Research Insights About Risk Governance

Organizational Characteristics of ERM Adopters

In light of limitations associated with traditional risk management, a number of organizations have begun to adopt ERM. The goal of ERM is to manage risks at an enterprise level to ensure that entity-wide risks to the organization have been assessed, rather than just one aspect of risk to the organization. As boards of directors respond to the increasing expectations for more effective board risk governance, many are placing pressure on senior executives to implement ERM. However, in making that decision, boards may question whether the implementation of ERM in their organization makes sense.

Colquitt, Hoyt, and Lee (1999) conducted one of the first studies on risk management as it applied to risk financing strategies, describing it as Integrated Risk Management. The authors surveyed 379 firms and found that the role of risk manager was growing in scope to integrate across the organization, beyond traditional financial risk management. Industry and firm size also were associated with a more integrated approach to risk management and affected the financial tools used to oversee risk.

Subsequent studies examine organizational factors and financial characteristics of entities that adopt ERM to understand factors that affect the embrace of ERM as a risk management paradigm. However, as firms do not usually announce when they are embarking on an ERM implementation, it can be difficult for researchers to determine who has implemented ERM. Some researchers have used announcements of appointments of individuals to serve as chief risk officer (CRO) or disclosures of ERM activities as proxies for ERM adoption, while others have surveyed companies to understand their stage of ERM adoption.

Using the announcement of a CRO as a signal of ERM implementation, Liebenberg and Hoyt (2003) found that firms announcing a CRO were among the largest in their industry and were primarily in the financial and energy industries. While they did not find significant differences in firms’ ownership (institutional vs. individual shareholders), the study did show a relationship between higher leverage and a greater likelihood to announce a CRO appointment.

Pagach and Warr (2011) also used the announcement of a CRO as a signal of ERM adoption to provide additional analysis of firmwide factors that might explain an entity’s ERM implementation. The study found that firms with higher levels of leverage and larger size (assets) were more likely to announce the appointment of a CRO, consistent with Liebenberg and Hoyt (2003). In addition, they found that more volatile operating cash flows and greater stock volatility were positively associated with the announcement of a CRO. Contrary to findings of Liebenberg and Hoyt, who did not find a difference in ownership structure between ERM adopters and the control group, Pagach and Warr found that firms with a high percentage of shares owned by institutional investors were more likely to have announced a CRO appointment, consistent with institutions’ desire for greater risk control. In a subsample of firms where CEO compensation could be determined, Pagach and Warr found that firms where CEO compensation was sensitive to stock volatility were more likely to have a CRO.

In a study of U.S. insurers with ERM initiatives found using a word search, Hoyt and Liebenberg (2011) found that firms that have ERM initiatives were larger in size (assets) and had more institutional ownership, consistent with Pagach and Warr (2011). They did not find any significant association between the extent of leverage, stock return volatility, or opaqueness and the presence of ERM, as had been found in some previous studies. In another study of U.S. insurers, Lin, Wen, and Yu (2012) performed a similar word search and found that firms that had implemented ERM had more reinsurance and had greater geographic diversification compared with firms that had not implemented ERM.

Lundqvist (2014a) examined the relationship between ERM and credit risk management for a sample of banking institutions. The author found that credit risk was reduced as the level of ERM quality increased. No significant relationship was found between ERM quality and credit rating when controlling for governance characteristics such as board independence, large ownership by a group, and corporate governance measured by Thompson Reuters ASSET4 environmental, social, and governance (ESG) content. The author explains this last finding by suggesting that the market perhaps values the risk management function itself, while the credit rating agencies focus on risk governance aspects.

Other studies have used different proxies for ERM implementation. Beasley, Clune, and Hermanson (2005) explored organizational factors and their relationship to the stage of ERM implementation, based on surveys completed by internal auditors. Like other studies that focus on the association of firm characteristics and ERM implementation, they found firm size (revenues) was positively related to the stage of ERM. In addition, the study found firms that had a CRO, more independent directors, or explicit ERM calls from the CEO and CFO were more likely to be at a more advanced stage of ERM, suggesting that top management support for ERM is critical for ERM implementation. Firms that engaged a Big Four auditor were also found to be further along in ERM implementation than were firms using smaller auditing firms. Firms in the banking, education, and financial industries were at a more advanced stage of ERM implementation than other industries. Finally, the study found that U.S. firms were less advanced in ERM implementation stage than international firms.

