison between Invest Cyprus, Malta Enterprise and IDA Ireland According to the Site Selection Magazine (Kelley-Jones, 2017), IDA Ireland is included amongst the top IPAs globally, based on a number of criteria that go a step forward from being a simple information desk and promotional tool, to being the investor’s true partner and reliable intermediary. Invest Cyprus is not included in this report, while also not being included in the “fDi Strategy Awards 2017” (Mullan, 2017), which found Invest Hong Kong at the top of list as the best IPA globally. One of the main issues Invest Cyprus is facing that renders it below its competitors, is not being the one-stop-shop for international investors as in other countries (see Malta Enterprise, IDA Ireland etc), due to the existence of other service points for international investors, such as the Point of Single Contact of the Ministry of Energy etc. Invest Cyprus has last year revised its strategy, in response to the shift in global and national economic and market trends, as well as developments in the international arena that could have an important effect in its line of work, such as Brexit, the political unrest in the Middle East region etc. As per its strategic plan for 2017-2020, Invest Cyprus has the vision of being “the essential agent in forging the position of Cyprus as a world-class investment destination” and the mission of “promoting and enhancing the country’s competitive environment, maximising FDI, for the economic and social benefit of Cyprus” (Invest Cyprus, 2016). Invest Cyprus has assumed a three-dimensional role as per below mandate: 19     Promote Cyprus as an investment destination in specific sectors and jurisdictions, highlighting the overall competitive advantages the country enjoys.  Provide tailored investor facilitation and professional support to all foreign investors.  Advocate for reforms and improve the regulatory and business environment to constantly improve the attractiveness of the country as a FDI destination transforming Cyprus into a truly global FDI hub. Invest Cyprus is engaged in intense and targeted promotional efforts in key target markets and economic sectors, in line with the governmental growth strategy. The Organisation’s goal is not just to achieve an inflow of foreign capital, but rather to attract investments of substance, which will create jobs and boost business and investment activity. Promotional campaigns include the organisation of events (exhibitions, conferences, roadshows etc.) both in Cyprus and abroad, often in collaboration with internationally renowned partners such as Bloomberg, and local partners such as the Presidency of the Republic, various Ministries, the Cyprus Chamber of Commerce and Industry etc., as well as the identification and approach of specific potential investors. Being the state’s entrusted facilitator of international investors, Invest Cyprus places great emphasis on developing and maintaining relationships with existing and prospective investors through various client management initiatives. This includes ongoing communication with existing investors by the members of the Organisation’s team who aim at providing support and tailor-made solutions to foreign investors, their “clients”, as they refer to them. The Organisation is also involved in the introduction of sector-based initiatives, e.g. in the areas of investment funds and entrepreneurship and innovation, as well as the signing of association and cooperation agreements with various countries. Specific sectorial incentives that are over and above a country’s competitive advantages are considered critical in investment promotion and their offering is necessary in order to attract FDI. The Organisation has a sectorial-based approach for investment promotion, where all identified growth sectors, which are aligned with the growth strategy of the Government, are being evaluated in terms of their attractiveness and maturity and categorised as per their assigned priority level, as shown in the Agency’s Strategic Plan for 2017-2020 (Invest Cyprus, 2016). The key sectors in which Invest Cyprus is promoting investment are the following: 20     Tourism  Shipping  Real Estate  Financial Services and Investment Funds  Energy  Regional Headquartering  Innovation and Start-ups  Filming  Education The main goals set by Invest Cyprus for the period 2017-2020 are the following:  Support the creation and promotion of a distinct brand identity that best underpins the country’s competitive advantages as an investment destination  Attract value-add investments that can lead to job creation and boost business and investment activity  Engage with potential investors at an earlier stage of the location process, through enhanced market intelligence  Design specific promotional activities best suited to our identified target markets  Effectively identify – through market research - potential investors and pursue B2B pitch meetings 2.5 Situational Analysis ‐ Cyprus macroeconomic and FDI indicators Following a severe economic crisis, Cyprus implemented an economic adjustment programme from April 2013 to March 2016. The programme provided financing by the European Stability Mechanism (ESM) and the IMF of about €7.8bn, aiming at putting Cyprus' public finances back on a sustainable path, ensure financial stability, implement structural reforms to restore competitiveness, and regain international capital market access at sustainable rates (European Commission, 2017). Cyprus managed to exit the international support programme much earlier than expected, entering an era of economic recovery and taking the first steps towards economic growth, with the Cypriot economy reached growth rates of 2.8% in 2016. Cyprus’ economic performance attracted international praise from prominent figures and organisations such as the 21    European Investment Bank (EIB) and the IMF, while consecutive upgrades from credit rating agencies reinforced Cyprus’ dynamic return in international markets and its re-establishment as a thriving business centre of excellence (Invest Cyprus, 2017). According to the EU Commission Winter 2018 Economic Forecast, Cyprus is experiencing a very strong recovery, with growth reaching 3.8%, rendering Cyprus one of the fastest growing economies in the euro area (EU Commission, 2018). Growth is expected to continue on a steady pace, however slightly reduced to 3.2% and 2.8% in 2018 and 2019 respectively (EU Commission, 2018). The EU Commission also sees a decline in unemployment, expected to reach 9% from 11% until 2019, while the IMF expects a recorded unemployment of 11.3% in 2017 and 10.0% in 2018 (IMF, 2018). However, as per international credit rating agencies, Cyprus is currently still below investment grade, having though being upgraded to Cyprus is BB+/Ba3/BB/BB (low) rated by S&P/Moody’s/Fitch/DBRS agencies respectively, with a positive outlook. Cyprus’ economy is definitely regaining momentum. According to the Cyprus Ministry of Finance (MoF, 2018), the Cypriot economy recorded a 3,9% real GDP growth in 2017, marking the 12th consecutive quarter in positive territory. Robust growth of around 3% is projected for both 2018 and 2019. The consolidation of public finances, an ambitious reform programme implemented by the Cyprus government and the declining – although still high – level of non-performing loans have also contributed to restoring investor confidence in the Cyprus economy (KPMG, 2017). Structural reforms are still underway with government officials vowing to continue on this path, determined to ensure a robust institutional framework that would, ensure FDI attraction. The table below shows the main economic indicators from 2013 until 2017, as per the figures published by the Cyprus Ministry of Finance (MoF), the International Monetary Fund (IMF) and the European Commission (EC), including projections for 2018 and 2019. 2013 2014 2015 2016 2017 2018 2019 (pr.) (pr.) EC -6.0 -1.5 1.7 3,0 3,8 3,2 2,8 IMF -5.9 -1.4 2.0 3.0 3.8 3.6 2.9 MoF -5.9 -1.4 2.0 2.8 3.9 3 2.7 Table 2: Main economic indicators for Cyprus 2013‐2019 (in %)   22    However, according to the IMF’s risk assessment (2017) Cyprus’s current high level of public debt renders the country more vulnerable to macro-fiscal shocks that can halt growth and directly affect investment. Due to the growth that has been achieved, nevertheless, Cyprus experienced a wave of renewed investor interest, manifested in numerous investments in a variety of economic sectors. Specifically, FDI inflows recorded a notable increase of 9.1% within the second quarter of 2016, the second largest increase across Europe (Eurostat, 2016). 