Enhancing public sector enterprise risk management through interactive information processing

PurposeThe purpose of this paper is twofold: first to add to the debate on good governance and ethics of enterprise risk management (ERM) and second to describe an ethical maturity scale based on duty and responsibility for practical implementation to ensure better governance.Design/methodology/approachThe methodology has centred on risk governance as a way for many organisations to improve their risk management (RM) practices from an ethical perspective based on responsibility and on fulfilling one's duty within the organisation.FindingsWhile companies in Australia, for example, are more mature than those in Russia in terms of governance systems life cycle, there are a number of common international challenges in risk governance implementation. These relate to a link between risk framework, enterprise value model and strategic planning; to a definition of risk appetite, the embodiment of RM in organisational culture, internal audit and ERM function, the evolving role of a chief risk officer (CRO) and senior management buy‐in and sponsorship of the integrated ethical RM from a chief executive officer.Practical implicationsERM – a way for many organisations to improve their RM practices – is a key component of the applied ethics of corporate governance. It has developed into a philosophy to assist organisations with the process of protecting shareholders' value while also increasing the bottom‐line profitability. Effective ERM is based on ethical risk governance. Internal audit needs to be involved in the process of integrating RM and compliance. It should maintain a degree of independence when assisting with ERM establishment. CRO is most effective when reporting to the board.Originality/valueGlobal companies are becoming more accountable to multiple stakeholders. It is the adoption of an ethical code to arrest the lack of clarity of roles ascribed to the audit committee and risk committee and management's accountability or lack thereof that remains the challenge across different jurisdictions. In attempting to implement good governance and meet the challenges, the paper introduces an ethical maturity scale as an internal measure that could be embedded in an organisation's strategy.

Over the past two decades, business practitioners have been shifting from a silo perspective to a comprehensive perspective of managing risk, which is referred to as enterprise risk management (ERM). Enterprise risk management provides resilience by holistically managing the risks within an organisation. Despite its importance, empirical evidence highlighting the factors influencing ERM adoption remains underexplored, particularly in developing countries like South Africa and Ghana, a gap addressed by this study. Accordingly, this study recruits panel logistic regression to examine the factors influencing the adoption of ERM. Another novel aspect of the study is the inclusion of the quantile regression analysis applied to panel data between 2015 and 2018. This technique accounts for the heterogeneity of the relationships at different levels of ERM adoption. Drawing from the contingency theory, this paper presents that a variety of factors stimulate the adoption of ERM. Thus, the implementation of ERM in both countries is positively influenced by the Big4 audit firms, ownership structure, leverage, firm size, and industrial diversification. Further insights from the quantile regression show that lower levels of firm size and profitability encourage the adoption of ERM in the South African sample, whereas significant increases in these factors weaken it, suggesting an inverted U-shaped relationship. In contrast, leverage exhibits a U-shaped relationship. More so, the study identifies an inverted U-shaped relationship between leverage, profitability, and ERM adoption for Ghana. Additionally, industrial diversification, engagement with the Big4 audit firms, and ownership consistently exhibit significant positive effects on ERM adoption across various quantiles in both samples. The results underscore the importance of these factors to ERM. Given this, insurers should consciously capitalise on their organisational strengths, such as diversification and partnerships with reputable audit firms, to enhance ERM adoption. Also, insurers that are highly diversified and rely on leverage to fund their operations should employ ERM to manage the associated complexities.

The Securities and Exchange Commission's enhanced disclosure rule on risk oversight, state laws requiring public disclosure of compromised customer information, and high-profile customer information breaches have caused Information Technology (IT) risk management practices to be a major concern for boards of directors and management. The Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Enterprise Risk Management (ERM) framework emphasizes the importance of the board's oversight role while also bringing attention to the firm's reporting structure. Consequently, our study examines whether the maturity of IT risk management practices depends on Chief Information Officer (CIO) reporting structure and Chief Executive Officer (CEO)/Chairman duality. We develop a scale to measure strategic and operational maturity under the larger auspice of IT risk management and distribute a survey to high-level IT professionals. Our survey also captures the reporting structure of their firms. Consistent with our hypothesis, we find that the maturity of strategic IT risk management practices are higher when the CIO reports directly to the CEO. However, contrary to expectations, we do not find that operational risk management is more mature when the CIO reports to the Chief Financial Officer (CFO). Instead, operational risk management is higher when the CIO reports to the CEO. For public firms, the maturity of IT risk management practices are higher when the CEO is also the chairman of the board of directors. As C-level officers may have asymmetric access to the board, understanding reporting structures may inform firms, regulators, and interested stakeholders on how well IT risk is managed and factors that affect IT governance.