Using a sample of 825 firms located in the Netherlands, Paape and Spekle (2012) used the stage of ERM implementation (based on an ordinal scale of 1 to 5 with 4 to 5 being adopters of ERM and 1 to 3 having traditional, silo approaches to risk) to examine firm characteristics of those with more advanced ERM. They found larger firms and firms in financial industries were further along in ERM stage, and stock ownership was not found to be significant, which is consistent with findings in Liebenberg and Hoyt (2003). Unlike some of the other studies focused on ERM implementation, they did not find a relationship between having a Big Four auditor and ERM development. The authors also found that publicly traded firms, firms with a CRO, and those with an audit committee were further along in ERM implementation.

Baxter, Bedard, Hoitash, and Yezegel (2013) used S&P ERM quality ratings for banking and insurance industry firms to investigate variations in firm characteristics in relation to ERM ratings. Their results showed that companies with higher ERM ratings were more complex, had greater financial resources, and had better corporate governance. They also found that higher risk firms had lower quality ratings, which they attributed to resource constraints limiting the investment in ERM.

Lundqvist (2015) surveyed 145 firms on two major Nordic stock exchanges across multiple industries and found that firms implementing ERM are larger, in line with Beasley et al. (2005), Liebenberg and Hoyt (2003), and Pagach and Warr (2011). As with Paape and Spekle (2012), having a Big Four auditor did not affect risk governance, and firms in the financial industry were marginally more advanced in ERM, consistent with previous studies (Beasley et al., 2005; Liebenberg & Hoyt, 2003). In addition, the quality of the ERM governance and the following year’s extent of leverage were positively related, consistent with limiting the use of free cash available to well-monitored managers. Finally, unlike prior research, organizations with higher leverage were less likely to have embraced ERM.

With the passage of Sarbanes–Oxley Act of 2002 (SOX), external auditors and corporate boards were assigned specific responsibilities for risk assessments related to financial statements. Farrell (2003) and Roth (2006) argued that firms can leverage SOX Section 404’s requirement that management and auditors attest to the state of internal control over financial reporting effectiveness to promote the evaluation of risk at an enterprise level. Arnold, Benford, Canada, Kuhn, and Sutton (2007) found in a study of four firms that all of the firms believed their ERM was made more effective by the effort to become SOX compliant, but it was an “unintended” consequence of the 404 compliance effort.

Many companies have either board-level or management-level committees that have responsibility for ERM implementation. Previous studies identified as a limitation the ability to identify these firms. Subramaniam, McManus, and Zhang (2009) used the presence of a Risk Management Committee (RMC), as disclosed in a firm’s annual report, to signal ERM implementation in 200 of the top 300 Australian Stock Exchange listed companies. Unlike some previous studies, they did not find a significant relation between ERM adoption and financial industry, board independence, or leverage. The authors did find that an independent board chair and larger boards were positively related to the presence of an RMC, as was organizational complexity as measured by the number of firm segments. Like Paape and Spekle (2012), having a Big Four auditor was not related to having an RMC.

Hines and Peters (2015) found that firms within the financial industry that formed an RMC had higher leverage (unlike Subramaniam et al., 2009); had a larger, more independent board; and were more likely to have a Big Four auditor. The authors also found that lower financial quality, international banking activity, and merger and acquisition activity where related to having an RMC.

ERM Implementation Process

While boards of directors and senior executives may conceptually embrace ERM, they often face a number of questions related to how organizations are implementing ERM to ensure its effectiveness in risk oversight. Because ERM is a relatively recent business paradigm, organizational leaders, including the board, have been calling for insights to help them understand specific processes that are needed when implementing ERM. A number of practitioner articles have been published with insights and suggestions related to processes important when implementing ERM. Some articles provide detailed steps, activities, and tools that should be used, while others describe individual firms that have implemented ERM, but not necessarily how they did it.

A number of ERM frameworks have been developed over the last decade to assist organizations in their design and implementation of ERM (COSO, 2004; International Organization for Standardization [ISO], 2009). When a board and its senior management team decide to implement ERM, they may seek conceptual frameworks related to ERM to guide the design of their ERM processes. In doing so, they may question what frameworks exist and which framework(s) are embraced by other organizations. Although only a few studies specifically address the use of ERM frameworks, we examine that research to summarize insights related to ERM conceptual frameworks.

