ENTERPRISE RISK MANAGEMENT: REVIEW, CRITIQUE, AND

816 
international standards organizations and consultants have vigorously urged firms to 
adopt ERM. Heeding such calls, leading financial services firms were some of the 
early adopters of ERM. Yet, the difficulties experienced by some of those firms 
during the 2008 financial crisis have cast doubt upon the efficacy of ERM 
Further, regrettably, the evolving discussion about ERM has not been informed 
by relevant work in management on risk, strategy management, organizational 
change and other relevant topics. Practitioners recognize the lack of good information 
on the management of ERM. Fraser et al. survey of risk managers found: “… 
virtually all literature is silent on how to deal with the myriad cultural, logistical, 
historical challenges that exist and are unique to all organizations… Manyof the 
articles describe what the process should look like and how it should function, but 
there are few that provide details of how to get to that step. Many of the articles use 
great overarching statements that seem very much like motherhood statements. There 
was a distinct lack of information on how to bring all the silos together… The impact 
of corporate culture on ERM implementation and practices is not well addressed in 
the literature.” 
These omissions, combined with the fragmentation of ERM research and the 
failures of high profile ERM adopters during the 2008 financial crisis, motivate this 
paper. The paper addresses two questions. To cut through the conflicting discussions 
about ERM, and to clarify the scope and meaning of ERM, we start with a basic 
question: “What is ERM?” To answer this question comprehensively and accurately, 
we review extant ERM research to identify ways researchers and practitioners define 
and operationalize ERM. This review provides the foundation for our second 
question: “How can management research inform ERM theory and practice?” To 
answer this question, we draw from the extensive micro/macro management research 
on risk, agency, strategy, decision making and organizations. The paper identifies 
areas where management research can contribute to the development of ERM 
research and practice. 

817 
Despite the ambiguities and disagreements about what constitute ERM, there 
has begun to emerge a consensus about the core elements of ERM. First, ERM 
assumes that managing the risk of a portfolio (the corporation) is more efficient than 
managing the risks of each of the individual subsidiaries (parts of the corporation or 
activities). In a stock market analogy, trying to mitigate the risk of each stock in a 
portfolio (e.g., by options that limit potential losses) is both costly and unnecessary if 
what we care about is the risk of the portfolio. For example, a corporation could have 
one division that is hurt if the euro rises, and another hurt if the euro declines. At the 
corporate level, these two risks might cancel out, making corporate performance 
insensitive to variation in the value of the euro. 
Secondly, ERM incorporates not only traditional risks like product liability and 
accidents, but also strategic risks such as product obsolescence or competitor actions. 
Thus, every substantive decision within the firm involves risk management concerns. 
Often, the largest risks a corporation faces lie in strategic areas where lack of relevant 
historical data prevents accurate estimation of probabilities. 
Thirdly, ERM assumes firms should not just look at risk as a problem to 
mitigate. Firms with a capability for managing a particular risk should seek 
competitive advantage from it. For example, while energy prices could form a 
substantial risk for many firms, a firm with a particular skill in predicting and 
managing such prices could profit, either by using the skill directly to invest in 
energy or by selling advisory services. The emerging consensus on core elements of 
ERM provides an opportunity for scholars to engage in more critical research on 
ERM adoption and effectiveness. The empirical literature on ERM has also been slow 
to address many of the core practitioner concepts. Regulations and recommended 
procedures use vague terms like “risk culture” and “risk appetite”. For example, 
COSO defines risk appetite as “The broad-based amount and type of risk that an 
entity is willing to accept in pursuit of its mission, vision, strategic objectives, and 
value goals.” Prescriptions on risk management often talk about firms adopting 
appropriate “risk cultures”. S&P evaluates risk cultures using “internal transparency 

818 
of the risk management process” and by evaluating the “staffing and structure of the 
risk management team” and the “influence that risk management team has with the 
top.” However, the questions of exactly what risk appetite means, whether firms even 
have a consistent risk appetite, and whether risk management processes have the 
intended effect on firm risk levels, have been largely ignored. 
This paper reviewed the academic and practitioner literatures on risk and ERM 
to develop suggestions on where and how management scholars can contribute to 
ERM research. Management scholars have particular methodological and theoretical 
bases that can complement ERM research in finance and accounting. The move to 
holistic risk management offers opportunities for a wide variety of management 
scholars to address issues on which they have substantial foundational knowledge and 
relevant techniques. To contribute to the ongoing ERM discussion, management 
scholars need to take a more prescriptive stance and pay more attention to the 
effectiveness of different practices and activities. Such a stance would align both with 
historical studies on planning systems and organizational change management and 
with recent efforts to increase engaged scholarship among management scholars. 
Practitioners need to understand how different individuals and groups within 
organization define risk, potential biases in risk assessment, and challenges in 
implementing risk management initiatives. These challenges offer opportunities for 
firms to look internally at these issues, and collaborate with scholars to produce 
engaged scholarship. Practitioners should note that this paper has taken a somewhat 
cautious view of the benefits of ERM. This reflects a bias toward empirical evidence. 
Until research conclusively demonstrates ERM actually has the outcomes its 
advocates claim, a skeptical view is justified. Studies are yet to demonstrate 
consistent benefits from ERM.

Download 8,84 Mb.