Academic study provides insights into effective enterprise risk management

A new survey-based study by researchers from the Copenhagen Business School has examined how organizations carry out enterprise risk management; the findings highlight the importance of broad organizational engagement in ERM and the need for agility.

The full results will be published in Long Range Planning (LRP), an international journal for the field of strategic management, and a pre-press version is available online.

Based on survey data from among the 500 largest companies in Denmark, the research study investigates the effects of adopting ERM frameworks.  And analyses risk management performance in conjunction with internal strategic decision-making processes.

“This is the first study of its kind to provide a more complete organizational picture of the risk management effects.  We find that pursuit of basic strategy-making efforts is fundamental to gain positive effects from adoption of formal enterprise risk management practices,” says Professor Torben Juul Andersen from the Department of International Economics, Government and Business at Copenhagen Business School.

The findings show that it takes more than implementing formal ERM frameworks to deal with uncertain global business conditions – it takes a broader organisational engagement.  The research suggests that corporate leaders, and public policymakers, should engage in deeper thinking about more effective ways to deal with the impending risks of our time.

“When actual developments take us by surprise and organizational decision-makers must deal with influences from unexpected events – like pandemics and climate effects – formal control-based guidelines and practices are insufficient. They are convenient and make us feel safe but provide a false sense of security,” says Professor Andersen.

The study argues that future solutions need a combination of fast responses with ongoing assessments of developments and viable solutions. “Companies that enable local responses and engage in strategic planning to assess sudden events perform significantly better compared to companies that only adopt formal ERM frameworks,” adds Professor Andersen.

The research found that adhering to the principles of ERM is linked to positive performance outcomes, but these effects are substantially enforced by decentralized responses and central strategic considerations.

“It is not sufficient to adopt formal risk management practices to deal with impending risk events. Instead, the ability to deal effectively with uncertain and unknown conditions hinges on local responses and ongoing strategic analyses,” says Professor Andersen.

The study urges policymakers to think actively about how to deal with emergent risk situations, the most significant of which will exceed prior expectations and imagined scenarios. “The only way to find new viable solutions is by experimenting – or acting fast through local responses that may point the way towards an adapted strategic direction,” adds Professor Andersen.

“There is a need for more versatile risk responses to deal with unexpected events and the unknown conditions of the evolving future where formal control-based approaches actually may curtail the ability to create innovative solutions,” Professor Andersen concludes.

Title: Conjoint effects of interacting strategy-making processes and lines of defense practices in strategic Risk Management: An empirical study

Abstract

The ability to contain adverse effects of major risks under turbulent conditions and exploit the opportunities they present are fundamental concerns in strategic management and various institutions promote enterprise risk management (ERM) to deal with these challenges. Yet, our knowledge about how ERM affects performance and interacts with corporate strategy-making processes is limited. The ERM frameworks impose first and second lines of defense practices to integrate business operations and corporate risk oversight. Emergent strategies generate responsive initiatives and strategic planning coordinates updated actions. Hence, this study analyzes the conjoint effects of these ERM practices and strategy-making processes based on a large corporate sample and finds that ERM practices depend on strategy-making to attain effective risk outcomes. The application of ERM frameworks can, therefore, not be assessed in isolation, but must consider corporate strategy-making. This has implications for the way we conduct research on strategic risk management, how executives approach risk oversight and policy-makers impose formal risk governance requirements.

Obtain the paper.