In light of the prominence of COSO as a thought leader in ERM, Hayne and Free (2014) sought to understand the rise of the COSO framework to its point of prominence in risk management. The authors describe the processes and mechanisms used by COSO to create the COSO ERM framework and enable it to become so dominant. Through a series of interviews with key stakeholders in risk management and analysis of secondary documentation, the authors describe the creation of “hybrid” professional groups and the impact of these groups on the eventual adoption of the framework.

Tekathen and Dechow (2013) studied a German organization while it implemented ERM by using semi-structured interviews to understand how the organization implemented ERM. Because the organization professed to having used the COSO ERM framework, the authors compared the insights from the interviews with the COSO ERM framework to determine a fit to the framework. The authors stated that the COSO framework was based on “radical assumptions,” and they asserted that the COSO framework implies that experts, expertise, and eventualities are aligned within an organization. The authors did not find this alignment in practice and concluded that ERM is not effective in reducing uncertainty, but instead increases the organization’s interaction with uncertainty, unless processes are designed to support the alignment.

Paape and Spekle (2012) addressed the actual use of an ERM framework, in particular the COSO ERM framework, by 825 firms based in the Netherlands. The authors reported that 43% of the firms indicated they used the COSO framework, but the study only dichotomously captured the use of the framework (i.e., framework used or not used) and did not provide any detail as to how much or how the framework was used.

Beyond studying the use of ERM frameworks, the ability to conduct rigorous academic research about ERM implementation processes has been significantly limited by the lack of publicly available data about specific internal tools and techniques used as part of the risk oversight process. To address this limitation, studies that have focused on specific techniques used by firms when implementing ERM typically have used a case study approach or surveys to examine internal activities that are associated with ERM implementations.

Articles that present specific case studies of firms adopting ERM show that ERM implementation varies widely across firms, even in the same industry. ¹ Arena, Arnaboldi, and Azzone (2010) studied three non-financial Italian firms over a 7-year period. All three firms professed to have an enterprise-wide risk management process, but each firm’s approach and resulting ERM process was influenced by the firm’s risk rationale. One firm’s rationale for ERM was for compliance, the second firm’s rationale was for stronger corporate governance to provide external assurance, and the third firm’s rationale was to improve performance that would lead to enhanced company value. In another study, Arena, Arnaboldi, and Azzone (2011), again studied non-financial firms to understand the extent of ERM use and the relationship of ERM use to the characteristics of the ERM tools implemented. The authors found that firms that used ERM for proactive actions, such as planning at the strategic level, had ERM tools that were highly integrated through the organization at all levels and risk was centrally managed. The study also found that the role played by the ERM coordinator must include interaction with managers at all levels to help those managers understand the value of ERM and to encourage open discussions across functional areas of the risks.

A working paper by Mikes and Kaplan (2014) used contingency theory to identify design parameters that can explain variation in how three different case study organizations implemented ERM. Using interviews over the period of 2008-2012, they studied the implementation of ERM in detail at the three organizations. They classify the implementation into three fundamental risk management components and then classify the types of risks each firm encountered into three categories. ² The authors found that organizations approached risk management in different ways, and the authors ultimately proposed that risk management is contingent on the organization’s nature and ability to control different types of risks, which supports the view that risk management is different for each firm.

In a single-organization study, Aabo, Fraser, and Simkins (2005) studied ERM implementation at a Canadian electric company. They chronicle the process beginning with the creation of a CRO position. The authors describe the actual process including the techniques and tools that were used by the firm. The successful implementation of ERM integrated risk into the workplace to the extent that the CRO position evolved into a low-maintenance position within the company.

Two articles examine the use of risk maps in the implementation of ERM. Woods (2009) performed a case study focused on a public sector entity’s risk management control system to examine whether risk management systems are similar across large organizations by comparing the risk process with the Institute of Risk Management (IRM; 2002) model. Because the organization’s process was easily mapped to the IRM model, the author argued that large organizations’ overall risk processes are similar, as many organizations are following the IRM model. Woods also described the use of heat maps (risk maps) to rank the organization’s risks on a scale from tolerable to material to severe (traffic light), which determines the level of control and monitoring (the resulting level of control and monitoring is the risk control system for the organization). The author concluded that the control system was affected by government policy, technology, and organization size.