Enterprise risk management and solvency: The case of the listed EU insurers

Contemporary risk management methodologies are typically used for identification and prioritisation of strategic risks. The International Risk Management standard, ISO 31000:2009, is the world-wide basis for best practice in strategic level risk processes. However, due to the qualitative and subjective nature of strategic risk, its analysis requires a more nuanced approach than that used in more tactical or operational settings and this paper discusses the need to understand the range and nature of strategic threats, and how to represent risk assessments. As such, a particular focus of this work is on how to incorporate best practices in strategic risk analysis, and operations research into the design and application of strategic risk management in the Defence context. A number of steps are recommended incorporating international risk management best practices within the context and uncertainties unique to strategic risk management for Defence (as opposed to tactical or engineering risk management).

This study investigates the level of Enterprise Risk Management (ERM) adoption within the Public Listed Companies (PLCs) in Malaysia and the influence of Chief Risk Officers (CROs) on ERM practices. Included in this particular study is a comprehensive survey on 500 companies from the main board of public listed companies in the Malaysian Bourse. Key findings of this research work reveal that only 42% of the companies surveyed have completely adopted ERM and based on regression analyses, the ‘quality’ of CROs has a strong influence on the level of ERM adoption within the PLCs involved in the survey.

This article examines the use of enterprise risk management (ERM) by companies in Canada, the characteristics that are associated with the use of ERM, what obstacles companies face in implementing ERM, and what role, if any, corporate governance guidelines have played in the decision to adopt ERM. We obtained our data from the responses to a mail survey sent to Canadian Risk and Insurance Management Society members as well as telephone interviews with 19 of the respondents. The results indicate that 31 percent of the sample had adopted ERM and that reasons for adopting ERM include the influence of the risk manager (61 percent), encouragement from the board of directors (51 percent), and compliance with Toronto Stock Exchange (TSE) guidelines (37 percent). The major deterrents to ERM were an organizational structure that discourages ERM and an overall resistance to change. Although only about one‐third of companies indicated that they had adopted an ERM approach, evidence was clear that a larger portion of the sample was moving in that direction, as indicated by what changes they had observed in their companies in the past three years. These include the development of company‐wide guidelines for risk management (45 percent), an increased awareness of nonoperational risks by operational risk management personnel and an increased awareness of operational risks by nonoperational risk management personnel (49 percent), more coordination with different areas responsible for risk management (64 percent), and more involvement and interaction in the decision making of other departments. Contrary to what we expected, there was not a significant difference between firms that are listed on the TSE versus those that are not in terms of the propensity to use ERM. However, the fact that 37 percent of firms indicated that the TSE guidelines were influential in their decision to adopt ERM provides some evidence that the guidelines are influencing companies’ risk management strategies.

Companies in the 21st century face a complex business environment, full of opportunities, but pitted with the risks, in which they should make effective business decisions, improve interpersonal relations, meet societal obligations with the right strategy and manage risks. To overcome those challanges, the company needs management tools that can help the company to achieve its objective. Balanced Scorecard (BSC) dan COSO Enterprise Risk Management (ERM) Framework are management tools that are well -recognized and accepted among academicians and more importantly business leaders. They link the high level corporate strategies as determined by top level management with the day-to-day activities of the employees within the organization. Surprisingly, most of companies view BSC and COSO ERM as separate, unrelated management initiatives. In this article, we studies the feasibility of integrating BSC with the COSO ERM Framework, the framework for state-of-the art risk management, similiar to the way the BSC can be integrated with a variety of business management frameworks and methods. The integration of these two management tools (BSC and COSO ERM Framework) is a natural step in the evolution of corporate management . Keywords : Balanced Scorecard, COSO Enterprise Risk Management Framework, Strategic Management System, Risk Management, Key Performance Indicators, Key Risk Indicators.