6.7 1.9 0.55 2013 2014 2015 2016 ‐4.9 € (bn)   Figure 4: FDI inflows into Cyprus 2013 – 2016 (Source: Central Bank of Cyprus) As shown in the chart above, FDI inflows following Cyprus’ economic recovery have recorded a significant rise, slightly decreasing only in 2016, a fact which however was recognised as a global decreasing trend by UNCTAD (2017). From the graph, we can also see that in 2013 and 2014, FDI reached negative levels, thus leading to the conclusion that the crisis and economic volatility and uncertainty negatively affect investment decisions. Cyprus’ success in attracting FDI over the recent decades has been generally limited to particular sectors related mostly to real estate and Financial/professional services including banking (EC, 2018). These types of investments are typical for service-based economies and Cyprus has truly developed these sectors. However, in the past 3 years, Invest Cyprus has shifted focus into other niche areas, such as start-ups and innovation, the audiovisual industry, thematic tourism and investment funds, advocating for reform in establishing the regulatory frameworks that would render the backbone of these industries and allow for their further development (Invest Cyprus, 2018). In parallel with international trends, Invest Cyprus focuses its promotional efforts in 23    Billion Euros regional headquartering, which runs across sectors and can have multiple benefits for the economy. The positive investment momentum is expected to continue (European Commission, 2017), despite the minor fall-back recorded in 2016. The continuous diversification of the economy is manifested in increased contribution to GDP growth by all sectors, except financial services and ICT (European Commission, 2017). In order for Cyprus to build on strong FDI foundations by proactively developing an even more appealing and competitive platform for FDI, Invest Cyprus is constantly advocating reform towards a more simplified and thus friendlier and more efficient environment towards foreign investors. Recent reforms have resulted in a solid, restructured and modernized state, that ensures speed, efficiency, transparency and ease of doing business, re-establishing Cyprus as a reliable and robust business centre. Reforms and initiatives promoted and adopted in the past years, in which Invest Cyprus had a direct contribution are: Improvement of Incentives Other Initiatives regulatory framework Attractive Incentives Package Enhanced and framework for for the audiovisual comprehensive investment funds industry digital marketing strategy Modernisation of Tax incentives for External Registrar of corporates and communications Companies individuals consultants abroad Incentives for start- Brexit strategy to E-government ups and innovative attract companies companies wishing to relocate Figure 5: Invest Cyprus’ contribution to reforms and initiatives 2013 – 2017 24    All of the above created the need to change direction, and, according to the Organisation’s Director General, to “redefine priorities and redesign the Agency’s strategy and optimise emerging opportunities” (Chrysostomou, 2018). As per the Organisation’s Strategy (2016) and Action Plan (Invest Cyprus 2017; Invest Cyprus; 2018), external environment developments such as Brexit, and internal conditions, such as economic growth, give a boost to the possibility of attracting high quality investment. In line with international trends, Invest Cyprus also focuses its efforts on strengthening relations with existing investors in an effort to achieve expansion of their activities as well as attraction of new investments through positive word of mouth. 2.6 Cyprus’ value proposition and international competitiveness   Apart from an impressive economic performance and macroeconomic forecasts, Cyprus enjoys a number of competitive advantages, upon which the value proposition of the country is formed and promoted by Invest Cyprus. The country’s appeal as an investment destination is also being enhanced by incentives and continuous improvements to the business and investment environment, as described above. The value proposition of Cyprus revolves around the following main pillars (Invest Cyprus, 2018): Geostrategic location between 3 continents Business-friendly environment High quality of life Cyprus Highly skilled Modernised tax human talent and legal framework EU and Eurozone member state Figure 6: Cyprus’ value proposition as an investment destination 25    Two of the most important tools investors look at when making an investment decision are the Global Competitiveness Report of the World Economic Forum and the Doing Business Report of the World Bank. It is, therefore, crucial to be ranked favourably in these reports in order to be high in the shopping list of international investors. The Global Competitiveness Index 2017–2018 evaluates the national competitiveness of 137 economies, in terms to the set of institutions, policies and factors that determine the level of productivity and prosperity, such as macroeconomic environment, business sophistication, labour market efficiency, higher education and training, health and primary education, innovation and technological readiness. The Doing Business Report assesses ease of doing business in 190 economies, in regards to ten main indicators: Starting a business, Dealing with construction permits, Getting electricity, Registering property, Getting credit, Protecting minority investors, Paying taxes, Trading across borders, Enforcing contracts and Resolving insolvency. Invest Cyprus monitors these reports, trying to identify weaknesses that lead to negative rankings, and find efficient solutions to improve the country’s ranking. In regards to the Doing Business Report, the Organisation has the coordinating role in the overall effort to complete the relevant questionnaires, organising meetings with all interested parties and involved stakeholders to exchange views and reach specific suggestions on reform needed to improve Cyprus’ ranking. Invest Cyprus followingly has the responsibility of liaising with the responsible governmental authorities to promote suggested reforms for the improvement of the country’s ease of doing business climate. In 2017, Cyprus ranked average in both reports; in the Global Competitiveness Report, Cyprus was ranked 64th most competitive nation globally out of 137 countries (World Economic Forum, 2017). Despite of climbing 19 places up the ladder, Cyprus still ranks lower than 24 other EU member states (Cyprus Mail, 2017). In the Doing Business Report for the year 2018, Cyprus’s position was deteriorated, dropping to place 53 from 45 the previous year (World Bank, 2017). However, this does mean that Cyprus has not taken any measures to improve its business and investment environment, since the results of the report are comparative to the progress made by other economies as well. The table below shows a comprehensive representation of Cyprus’ rankings in the Doing Business Report in the past 3 years: 26    RANKING INDICATOR 2018 2017 2016 Overall ranking  53  45 41 1. Starting a business  50  53 60 2. Construction permits  120  125 122 3. Getting electricity  67  63 68 4. Registering property  92  91 89 5. Getting credit  68  62 42 6. Protecting minority investors  43  27 25 7. Paying taxes  44  34 36 8. Trading across borders − 45 − 45 45 9. Enforcing contracts  138 − 139 139 10. Resolving insolvency  21 − 16 16 Table 3: Results of Doing Business Report 2016 – 2018 (Source: World Bank)   2.7 SWOT Analysis   As per the data examined so far in this chapter, and the Strategy of Invest Cyprus (2016), the below SWOT Analysis was created, as a crucial step towards the identification of the main risks that Invest Cyprus is facing nowadays.   Except from the SWOT Analysis included in Invest Cyprus’ strategy, no risk management framework seems to be currently in place, although certain processes seem to be performing this exact role, such as the existence of a Strategy Committee whose role is to examine trends and developments and set the course of action to avoid specific situations’ escalation into crises. It is not however, a systematic process, documented and enforced throughout the Organisation and its activities. 27    Strengths Weaknesses • Organisational structure that • Lack of executive powers allows flexibility • Limited resources - • Distinguished members of reliance on state funding Board of Directors • Not a one-stop-shop • Good relations with all • Financial services sector external stakeholders (public challenges & private sector, media etc) • Geopolitical risk • Cyprus market realities perceptions • Cyprus' competitive • Lack of incentives advantages • Lack of investment opportunities • Opportunities Threats • High sectorial potential • Decelerating reform • Opportunities arising from process regional/global • Increasing public control developments • Reduced flexibility • Strong growth prospects • Highly competitive • Deputy Ministry for Growth environment and Competitiveness • GDPR Legislation on Data • Possible solution of Cyprus Protection problem • EU investment screening • Digital revolution law     Figure 7: SWOT Analysis for Invest Cyprus 28    Chapter 3 Methodology       This chapter describes the methodology used for the case study of this thesis, describing the techniques used as regards to both data collection and data analysis while stating the main research questions and hypotheses formed. 