Jordan, Jørgensen, and Mitterhofer (2013) examined the use of risk maps in the Norwegian petroleum industry as a way to represent risks within project management. They found that risk maps are being used to negotiate the boundaries of different project areas. The appearance of a risk object on a risk map resulted in it being more likely to be discussed. The risk maps were used to mediate concerns between groups and resulted in topics not shown being avoided, thus setting boundaries on the meeting discussions. Overall, the risk maps were used to create project identity, increase commitment to the project, and mediate between different groups in the company.

Studies that used surveys have each developed their own set of questions and surveyed a variety of groups, such as the American Institute of Certified Public Accountants (AICPA), The Conference Board, companies listed on the two Nordic stock exchanges, and firms based in the Netherlands. Paape and Spekle (2012) examined design choices of ERM by firms and the effects of the choices on risk management effectiveness. The authors found that the frequency of risk assessments and risk reporting and the use of quantitative approaches are associated with higher stages of ERM implementation. They also found that use of the COSO framework did not contribute to higher risk management effectiveness.

Another article based on the COSO ERM framework, Gates, Nicolas, and Walker (2012), surveyed Conference Board member firms to study the practical side of ERM. ³ Based on 150 completed responses, the authors modeled the direct impact that each of the components has on the subsequent component beginning with objective setting through performance. The study found that a structured approach to risk management can result in enhanced management and improved performance.

Beasley, Branson, and Pagach (2015) examined specific risk management processes associated with greater ERM maturity using a sample of 645 organizations across a number of industries. They found ERM maturity to be positively associated with boards of directors that are more actively engaged in risk oversight. ERM maturity also was positively related to organizations with risk management responsibilities assigned to a board committee, formal risk management reports to the board, and a formally articulated risk appetite.

Lundqvist (2014b) used survey results from 153 firms on two Nordic stock exchanges to understand ERM implementation and found four ERM implementation factors: (1) general internal environment and objective setting, (2) specific risk identification and risk assessment activities, (3) holistic organization of risk management, and (4) general control activities and information and communication. Lundqvist explained that Factors 1 and 4 could be viewed as “prerequisites” of an ERM implementation because they are necessary to support ERM but can exist without any effort toward risk management. Factor 2 represents efforts by the organization to manage certain types of risks, such as financial and compliance. Lundqvist identified Factor 3 as the true ERM identifier. Factor 3 represents organizational activities such as a formal, written risk appetite definition, senior management responsible for overseeing risk and risk management, and formal risk management reports provided to the board on a regular schedule. These activities are typical of firms approaching risk holistically the definition of ERM.

Ittner and Oyon’s (2014) data consisted of responses from the corporate-level finance and risk executives of 1,051 international firms in multiple industries. The authors found that the breath of functional and hierarchical ownership of risk is positively associated with the sophistication of a firm’s ERM implementation and that management practices are more closely associated with the levels and functions of the risk owners, not the number of owners. When the CFO of a firm has risk ownership, significantly larger contributions are made to a wider range of strategic and operational risks.

Finally, Viscelli, Hermanson, and Beasley (2016) conducted a series of semi-structured interviews with 15 ERM champions representing 14 organizations headquartered in the United States to gain insight into how firms actually implement ERM. They found that most firms began their process by developing a list of risks. Very few of the firms provided formal education on ERM to the employees involved in the ERM implementation. Most of the organizations did not define risk appetite. The most positive ERM impact on the firm was greater risk awareness, risk management, and risk mitigation, and more timely dissemination of risk information was identified as the Number 1 change to the firm.

Internal Auditing and ERM

In response to growing expectations for more effective board risk governance, a number of boards have called upon IA to assist them with their ERM efforts. In many organizations, the audit committee of the board is responsible for oversight of the IA function, and there are direct lines of communication between IA and the board via the audit committee. Because IA has an enterprise-wide focus and because IA procedures are often risk-based, a number of boards of directors have initially assigned responsibility for ERM leadership to IA. However, in doing so, some boards may question what IA’s role in ERM should be, and they may have concerns about how ERM leadership affects IA’s objectivity.

The IA function, especially the chief audit executive, is frequently tasked with the leadership of ERM implementation (Viscelli et al., 2016). While there is disagreement in the IA community about how closely the Institute of Internal Auditors (IIA; 2004) guidelines about IA involvement in ERM should be followed, there is agreement that IA should never “own” risk, because owning the risk would jeopardize IA’s independence and objectivity in evaluating risk (Jackson, 2005). Several articles discuss the appropriate role of the IA function in ERM.