This research work was tries to study the risk management practice on public building construction projects and aims to identify the level that use of risk management practice especially in the public building. The data collection method was a combination of interview and questionnaire. Samples were purposively selected from clients, consultants, and contractors representatives who are now actively participating in public building construction projects. For this study, the data was collected using both primary and secondary sources. Depending on the data that was gathered from the respondent to test the level of awareness, identifying the Risk that affect the performance of public building construction project and major risk management practice on public building construction project are considered and the RII was used to rank the factors. This data was analyzed using SPSS of version 22 to perform descriptive statistics. A total of 75 questionnaires were targeted to be distributed and out of those 50 which is 66.67% are successfully responded. The finding from this study revealed that, about (52%) of the project progress is lagging from the schedule. Regarding the awareness of the risk management, (94%) of the respondents where confirmed that they have awareness of risk management ideologies and they are confident enough to implement their knowledge while, (6%) of them have no concept about the risk management. The top five risks that affect the performance of construction project have been identified and ranked. Accordingly; market condition, unexpected inflation, local taxes, inadequate production of raw materials, and the economic condition of country are the top five identified associated project risks.

The study aims to examine the enterprise risk management (ERM) practices of Ethiopian commercial banks. This approach is undertaken to examine the current approach to enterprise risk management within the Ethiopian banking context. A mixed-methods research design is employed which comprises content analysis and a survey study. The study found that the prevailing emphasis of risk management functions in Ethiopian commercial banks revolves on ensuring compliance with regulatory reporting standards. A significant number of the banks have implemented ERM programs primarily to meet regulatory obligations, rather than leveraging ERM to generate firm value. The study identified several gaps in the risk management function of Ethiopian commercial banks, including lack of integration of risk management with the banks’ mission and core values, failure to assess the resources required for effective risk management and to prioritise resource allocation accordingly, inadequate coverage of relevant activities and functional areas by both risk management and internal audit activities, and limitations on the assignment of chief risk officers (CROs) to oversee the risk management function within the banks. Overall, the maturity level of ERM implementation among Ethiopian commercial banks is moderate and requires further enhancement.

The adoption of Enterprise Risk Management (ERM) by State Corporations in Kenya is a mandatory requirement and yet, the information on levels of adoption amongst Commercial State Corporations, most of which continue to experience poor performance due to weak governance is scanty. The objective of the study was to establish the relationship between transformational leadership and enterprise risk management adoption. This study adopted a positivist research philosophy and cross-sectional survey design approach. The target population comprised all the Commercial State Corporations in Kenya listed in the register of State Corporations Advisory Committee (SCAC) as at January 2021. The unit of analysis was the 52 Commercial State Corporations and unit of observation was top management of each entity. The researcher applied purposive sampling to select top management and surveyed the total population of top management that derived a sample size of 364 participants. The study used primary data which was collected through structured questionnaires. The descriptive and inferential statistics was employed in the analysis. The Statistical Package for Social Sciences (SPSS version 22) was used in regression modeling for prediction and causal inferences between study variables. The study findings indicated that Transformational Leadership has a significant relationship with ERM adoption. The study recommends that commercial state corporations embrace transformational leadership in order to enhance ERM adoption. Keywords: Transformational Leadership, Enterprise Risk Management & Commercial State Corporations

This study examines the impact of enterprise risk management (ERM) programs on corporate tax planning. ERM is a holistic approach to managing an enterprise's entire portfolio of risks. We hand‐collect data on ERM adoption for a sample of Standard & Poor's 500 firms from 1993 to 2016. We empirically document that firms with ERM programs have lower cash effective tax rates than firms without ERM. Additionally, we find that the relation between ERM and tax avoidance is stronger among firms with more business segments. Finally, our results suggest ERM adoption offsets an increase in opacity and tax uncertainty typically associated with tax avoidance strategies. Overall, we provide evidence that ERM allows firms to exploit tax avoidance opportunities through enhanced coordination and communication.