3.1 Survey design, Sample size and Data collection Following an analysis of the internal and external context of the Organisation through existing literature and publicly available data and the SWOT analysis performed based on them, this case study uses a qualitative risk profiling technique to determine the risk profile of Invest Cyprus, through the eyes of its staff. The target population of this survey was the total of Invest Cyprus’ employees, which amounts to 10 people. It is a relatively small Agency however the goal was to achieve 100% response rate and have full representation of all levels. Data was collected through the use of a questionnaire, via Google Forms. The questionnaire was designed on the basis of consultation with the thesis’ supervisor. It was sent to all participants, after obtaining written approval from the Agency’s management. The questionnaire includes a variety of question types, such as closed, dichotomous, rank order, multiple choice and rating scales’ questions, and matrix table questions, excluding open ended questions aiming at minimizing the required time needed to fill the questionnaire. The purpose was to keep it short and simple, as well as targeted and structured, in order to get the desirable results. As far as the risk types included in the questions examining impact and likelihood, these were included based on the situational analysis performed in the previous chapter, which outlined the main risks the Organisation has been facing and have been obstructing its line of work in the past years. The questionnaire is fully structured and comprises of 24 questions into three (3) sections, covering the following aspects: 1. Demographics and general risk knowledge, 2. Risk mapping and 29    ranking, and 3. Risk management techniques. Section 1 of the questionnaire includes questions on demographics and general Questions on risk-related issues and an overall assessment of the existence of risk-related processes within the operations and strategy of Invest Cyprus. In Section 2, participants were asked to rate risk categories and types according to likelihood and impact, on a pre-defined 5-point scale, as well as set the risk appetite level of each risk category. “Risk categories” were written in capital letters while, their subcategories, hereinafter called “risk types” were listed below each category in small letters. Moreover, participants where asked to respond on whether the predefined risk categories were being dealt with via the established risk management framework or processes. In Section 3, participants were asked to define which risk management profiling techniques the Organisation is currently using (out of a list of pre-defined options, rate the effectiveness of these techniques and state their level of agreement with a number of statements regarding the use of risk management within corporations and within the specific Organisation. The Questionnaire is presented in Appendix I. 3.2 Data analysis Results are described using visuals (e.g. Charts, graphs etc.) in a separate section of Chapter 4, followed by risk estimation in relevant matrices as well as a two-dimensional graphical presentation assessing likelihood and impact using a 5X5 risk matrix, defining three (3) risk levels. This risk analysis is used to produce Invest Cyprus’ risk profile, giving a rating to each risk and proceeding to risk prioritization that should be the basis of the risk treatment process. To determine the level of each risk, one can again refer to the risk matrix. The risk level is identified by intersecting the likelihood and consequence levels on the risk matrix (Berg, 2010), and is a useful tool towards risk prioritisation. According to the analysis of results, the following risk matrix will be constructed, plotting the severity of each risk on two axis, likelihood of occurrence and level of impact: Impact Very low Low Medium High Very high Very high High Medium Low Very low Figure 8: Risk matrix template used 30    Likelihood Risk level is determined and defined as follows: Risk level Risk definition High Risks that either have severe impact or high likelihood of occurrence and should be monitored and/or avoided/ managed/ treated effectively. Medium Risks that should be monitored but should be evaluated individually on a case per case basis to determine whether to respond. Low Risks that could be safely neglected. Table 4: Risk levels and relevant definitions In order to rate impact and likelihood, a scale of 1 to 5 is used. Following risk estimation, risk score will be calculated as Likelihood x Impact. 3.3 Research Questions and Hypotheses The study will examine the following research questions: 1. What types of risks do IPAs worldwide face in general and what risk profiling techniques do they have in place? 2. Which risks and in what level (likelihood and importance) constitute Invest Cyprus’ risk profile? 3. Does the specific Organisation have a risk management framework in place and is it embedded in its corporate culture, strategy and operations? 4. Are these risks identified and handled in a timely and effective manner? 5. Which profiling techniques are used in this Organisation and how effective are they (if any)? 6. Which techniques could be alternatively used in order to ensure a more accurate profile? Research Question Hypothesis 1. IPAs are expected to be facing several risks, mainly in regards to the political and economic context not only of their own country but also on a global basis, as these would have a direct effect in their efforts to attract foreign investment. They are also expected to face 31    operational risks, such as lack of resources and/or limitation of authority, as well as administrative processes and bureaucratic dysfunctions. Legal risks are also important especially now in regards to the new GDPR legislation, as well as in regards to the need to comply with relevant EU regulations. 2. The specific Organisation is expected to be facing all risks mentioned above, and especially operational risks, as it is a relatively new and small Organisation, with no executive powers, therefore with a limited role not allowing actual negotiation and finalisation of investment agreements. 3. Invest Cyprus is expected to have a risk management framework in place since it is a new Organisation and should be up-to-date with all new concepts in such an important field. 4. Due to its limited role and powers, it is expected that the Organisation might not have absolute control over some risks it is facing and it therefore might not able to handle them effectively. 5. The Organisation is expected to be using traditional qualitative risk profiling techniques. 6. The Organisation should be outsourcing these functions in order to ensure a more professional risk profiling by experts of the field. Table 5: Hypotheses for pre‐set research questions  3.4 Study limitations    The sample of the study – amounting to 10 persons - is quite small to derive results that can be considered generalised. It represents, however, the total of the Organisation’s staff, and the survey had a 100% response rate.  The use of qualitative profiling techniques could be enhanced in a future study with supporting quantitative methods such as Bow-Tie, Monte Carlo etc.  The literature review regarding Invest Cyprus was limited to the Organisation’s Strategy, which was formed in 2013 and then reviewed in 2016, as well as its Articles of Association, its Annual Reports and media references. This is due to the fact that it is a new Organisation and therefore no literature exists on the specific subject. Benchmarking exercises with other IPAs have not been performed at an academic level and are rather 32    done through surveys conducted by international Organisations such as the IMF, the World Bank and WAIPA.  The lack of specific data on behalf of the Organisation did not allow for a hypothesis testing to be performed comparing the risk level of risks deriving from the literature review with the level of risks deriving from the empirical study. 