The IIA released a position paper, The Role of Internal Auditing in Enterprise-Wide Risk Management (IIA, 2004), shortly after COSO (2004) released its ERM framework. The IIA provided guidance on the roles internal auditors should or should not perform in risk management, and it stated that IA’s core role is to “provide objective assurance to the board on the effectiveness of risk management” (p. 3). Some practice-based polls of IA practitioners provide some insights about consistency with the IIA guidelines. For example, Gramling and Myers (2006) found in a survey that the responsibilities held by internal auditors differed somewhat from The IIA’s guidelines, but that internal auditors understood the guidance. Also, Sobel (2011) surveyed IIA members through the IIA’s Global Audit Information (GAIN) Flash system and found that IA was not participating in core ERM roles, consistent with IIA guidelines on ERM implementation. In addition, Thompson (2013) provided a framework that can be used to evaluate the potential conflicts that an internal auditor might face while implementing ERM.

Fraser and Henry (2007) found in a study of U.K. companies that internal auditors were playing a bigger role in ERM than recommended by the IIA, and there was concern that they were doing so at the risk of losing independence. Interviews revealed that internal auditors were in the role of risk management facilitators and consultants, rather than evaluators of risk management processes. This raised the question of whether the internal auditors were maintaining their independence.

Beasley, Clune, and Hermanson (2008) focused on the macro-level impact of ERM on IA. They surveyed 122 firms and found that, overall, ERM implementation positively affects IA by expanding IA’s work as the organization progressed through its implementation. This is not surprising, as ERM implementation requires significant resources, and, as outlined by The IIA’s guidelines, there are many roles for IA in the process. The authors also found a greater impact on IA by ERM when the CFO and audit committee have called for IA to have greater involvement in the ERM process and when IA has a greater role in leadership of the ERM implementation. This suggests that CFOs and audit committees may recommend that IA take a leadership role, thus leading to an impact on IA resources, which could lead to a loss of independence. The authors did not conclude whether greater IA involvement in ERM was helpful or harmful to IA’s independence and objectivity.

Research Insights Related to Board’s Evaluation of Risk Information Generated by ERM Processes

In addition to responsibilities related to understanding and approving management’s approach to risk oversight, boards also are responsible for understanding risk information output from the ERM process as part of the board’s oversight of management. Conceptually, ERM is a process designed to increase the likelihood that entity objectives are achieved (COSO, 2004). Thus, ultimately, ERM is designed to provide strategic value. But, as boards evaluate information generated by ERM processes in organizations they serve, they may have questions about how organizations integrate ERM with the strategy of the organization, and they may ask whether ERM processes actually enhance stakeholder value. We examine ERM-related research to summarize insights to these governance questions:

We use these questions as a framework for organizing our understanding of insights from ERM-related research performed to date and we build upon that to generate a number of future research topics that governance scholars may consider for future examination.

ERM and Strategy

The COSO (2004) framework emphasizes that ERM is a process “applied in strategy setting” designed “to provide reasonable assurance regarding the achievement of entity objectives” (p. 2). That definition indicates that ERM is intended to focus on the management of risks affecting the strategy a firm uses to achieve its objectives. Similarly, Frigo and Anderson (2011) stated that ERM must take place within a strategic setting to actually create value. ⁴ Despite these assertions, the academic literature indicates that firms typically are struggling to effectively link ERM to strategy. ⁵

Beasley, Branson, and Pagach (2015) examined firm-specific factors associated with the perceived strategic value of ERM, using a sample of 645 organizations across a number of industries. They found that ERM is more likely to be viewed as a strategic tool when the organization has stated its risk appetite in the strategic planning process and when the board of directors receives, at least annually, a management report describing top risks. As for management-level processes, they found greater linkage of ERM and strategy when the organization has a management-level risk committee, provides ERM training to executives, and regularly updates the key risk inventories. Interestingly, they also found that the presence of an explicit relationship between executive compensation and risk management increases the perceived strategic value of ERM. In addition, larger firms were more likely to view ERM as a strategic tool, while private firms were more likely than public firms to view ERM as value adding.