Anticipation in risk management - a stich in time...? Anticipation versus reliance, Christopher Hood, David Jones Anticipating the risk posed by natural perils, David Jones Hazard engineering, David Blockley Resilience, flexibility and diversity in managing the risks of technologies, David Collingridge. Absolution, liability and blame - pointing the finger: Absolutism versus blame, Christopher Hood, david Jones Criminal law, blame and risk: the case of corporate manslaughter, Celia Wells The problem of blame, Tom Horlick-Jones Blame, punishment and risk management, A. Neil Johnston. Quantitative risk assessment and risk management - faith in figures: The extent to which statistics are signs from God, Christopher Hood, David Jones Quantitative risk assessment and decisions about risk: an essential input into the decision process, A.V. Cohen Limits to the mathematical modelling of disasters, B. Toft. Designing institutions - a house of cards? The feasibility of institutional design in risk management, Christopher Hood, David Jones Risk and disaster: the role of communications breakdown in plane crashes and business failure, David Weir Criteria for the design of hazard mitigation instructions, Edmund Penning-Rowsell. Counting the cost: Risk reduction, but at what price? Christopher Hood, David Jones Is safety a by-product of quality management, Tom Horlick-Jones Risk management: an economist's approach, Sir Christopher Foster. Participation in risk management decisions: To what extent is risk management best left to experts, Christopher Hood, David Jones technocracy, democracy, secrecy and error, Nick Pidgeon Risk management, post-normal science and extended peer communities, Silvio O. Funtowicz, Jerome R. Ravetz Exploring the role of civic science in risk management, Timothy O'Riordan. The regulatory target - crying over spilt milk: Should regulation be targeted on physical products or institutional processes, Christopher Hood, David Jones Risk and emerging technology: the case of process-based regulation of biotechnology in Europe, Simon Shohet. Conclusion - learning from your desk lamp: Homeostatic versus collaborationist approaches to risk management, Christopher Hood, David Jones When extremes meet: sprat versus shark in public risk management, Christopher Hood.

Enterprise risk management (ERM) and knowledge management (KM) both encompass top-down and bottom-up approaches developing and embedding risk knowledge concepts and processes in strategy, policies, risk appetite definition, the decision-making process and business processes. The capacity to transfer risk knowledge affects all stakeholders and understanding of the risk knowledge about the enterprise's value is a key requirement in order to identify protection strategies for business sustainability. There are various factors that affect this capacity for transferring and understanding. Previous work has established that there is a difference between the influence of KM variables on risk control and on the perceived value of ERM. Communication among groups appears as a significant variable in improving risk control but only as a weak factor in improving the perceived value of ERM. The ERM mandate, however, requires for its implementation a clear understanding of risk management (RM) policies, actions and results, and the use of the integral view of RM as a governance and compliance programme to support the value-driven management of the organisation. Furthermore, ERM implementation demands better capabilities for unification of the criteria of risk analysis, alignment of policies and protection guidelines across the organisation. These capabilities can be affected by risk knowledge sharing between the RM group and the board of directors and other executives in the organisation. This research presents an exploratory analysis of risk knowledge transfer variables used in risk management practice. A survey to risk management executives from 65 firms in various industries was undertaken and 108 answers were analysed. Potential relationships among the variables are investigated using descriptive statistics and multivariate statistical models. The level of understanding of risk management policies and reports by the board is related to the quality of the flow of communication in the firm and perceived level of integration of the risk policy in the business processes.

The article investigates the ways and means of improving and perfecting the state of labor protection at transport enterprises of Ukraine through the implementation of international standards for risk management and occupational safety. A detailed analysis of international standards for occupational safety, and their main benefits that improve the health and safety of enterprises. The object of research is international standards on occupational safety and risk management. The purpose of the work is to analyze the implementation and use of international standards on occupational safety and risk management at Ukrainian transport enterprises. Research methods - analytical. Quality management of labor protection at enterprises is one of the priority areas of transport enterprises in order to reduce occupational injuries and improve working conditions. In order to effectively manage labor protection in transport enterprises, the authors of the article propose the introduction of international standards in the field of occupational safety and risk management in Ukraine. Examining the chosen topic, it was found that in many works that devoted to the application of international standards on occupational safety was not a generalization of all regulations and standards on labor protection and risk management in the enterprise. The main directions for the implementation of international standards for occupational safety and risk management in transport enterprises of Ukraine are proposed. The results of research can be recommended for implementation in the management system of labor protection at transport enterprises of Ukraine. KEY WORDS: INTERNATIONAL STANDARDS, OCCUPATIONAL HEALTH AND SAFETY, SAFE WORKING CONDITIONS, RISK ASSESSMENT, IMPROVING OCCUPATIONAL HEALTH AND SAFETY CONDITIONS, MANAGEMENT SYSTEM.