33    Chapter 4 Results       A summary of the participants’ responses is provided below, divided into sections as per the Questionnaire, and followed by a discussion of the main findings of the survey and replies to the research questions initially set. In regards to the response rate, the survey was filled by all 10 employees of the Organisation from all hierarchical levels, thus recording a 100% rate. 4.1 Responses to Section 1 – Demographics and general knowledge   In regards to demographics, 60% of the respondents are at the level of “Officer”, while the remaining 40% (4 persons) are equally divided between 1 Director, 1 Senior Officer, 1 member of the Administrative Staff, and 1 person who chose “Other”. Due to the fact that the Organisation has been operating for only 11 years now, we note that most employees are relatively new. Years of employment results can be shown in the graph below: Years of employment 30% 20% 10% 40% 1 2-4 5-7 8-10 Figure 9: Responses on Years of employment 34    In regards to familiarity with different relevant terms, as shown in the graph below, the majority of participants are familiar of the terms risk management (80%) and risk culture (60%), rather than risk profile and risk appetite, which are more specialised terms, and therefore, one needs to have a risk-related background to know them. Familiarity with terms Risk culture 60% Risk appetite 30% Risk profile 50% Risk management 80% 0% 20% 40% 60% 80% 100% % of response Figure 10: Responses on Familiarity with four (4) predefined terms All respondents are familiar with the Organisation’s strategic objectives. It is however, worth noting that their responses to the next two questions regarding the existence of a risk framework and the alignment of this framework with the Organisation’s strategic objectives vary, therefore showing different perceptions and views on this issue. In specific, only 40% of respondents believe there is a comprehensive risk management framework in place to address risks endangering its normal operations, with the same respondents stating it is aligned with the Organisation’s objectives. All participants acknowledge the importance of risk management in the investment promotion context, with 90% of participants rating it as “Very important”, and only 10% as “Somewhat important” while no one responded negatively or even neutrally in this question. 35    Term What is interesting is the fact that employees do not agree on who has the responsibility of overseeing risk management, as shown in the chart below. This comes in line with their lack of agreement on whether there is a risk management framework in place and indicates an overall lack of knowledge on the subject, which could be due to their lack of involvement in such processes. Who has the responsibility of overseeing risk management within Invest Cyprus 10% Board of Directors 20% Top Management Relevant assigned Officer All of the above None of the above 70% Other Figure 11: Responses on Question: “Who has the responsibility of overseeing risk management?”   Supporting the above assumptions in a dichotomous Yes or No question, 70% of the respondents confirmed that risk culture is not clearly defined, communicated and reinforced in the Organisation. However, 60% of the employees seems to believe that the Organisation is able to respond to changes quickly and effectively, out of which only 33.3% are directly involved with risk-related processes. Only 20% of respondents have a risk management background. 36    100% 90% 80% 70% 60% 60% 60% 60% 50% 40% 40% 40% 40% 30% 20% 10% 0% Is the Organisation able to Are you directly involved Do you have any risk respond to changes with risk-related management background quickly and effectively? processes? (academic or professional)? Questions Yes No Figure 12: Responses on three interconnected questions Risk-related skills do not seem to be incorporated in either the Organisation’s recruitment process or the appraisal process, with participants responding “Yes” amounting to barely 30% and 20% respectively in the two questions. What is highly important in the budget allocation to risk management, reference to which was not found during the literature review phase of the study. 70% of respondents responded negatively when asked of the existence of a specific budget allocated to risk management. 4.2 Responses to Section 2 – Risk Mapping and Ranking Rating the pre-defined risk categories and types both in terms of impact and in terms of likelihood separately, the participants’ responses varied but weighed in general towards defining the majority of the risks as likely to happen and as entailing severe impact. Detailed risk rating in regards to likelihood of occurrence and in regards to impact is shown separately in the two relevant tables below, where all replies sum up to a 100% in each risk category/ type. 37    % of responses RISK CATEGORY/TYPE Very Likely Possible Unlikely Highly N/A likely unlikely HAZARD RISKS 60% 20% 20% FINANCIAL RISKS 20% 10% 60% 10% Lack of resources 50% 20% 20% 10% Dependence on public funding 70% 20% 10% Liquidity risk 20% 40% 30% 10% Interest rate and foreign 10% 40% 30% 20% exchange risk OPERATIONAL RISKS 10% 80% 10% Corporate security 20% 40% 30% 10% Cyber risk and data security 50% 40% 10% Outsourcing implications 20% 50% 20% 10% IT failure 10% 70% 10% 10% Organisational change 20% 50% 20% 10% Human Capital quality 20% 30% 40% 10% Structural efficiency (of 20% 20% 40% 10% 10% procedures in place) STRATEGIC RISKS 20% 20% 50% 10% Customer satisfaction 20% 50% 20% 10% Reputation (within Cyprus) 30% 40% 20% 10% Reputation (abroad) 40% 20% 30% 10% Market reliability 40% 30% 10% 10% 10% Market size 10% 20% 50% 20% International market realities 20% 40% 30% 10% Competition 20% 40% 20% 20% Lack of political backing 10% 40% 30% 20% Lack of cooperation with public 20% 10% 20% 40% 10% and private sectors Lack of executive powers 50% 40% 10% COMPLIANCE RISKS 20% 70% 10% OTHER RISKS 10% 10% 60% 10% 10% Lack of investment opportunities 10% 50% 10% 30% Lack of incentives 10% 60% 10% 20% Regulatory framework non- 40% 30% 30% conducive to investments Table 6: Responses on likelihood of pre‐defined risk categories and types 38    RISK CATEGORY/TYPE Extensive Major Medium Minor No N/A impact HAZARD RISKS 10% 20% 50% 20% FINANCIAL RISKS 40% 30% 20% 10% Lack of resources 50% 30% 20% Dependence on public funding 30% 60% 10% Liquidity risk 30% 50% 10% 10% Interest rate and foreign 10% 40% 50% exchange risk OPERATIONAL RISKS 50% 40% 10% Corporate security 10% 40% 40% 10% Cyber risk and data security 10% 50% 30% 10% Outsourcing implications 40% 40% 20% IT failure 40% 40% 20% Organisational change 10% 60% 20% 10% Human Capital quality 10% 60% 20% 10% Structural efficiency (of 10% 50% 10% 20% 10% procedures in place) STRATEGIC RISKS 40% 20% 30% 10% Customer satisfaction 30% 40% 20% 10% Reputation (within Cyprus) 40% 40% 10% 10% Reputation (abroad) 50% 20% 20% 10% Market reliability 40% 30% 30% Market size 10% 30% 40% 20% International market realities 30% 40% 20% 10% Competition 40% 40% 10% 10% Lack of political backing 50% 30% 10% 10% Lack of cooperation with public 40% 40% 10% 10% and private sectors Lack of executive powers 50% 40% 10% COMPLIANCE RISKS 10% 50% 30% 10% OTHER RISKS 40% 10% 30% 10% 10% Lack of investment opportunities 30% 50% 20% Lack of incentives 40% 40% 10% 10% Regulatory framework non- 30% 50% 10% 10% conducive to investments Table 7: Responses on impact of pre‐defined risk categories and types 39    Moreover, participants were asked to state whether the above risk categories are being dealt with via the established risk management process or other processes within the strategic planning of the Organisation. In their majority, replies were positive, as shown in the graph below: 40% Other risks 20% 40% 30% Compliance risks 10% 60% 10% Strategic risks 10% 80% 10% Operational risks 90% 20% Financial risks 10% 70% 20% Hazard risks 50% 30% 0% 20% 40% 60% 80% 100% % or responses N/A No Yes   Figure 13: Responses on whether the predefined risk categories are being dealt with via the established risk management framework or processes   In regards to risk appetite, participants were asked to rate each category’s appetite level defining which risks should be avoided at all cost and which if possible, for which risks exposure or impact should be reduced and which risks the Organisation can tolerate without any further action required, 40    Rsk categories 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Hazard risks Financial risks Operational risks Strategic risks Compliance risks Other risks Avoid at all cost Avoid, if possible Reduce exposure Minimise risk impact Accept with no further action Figure 14: Responses on risk appetite level as per pre‐defined 5‐point scale rating   4.3 Responses to Section 3 – Risk Management Techniques   The majority of participants (70%) showed familiarity with the risk techniques used, which, according to responses, include mostly qualitative methods, as shown below: Use of risk management techniques 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Qualitative Graphical Quantitative Model-driven Combination None of the N/A visualisation approaches of the above above in matrix Technique Figure 15: Responses on the use of risk management techniques by Invest Cyprus 41    Responses (%) Participants were also asked to rate the effectiveness of these techniques, on a 6-point Likert scale, indicating that the most effective way is to use a combination of the above techniques in order to achieve the best possible result. A high percentage of the responses was “N/A”, which was expected following the review of responses in the previous question. Effectiveness of risk management techniques 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Qualitative Graphical Quantitative Model-driven Combination of the visualisation approaches above Very effective Satisfactory Neutral Not so effective Not at all effective N/A Figure 16: Responses on effectiveness of risk management techniques In the last question, participants were asked to indicate their level of agreement with a number of statements, using a 5-point scale, aiming at determining the exact situation in regards to risk management currently at the Organisation and their opinions on how it should be. There is an overall variety of opinions on the below statements, while an agreement is noted on the importance of risk management, the fact that it should be integrated into all strategic processes of the Organisation, as a systematic and dynamic process, as well the necessity to proceed with this as soon as possible to avoid any kind of disruption of business continuity. The table below shows the answers of participants at the pre-set statements, regarding risk management as a process itself and risk management processes within Invest Cyprus. All replies sum up to a 100% in each statement. 42    Strongly Agree Neutral Disagree Strongly agree Disagree Risk management is a value-add 50% 50% tool for any corporate. Risk management is an integral 10% 30% 10% 40% 10% part of all strategic processes of Invest Cyprus. Risk management should be an 30% 70% integral part of all strategic processes of Invest Cyprus. Risk management in Invest Cyprus 10% 20% 30% 20% 20% is a systematic, dynamic and transparent process. Risk management in the 30% 70% Organisation should be a systematic, dynamic and transparent process. Risk management is embedded in 10% 10% 40% 20% 20% the Organisation's culture at all hierarchy levels. The Organisation has the right 10% 20% 40% 30% people, processes and infrastructure to identify risks effectively. The Organisation has the right 10% 10% 40% 40% people, processes and infrastructure to assess risks effectively. The Organisation has the right 10% 30% 20% 30% 10% people, processes and infrastructure to manage risks effectively. The use of risk management 30% 60% 10% techniques should be established as soon as possible so as to avoid future disruptions and ensure business continuity. Table 8: Responses on agreement with specific statements using a 5‐point scale   43    4.4 Risk estimation and mapping The impact score and likelihood score and the total risk score of each risk category and type have been calculated and are shown in the table below. The impact score and the likelihood score were found through calculating the average (using the relevant formula in Excel) of the responses for each risk category and type. Risk score is measured as the Impact score X the Likelihood score. No (as in risk Impact Likelihood Risk score RISK CATEGORY/TYPE matrix) score (X) score (Y) (𝑹 𝑿 𝒀 1. HAZARD RISKS 3.20 2.40 7.68 2. FINANCIAL RISKS 4.00 3.30 13.20 3. Lack of resources 4.30 4.00 17.20 4. Dependence on public funding 4.10 4.60 18.86 5. Liquidity risk 4.00 3.60 14.40 6. Interest rate and foreign exchange risk 2.60 2.40 6.24 7. OPERATIONAL RISKS 3.40 2.90 9.86 8. Corporate security 3.50 2.70 9.45 9. Cyber risk and data security 3.60 3.30 11.88 10. Outsourcing implications 3.20 2.80 8.96 11. IT failure 3.20 2.80 8.96 12. Organisational change 3.70 3.70 13.69 13. Human Capital quality 3.70 3.50 12.95 14. Structural efficiency (of procedures in place) 3.55 3.44 12.21 15. STRATEGIC RISKS 3.90 3.40 13.26 16. Customer satisfaction 3.90 3.70 14.43 17. Reputation (within Cyprus) 4.10 3.90 15.99 18. Reputation (abroad) 4.10 3.90 15.99 19. Market reliability 3.80 3.80 14.44 20. Market size 3.30 3.20 10.56 21. International market realities 3.90 3.70 14.43 22. Competition 4.10 3.60 14.76 23. Lack of political backing 4.20 3.40 14.28 24. Lack of cooperation with public and private sectors 4.10 2.90 11.89 25. Lack of executive powers 4.30 4.40 18.92 44    26. COMPLIANCE RISKS 3.60 3.00 10.80 27. OTHER RISKS 3.88 3.11 12.07 28. Lack of investment opportunities 3.90 3.40 13.26 29. Lack of incentives 4.10 3.60 14.76 30. Regulatory framework non- conducive to investments 4.00 3.10 12.40 Table 9: Impact score, Likelihood score and Risk score calculations   Followingly, the relevant risk matrices are created, based on the above calculations. Risk matrices do not represent a precise estimation of risk, but provide a high-level risk assessment, which allows for better planning and decision-making, through sound risk prioritization and treatment. The first risk matrix, presented on a bi-dimensional graph marking impact and probability, maps the relevant risk categories and types in the appropriate risk level, using the referenced numbering and calculations in Table 9 above. Risk assessment graph for both risk categories and types 5 4 25 4 19 17, 18 3 12 16, 21 14 5 22, 29 20 23 3 9 1315, 28 230 10,11 7 3 27 24 8 2 6 1 1 0 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Likelihood Figure 17: Graphical representation of risk matrix showing categorisation of risk categories and types as per assigned impact and likelihood score 45    Impact The second risk matrix maps only the relevant risk categories as per their estimated risk level, using the same numbering and calculations. Risk assessment graph for risk categories only 5 4 15 26 2 3 7 27 2 1 1 0 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5   Figure 18: Graphical representation of risk matrix showing categorisation of risk categories as per assigned impact and likelihood score 4.5 Discussion of findings   As shown in the risk matrices above, the majority of the risks examined through this empirical study are “High” level risks (portrayed in red). Only one risk type: “Interest rate and foreign exchange risk” is considered as “Medium” level by participants, while no risks are considered “Low” risk level according to the participants’ perceptions. The most important risks that have both a severe impact and a high likelihood of occurrence are: “Dependence on public funding” and “Lack of executive powers”, which fall under the categories of Financial risks and Strategic risks respectively. Invest Cyprus’ staff seems to understand the importance of controlling these high-level risks to ensure business continuity. This is demonstrated through their answers in the relevant question asking participants to determine the risk appetite level of risk categories, to which they replied that Financial risks should be avoided at all cost, while Strategic risks should either be avoided at all cost or avoided, if possible. 46    The limited financial abilities and the lack of executive powers of Invest Cyprus also represent important risks according to the participants’ responses. This conclusion is in line with the Literature Review results, which underline the importance of these two elements as factors that prohibit the achievement of the Organisation’s strategic objectives. The Organisation should exert all possible efforts towards increasing its budget and towards obtaining additional powers that would increase its influence and abilities and subsequently lead to a successful increase of FDI inflows. Another suggestion would be for the Organisation to seek alternative forms of funding, so as to reduce dependency from public money and be able to cover its needs in a different way. Even though the following risk categories and types are considered to have a major impact, they were rated as “Medium” in regards to likelihood. These risks should be systematically monitored, while the possibility of further action should be examined and decided upon on a case by case basis. Appropriate action to mitigate their impact should definitely be taken in cases where a risk trigger appears indicating increased likelihood of occurrence.  Hazard risks  Operational risk  Corporate security  Outsourcing implications  IT failure  Compliance risks  Lack of cooperation with public and private sectors All other risks in the categories in between should be both monitored and/or avoided/ managed/ treated effectively, through a systematic process of risk management, as they are very likely to occur and can have a severe negative impact in case of occurrence. The fact that no risk categories or types were rated as “Low” risk according to the perceptions of the employees of Invest Cyprus can be attributed to the fact that the risk categories and types which were included in the questionnaire were identified as important risks from the research initially made and presented in the “Literature Review” chapter. Therefore, the risks were not randomly chosen, but were rather targeted and it was therefore expected they would be rated as highly important risks. The goal was to examine whether the staff of the Organisation has a good understanding of the main risks the Organisation is facing. Good understanding is an important 47    element towards good judgment on the part of employees in relation to actions required to manage these risks. In this regard, employees seem to be well aware of the main risks the Organisation is facing and agree on the importance of risk management for any business today, including Invest Cyprus. As noted in the Literature review Chapter, no evidence was found of the existence of a comprehensive risk management framework that identifies, assesses, evaluates and monitors any risks endangering the Organisation’s normal operation, and deciding on risk treatment actions. The fact that there is no uniformity in the participants’ responses on the relevant question is considered as evidence supporting the assumption that there is in fact no comprehensive risk management framework in place. It seems, however, that there are scattered processes that deal with risk management, and the relevant officers who are involved in the specific procedures are probably the ones who responded positively to this question. Another explanation would be a level of ignorance on the part of employees on this matter and on the definition and processes that a risk management framework involves. Participants argue that it is crucial to set in place a comprehensive risk management framework, which would ensure business continuity and the achievement of Invest Cyprus’ strategic objectives. It is worth noting however that employees believe that the majority of the risks faced by the Organisation are being dealt with through the existing processes in place, despite the absence of a comprehensive framework. However, the participants’ responses show little understanding of the concepts and the processes revolving around risk management. As risk-related skills are not included in either the recruitment or the appraisal process of the Organisation and the majority of employees is not involved in risk-related processes and does not have a risk-related background, the Organisation should train its staff accordingly to have at least a sound high level understanding of risk management and be able to perform risk-related tasks effectively. In regards to risk techniques, the Organisation mainly uses qualitative techniques up to this moment, which are considered quite effective by the employees. Employees also agree on the effectiveness of a combination of techniques for a more efficient risk management, which is also in line with the main conclusions derived from the theoretical research performed. In the table below, the main conclusions of the study are listed, supporting or rejecting the hypotheses initially formed and providing answers to the relevant research questions set. 48    Research Question Hypothesis Result 1. What types of risks IPAs are expected to be facing several Hypothesis supported by both do IPAs worldwide risks, mainly in regards to the literature review and face in general and political and economic context not empirical study results. what risk profiling only of their own country but also on techniques do they a global basis, as these would have a have in place? direct effect in their efforts to attract foreign investment. They are also expected to face operational risks, such as lack of resources and/or limitation of authority, as well as administrative processes and bureaucratic dysfunctions. Legal risks are also important especially now in regards to the new GDPR legislation, as well as in regards to the need to comply with relevant EU regulations. 2. Which risks and in The specific Organisation is expected Hypothesis supported by what level to be facing all risks mentioned survey results. Invest Cyprus (likelihood and above, and especially operational is facing all kinds of pre- importance) risks, as it is a relatively new and defined risks included in the constitute Invest small Organisation, with no executive main risk categories of Hazard, Cyprus’ risk profile? powers, therefore with a limited role Financial, Operational, not allowing actual negotiation and Strategic, Compliance and finalisation of investment other risks that could have a agreements. severe impact on its efforts and are likely to occur. 3. Does the specific Invest Cyprus is expected to have a Hypothesis rejected. Invest Organisation have a risk management framework in place Cyprus does not seem to have risk management since it is a new Organisation and a comprehensive risk framework in place should be up-to-date with all new management framework in and is it embedded concepts in such an important field. place. It rather has scattered in its corporate risk-related processes that 49    culture, strategy partly serve the purpose of and operations? risk management. However, risk culture is not embedded in neither the mentality, the structure or the operations of the Organisation. 4. Are these risks Due to its limited role and powers, it Hypothesis supported by identified and is expected that the Organisation literature review. Partly handled in a timely might not have absolute control over supported by survey results, and effective some risks it is facing and it therefore as participants argue that manner? might not able to handle them Invest Cyprus effectively effectively. handles risks in a timely and effective manner. 5. Which profiling The Organisation is expected to be Hypothesis supported. Lack of techniques are used using traditional qualitative risk human resources and capital in this Organisation profiling techniques. might not allow the use of and how effective other more sophisticated are they (if any)? methods that could require outsourcing or recruitment of specialists. 6. Which techniques A variety of techniques. The Hypothesis supported by the could be Organisation should be outsourcing participants’ replies regarding alternatively used in these functions in order to ensure a the effectiveness of other order to ensure a more professional risk profiling by techniques apart from more accurate experts of the field. qualitative ones, especially in profile? regards to using a combination of techniques to ensure a more accurate and holistic approach and result. Table 10: Evaluation of initial hypothesis and answers to research questions   50    Chapter 5 Conclusion       Risk profiling is most definitely a multifaceted process that requires a holistic approach, sound processes and efficient tools, in order to present an in-depth understanding of all elements comprising the risk profile of an enterprise or an individual, which will, in its part, guide effective decision-making. Defining not only the type of risks, but also the amount of risk an entity can tolerate without causing disruption to its normal operations, is crucial for the business continuity and successful path of any business. The purpose of this study was to risk profile Invest Cyprus, the national body responsible for the attraction and facilitation of FDI into Cyprus, using qualitative methods. The methodology used involved the dissemination of a questionnaire amongst the employees of Invest Cyprus, the results of which were mapped through the creation of relevant risk matrices and graphical representations of the impact, the likelihood and the total risk score for a variety of risk categories and types that were identified through literature. The content of the Questionnaire was formed through a variety of elements and risks affecting IPAs’ and Invest Cyprus’ performance and success, which were identified through the literature review and agreed upon with the supervisor. In the investment promotion sector at national level, it is evident that along with a growing number of IPAs around the world, comes a growing competition amongst countries to ensure increased FDI inflows that can support the economy and form the basis for growth and prosperity. Invest Cyprus is a relatively new Organisation and does not seem to have the tools required to successfully achieve its goals in regards to attracting substantial investments. It does, however seem to have an increase role in different areas, such as advocacy and facilitation which are also important parameters in investment promotion. 51    As derived from the empirical part of the study, in line with the main conclusions of the literature review, the Organisation faces a number of important risks, which include Hazard, Financial, Operational, Strategic, Compliance and Other risks, which include the lack of investment opportunities and the lack of incentives for international investors. These categories were identified through the literature review as critical for the successful operation and business continuity of Invest Cyprus, and were, therefore, included in the questionnaire. The most prominent risks Invest Cyprus is facing are Financial and Other risks. Limited funding, dependence on public funds, and external shocks as the economic crisis of 2013 can be quite detrimental for the Organisation. The lack of investment opportunities would immediately mean the lack of product to “sell” to international investors, while incentives are increasingly becoming a key driving force for investments in a variety of fields. It is evident that Invest Cyprus does not have a comprehensive risk management framework in place, despite the high level of risks it is facing and could significantly affect its work and operation as a whole. Forming an effective investment promotion strategy should definitely involve risk management. Especially amidst growing competition and global economic and political volatility, it is more than essential for businesses and individuals to be well-prepared and be able to avoid risks, reduce exposure to them or mitigate their impact if they cannot be avoided. The Organisation should not only create a holistic framework embedded into all aspects of its strategic and operational processes, but also embed risk management into its recruitment and appraisal processes. Not all employees should have specialized risk-related knowledge, but they should, however, receive relevant training so as to be able to do their part in identifying and pointing out risks to the relevant Risk Officer that should be part of the permanent staff of the Organisation and taking the appropriate action required. The use of qualitative methods to create a risk profile has a high level of effectiveness. In this case, the questionnaire used was highly targeted and therefore constituted an accurate method of capturing and evaluating the perceptions of the employees regarding the matter in question. However, results would be more comprehensive and accurate, if the methods also used quantitative techniques that could support the qualitative conclusions. 52    References       1. Ackermann, J. (2017). Destructive Creations: Lessons from the Financial Crisis and the Future of Europe. Retrieved from: http://www.oeb.org.cy/wp- content/uploads/2017/12/Ackermann-Presentation-at-LSE-Alumni-Association-Dec- 11-2017.pdf 2. Alfaro, L., Chanda, A., Kalemli-Ozcan, S. and Sayek, S. (2006). How does Foreign Direct Investment Promote Economic Growth? Exploring the effects of financial markets on linkages. Working paper 07-013. 3. Alkiviadou, N (2017). Sustainable Enjoyment of Economic and Social Rights in Times of Crisis: Obstacles to Overcome and Bridges to Cross. Jean Monnet Module Working Paper Series. Retrieved from: http://www.uclancyprus.ac.cy/files/5115/0407/8235/JMMWP_Dr.Natalie_Alkiviadou. pdf 4. Altenbach, T.J. (1995). A Comparison of Risk Assessment Techniques from Qualitative to Quantitative. Retrieved from: https://www.osti.gov/scitech/servlets/purl/67753/ 5. Alverbro, K., Nevhage, B. and Erdeniz, R. (2010). Methods for Risk Analysis. Stockholm: US AB. 6. Anderson, J. and Sutherland, D. (2015). Developed economy investment promotion agencies and emerging market foreign direct investment: The case of Chinese FDI in Canada. Journal of World Business, 50: 815-825. 7. Antwi, S., Gyebi, F. and Boateng, V. (2013). Investment Promotion Agencies and their Attraction of Foreign Direct Investment in Ghana. International Journal of Academic Research in Business and Social Sciences, 3(5): 1-18. 8. Aon (2015). Understanding your company’s risk profile. Retrieved from: http://www.aon.com/netherlands/global-risk-consulting/pdf/risk-management/Risk- Assessment-Productsheet-ENG.pdf 9. Aven, T. and Renn, O. (2009). On risk defined as an event where the outcome is uncertain. Journal of Risk Research, 12: 1-11. 10. Bartesaghi, M., Grey, S.H. and Gibson, S. (2012). Defining (the Concept of) Risk. Poroi, 8(1): 1-7. 53    11. Bedford, T. and Cooke, R. (2001). Probabilistic Risk Analysis: Foundations and Methods. Cambridge University Press. 12. Beg, H.-P. (2010). Risk management: Procedures, Methods and Experiences. RT&A, 1: 79- 95. 13. Blalock, Garrick, and Paul Gertler. 2008. Welfare Gains from Foreign Direct Investment through Technology Transfer to Local Suppliers. Journal of International Economics, 74(2): 402–21. 14. Borghesi, A. & Gaudenzi, B. (2013). Risk Management How to Assess, Transfer and Communicate Critical Risks. Springer, Milan; New York. 15. Brayman, S., Finke, M., Bessner, E., Grable, J., Griffin, P. and Clement, R. (2015). Current practices for risk profiling in Canada and review of global best practices. Ontario: PlanPlus. 16. Buck Consultants International (2014). Business plan for Investment Promotion Agencies in the Baltic Sea Region. Copenhagen: Baltic Development Forum. 17. Chaim, R. M. and Castellano, M. (2012). ERM quantitative risk analysis methods and techniques applied to a small commercial bank. Conference proceedings. Retrieved from: https://www.systemdynamics.org/conferences/2012/proceed/papers/P1397.pdf 18. Chivers, E., Clark, J.A. and Cheng, P.-C. (2009). Risk profiles and distributed risk assessment. Computers and Security, 28: 521-535. 19. Christofides, L.N. and Michael, M. (2010). Structural Weaknesses in the Economy of Cyprus: How Do We Score Relative to the EU15? Cyprus Economic Policy Review, 4(2): 43- 71. 20. CIMA (2007). Introduction to managing risk. Chartered Institute of Management Accountants. London: CIMA Publishing. 21. Collier, P.M. and Agyei-Ampomah, S. (2006). Management accounting: risk and control strategy. Oxford: Elsevier. (CIMA Official Study System) 22. Cross, J. (2017). ISO 31010 Risk assessment techniques and open systems. Sixth Workshop on Open Systems Dependability. Tokyo, 21.10.2017. Retrieved from: http://tc56.iec.ch/action/WOSD2017b.pdf 23. Culp, C.L. (2001). The Risk Management Process: Business Strategy and Tactics. New York: John Wiley and Sons Inc. 24. Curtis, P. and Carey. M. (2016). Risk assessment in practice. Retrieved from: https://www2.deloitte.com/content/dam/Deloitte/global/Documents/Governance- Risk-Compliance/dttl-grc-riskassessmentinpractice.pdf 25. Cyprus Mail (2017). Cyprus 64th among 137 countries in competitiveness. Cyprus Mail, 28 September 2017. Retrieved from: http://cyprus-mail.com/2017/09/28/cyprus-64th- among-137-countries-competitiveness/ 54    26. Deloitte & Touche LLP (2012). COSO. Risk Assessment in practice. Durham: COSO. 27. Dey, P.K. and Ogunlana, S.O. (2004). Selection and application of risk management tools and techniqeus for build-operate-transfer projects. Industrial Management and Data Systems, 104(4): 334-346. 28. Dinu, A.-M. (2012). Risk Types in International Business Relations. International Journal of Academic Research in Accounting, Finance and Management Sciences, 2(1): 89-95. 29. Dionne, G. (2013). Risk Management: History, Definition and Critique. CIRRELT. Retrieved from: https://www.cirrelt.ca/DocumentsTravail/CIRRELT-2013-17.pdf 30. Duce, M. (2003). Definitions of Foreign Direct Investment (FDI): a methodological note. Memo. BIS Meeting of the CGFS Working Group on FDI in the financial sector. Retrieved from: https://www.bis.org/publ/cgfs22bde3.pdf 31. Estrin, S. and Uvalic, M. (2013). Foreign direct investment into transition economies: Are the Balkans different? LSE “Europe in Question” Discussion Paper Series. LEQS Paper No. 64. 32. European Commission (2018). Cyprus: Winter 2018 Economic Forecast. Retrieved from: https://ec.europa.eu/info/sites/info/files/economy- finance/ecfin_forecast_winter_0718_cy_en.pdf 33. Fox, C. and Hather, S. (2014). Methods for assessing risk. RISM Risk Forum 2014. Retrieved from: https://www.rims.org/annualconference/riskforum2014/Documents/Methods%20for %20Assessing%20Risk.pdf 34. Frenkel, M., Hommel, U. and Rudolf, M. (eds.) (2005). Risk Management: Challenge and Opportunity. Germany: Springer. 35. Guimon, J. and Filippov, S. (2010). Competing for High-Quality FDI: Implications for Investment Promotion Agencies. Proceedings of the 7th International Conference on Innovation and Management, 242-253. 36. Harding, T. and Javorcik, B.S. (2011). Roll out the Red Carpet and They Will Come: Investment Promotion and FDI Inflows. The Economic Journal, 121(557): 1445-1476. 37. Hardouvelis, G.A. and Gkionis, I. (2016). A Decade Long Economic Crisis: Cyprus versus Greece. Cyprus Economic Policy Review, 10(2): 3-40. 38. Hellenic Bank (2017). Current Economic Developments. The Cyprus Economy. Economic Review September 2017. Retrieved from: https://www.hellenicbank.com/portalserver/content/atom/ba122ca0-b615-4054- 878e-cf272e6e3254/content/PDF/HB-ECONOMIC%20REVIEW- 1ST%20HALF%202017-EN.PDF?id=9a42063c-69be-43d4-9fd7-3706d2d4f2d8 55    39. Hornberger, K., Battal, J. and Kusek, P. (2011). Attracting FDI. How Much Does Investment Climate Matter. World Bank Public Policy Journal, Note 327. Retrieved from http://www.worldbank.org/fpd/publicpolicyjournal 40. Invest Cyprus (2013). Strategy and Action Plan. Nicosia: Invest Cyprus. 41. Invest Cyprus (2016). Strategic Plan 2017 – 2020. Nicosia: Invest Cyprus. 42. Invest Cyprus (2017). Annual Report for 2016. Retrieved from: http://www.investcyprus.org.cy/images/media/assetfile/CIPA%20ANNUAL%20REPO RT%202016_LOW%20RES.pdf 43. IOD (2012). Business Risk. A practical guide for board members. London: Director Publications Ltd. 44. IRM (2002). A Risk Management Standard. 45. Kellysears (2017). Risk Profiling Toolkit. Developing a corporate risk profile for your Organisation. Retrieved from: http://kellysears.ca/wp- content/uploads/2017/04/Risk_Profiling.pdf 46. Khakzad, N., Khan, F. and Amyotte, P. (2012). Dynamic Risk analysis using Bow-tie approach. Retrieved from: https://www.researchgate.net/publication/256459446_Dynamic_risk_analysis_using_b ow-tie_approach 47. Khatta, R.S. (2008). Risk management. New Delhi: Global India Publications Ltd. 48. Lund, M.S., Solhaug, B. and Stolen, K. (2011). Risk Analysis of Changing and Evolving Systems using CORAS. Retrieved from: http://folk.uio.no/ketils/kst/Articles/2011.FOSAD.pdf 49. Marchick, D.M. and Slaughter, M.J. (2008). Global FDI Policy. Correcting a Protectionist Drift. The Bernard and Irene Schwartz Series on American Competitiveness. CSR No. 34. US: Council on Foreign Relations Inc. 50. Marhavilas, P.K., Koulouriotis, D. and Gemeni, V. (2009). Risk analysis and assessment methodologies in the work sites: On a review, classification and comparative study of the scientific literature of the period 2000- 2009. Journal of Loss Prevention in the Process Industries. 51. Melko, A. and Ievins, J. (2012). Methods of the Environmental Risk Analysis and Assessment, the Modified Method of the Risk Index. Safety of Technogenic Environment, 2: 50-56. 52. Miskinis, A. and Byrka, M. (2014). The role of Investment Promotion Agencies in Attracting Foreign Direct Investment. Ekonomika, 93(4): 41-57. 53. Modarres, M. (2006). Risk Analysis in Engineering: Techniques, Tools and Trends. New York: Taylor and Francis Group. 56    https://books.google.com.cy/books?hl=en&lr=&id=ErjFzRWSne8C&oi=fnd&pg=PA1&d q=risk+analysis+techniques+and+tools&ots=osCg31JnVU&sig=S4evywFn5igtMdCOrioc nhpwWsM&redir_esc=y#v=onepage&q=risk%20analysis%20techniques%20and%20to ols&f=false 54. Moran, T. H., Graham, E.M. and Blomstrom, M. (2005). Conclusions and Implications for FDI Policy in Developing Countries, New Methods of Research and a Future Research Agenda. 14: 375-395. In Moran, T. H., Graham, E.M. and Blomstrom, M. (eds.) (2005). Does Foreign Direct Investment Promote Development? Washington DC: Institute for International Economics. 55. Morisset, J. and Andrews-Johnson, K. (2004). The Effectiveness of Promotion Agencies at Attracting Foreign Direct Investment. FIAS Occasional Paper 16. Washington D.C: The World Bank. 56. Mukim, Megha, and Peter Nunnenkamp. 2010. “The Location Choices of Foreign Investors: A DistrictLevel Analysis in India.” Working Paper 1628, Kiel Institute for the World Economy. 57. OECD (2002). Foreign Direct Investment for Development. Maximising Benefits, Minimising Costs. Paris: OECD Publications Service. 58. OECD (2005) Assessment of Challenges faced by MENA Investment Promotion Agencies and Investment Promotion guidelines for the MENA region. A summary overview of MENA IPAs and Recommendations for Future Actions. 59. Patterson, N., Montanjees, M., Motala, J. and Cardillo, C. (2004). Foreign Direct Investment. Trends, Data, Availability, Concepts, and Recording Practices. Washington D.C.: International Monetary Fund. 60. Pollard, S.J.T., Strutt, J.E., Macgillivray, B.H., Hamilton, P.D. and Hrudey, S.E. (2004). Risk analysis and management in the water utility sector – A review of drivers, tools and techniques. Process Safety and Environmental Protection, 2004, 82(B6): 1–10 61. Purdy, G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis, 30(6), 881-886. 62. Reniers, G.L.L., Dullaert, W., Ale, B.J.M. and Soudan, K. (2005). The use of current risk analysis tools evaluated towards preventing external domino accidents. Journal of Loss Prevention in the Process Industries, 18(3): 119-126. http://www.sciencedirect.com/science/article/pii/S0950423005000240 63. Risk Assessment Techniques. http://media.techtarget.com/searchSecurity/downloads/Security_Risk_Mgmt_Ch_10.pd f 57    64. Rjoub, H., Aga, M., Oppong, C., Subju, N. and Fofack, A. (2017). The impact of FDI inflows on economic growth: evidence from landlocked countries in Sub-Saharan Africa. Journal of Social Sciences, 10(1): 153-167. 65. Ecorys (2013). Exchange of Good Practice in Foreign Direct Investment Promotion A study carried out under the Framework Contract ENTR/2009/033. Rotterdam. 66. Sharp, J.V., Strutt, J.E., Busby, J. and Terry, E. (2002). Measurement of organizational maturity in designing safe offshore installations. Proceedings of the International Conference on Offshore Mechanics and Arctic Engineering, 2: 383–390. 67. Sotic, A., and Rajic, R. (2015). The Review of the Definition of Risk. Online Journal of Applied Knowledge Management, 3(3): 17-26. 68. Stammers, R. (2015). Beyond the Questionnaire: New Tools for Risk Profiling. 71st CFA Institute Annual Conference Proceedings. Retrieved from: https://annual.cfainstitute.org/2015/04/27/beyond-the-questionnaire-new-tools-for- risk-profiling/ 69. Stolen, K., Den Braber, F., Dimitrakos, T., Fredriksen, R., Gran, B.A., Houmb, S.-H., Lund, M.S., Stamatiou, Y.C. and Aagedal, J.O. (2002) Model-based risk assessment – the CORAS approach. Retrieved from: http://www.nik.no/2002/Stolen.pdf 70. Trnik, M. (2007). The role of Investment Promotion Agencies at attracting foreign direct investment and their impact on economic development in Central Europe. Thesis. Central European University, Department of International Relations and European Studies, Budapest, Hungary 71. Valis, D. and Koucky, M. (2009). Selected Overview of risk assessment techniques. Problemy Eksploatacji, 4: 19-32. 72. Vlăduț-Severian, J. (2014). Risk Management and Evaluation and Qualitative Method within the projects. Ecoforum, 3(1/4): 60-67. 73. UN (2008). Evaluating Investment Promotion Agencies. Investment Advisory Series, A(3). United Nations Conference on Trade and Development. 74. UNCTAD (2001). The World of Investment Promotion at a glance. A survey of investment promotion practices. United Nations Conference on Trade and Development. ASIT Advisory Studies No 17. Geneva: UN. 75. UNCTAD (2016). Global Investment Prospects Assessment 2016-2018. Global Investment Trends Monitor. Report No. 24. 76. UNCTAD (2017). World Investment Report 2017: Investment and the Digital Economy. United Nations Conference on Trade and Development. Geneva: United Nations Publications. 58    77. WAIPA (2010). Investment Promotion Agencies and Sustainable FDI: Moving toward the fourth generation of investment promotion. Report of the findings of the VCC – WAIPA Survey on Foreign Direct Investment and Sustainable Development. Columbia: Vale Columbia Center on Sustainable International Investment. 78. World Economic Forum (2013). Foreign Direct Investment as a Key Driver for Trade, Growth and Prosperity: The Case for a Multilateral Agreement on Investment. Geneva: WEF. 79. Zanatta, M., Camillo, E., Consoni, F. and Varrichio, P. (2008). Investment Promotion Agencies and the world competition for foreign direct investment: A survey of institutional frameworks. OECD Global Forum on International Investment. 80. Zanatta, M., Costa, I. and Filippov, S. (2006). Foreign Direct Investment: Key Issues for Promotion Agencies. Policy Brief No 10. Netherlands: United Nations University. 81. Zanatta, M., Costa, I. and Filippov, I. (2006). Foreign Direct Investment: Key Issues for Promotion Agencies. UNU-MERIT Policy Brief, n. 10. 59    Appendix I       60      61    62    63      64    65