Cohen, Krishnamoorthy, and Wright (2014) interviewed CFOs, audit committee members, and audit partners within the same firms (which they referred to as the governance triad) for 11 organizations. They found that CFOs and audit committee members more often included strategic elements in their definition of ERM than did audit partners. In only two of the organizations did all three members of the governance triad mention strategy. Of the remaining organizations, half had triads where the majority of the triad members noted strategy in their responses, and in most of those triads, the audit committee member and the CFO were the ones noting the strategy connection most often. When asked about their individual role in addressing risks related to the four objectives (strategic, operational, reporting, and compliance) outlined in the COSO (2004) ERM framework, the CFOs and the audit committee members were more likely to respond that they played a significant role in assessing risks related to the strategic objective. The external auditors saw their role as weak in the assessment of risks related to the strategic objective. The authors also reviewed the responses through the lens of agency theory and resource dependence theory. While they found that ERM was mostly playing a monitoring role (agency theory), they did see it being used to balance corporate strategy and business risks (resource dependence) in some cases.

Viscelli et al. (2016) interviewed ERM champions in 14 organizations and found that most of the organizations adopted ERM due to a “strategic need to understand risk.” However, the most common area cited by interviewees for future improvement in the ERM process was the link to strategic planning, and making ERM more a part of the organization’s strategy was cited when asked about goals for the ERM implementation over the next 3 to 5 years. Overall, the responses seem to indicate that ERM’s strategic impact is limited and that the ERM implementation process often begins with a resource dependence/strategic focus, but ultimately emerges as more of an agency theory/monitoring tool. As a result, the overall impact of ERM is limited by the failure to tightly link ERM and strategy.

In a study of 110 non-financial Canadian firms, Ben-Amar, Boujenoui, and Zéghal (2014) found that a firm’s risk management approach is directed by the firm’s corporate strategy. Content analysis was performed on annual reports for 2007 to examine risk management. The authors reported that a firm’s business sector affects the risk exposure level, perception of risk consequences, and risk management strategy for both individual risks and risk categories.

Firm Value and Performance

As noted in the COSO definition of ERM, the goal of an effective ERM process is to increase the likelihood that organizations achieve their objectives. Although that is conceptually appealing, a number of boards may question whether actual ERM implementations have demonstrated value-adding contributions. ⁶ To explore answers to that question, we examine prior ERM research for insights about the association of ERM with firm value and performance.

Nocco and Stulz (2006) argued that the implementation of an integrated, holistic risk management environment (ERM) can be used to create value by better managing risk at a macro and micro level. By looking across the enterprise’s risks and coordinating them, ERM helps to ensure that no single project has a negative impact on the firm (Stulz, 1996). Unlike Nocco and Stulz (2006), Schiller and Prpich (2014) argued that ERM is lacking in solid empirical validation that the comprehensiveness is worth the effort, and its adoption is limited by its lack of solid theoretical support. The authors also point out that ERM does not provide institutional design recommendations.

While ERM has been widely accepted, there has been some resistance to the value proposition of ERM. For example, Power (2009) argued that ERM encourages a “logic of auditability,” which results in process-based rules with an ever-expanding reach leading to “the risk management of everything” (Power, 2004). The author also argues that the narratives of risk management cannot articulate nor comprehend the interconnectedness of critical risks. Power (2009) suggested that business continuity management (BCM) is a better way to manage risk because it potentially has a better consideration of interconnectedness. Overall, Power (2009) suggested that ERM ultimately can lead to the “risk management of nothing.” These views illustrate how some question whether ERM has the potential to be value adding.

Beasley, Pagach, and Warr (2008) used announcements of appointments of senior executives into ERM roles such as CRO to proxy for the launch of ERM. In a sample of 120 announcements of a senior executive being appointed to an ERM role, they found that there are significant relations between the magnitude of abnormal returns for the 2-day period surrounding the announcement and certain firm-specific characteristics. The authors state,

For nonfinancial firms, announcement period returns are positively associated with firm size and the volatility of prior periods’ reported earnings and negatively associated with leverage and the extent of cash on hand relative to liabilities. For financial firms, however, there are fewer statistical associations between announcement returns and firm characteristics. (pp. 311-312)

Overall, the study found that the value of ERM is dependent on the overall risk profile of the firm, with shareholders of higher risk firms placing greater value on the announcements of CRO appointments relative to other firms.

Gordon, Loeb, and Tseng (2009) used a word search to identify 122 firms that disclosed ERM activities. Using Compustat data to measure strategy, operations, reporting, and compliance (the four objectives in COSO’s ERM Framework), they developed an index of the effectiveness of a firm’s ERM initiative. The ERM effectiveness measure was then used in a regression with independent variables representing firm characteristics. ⁷ The authors used a subsample of high performance firms, as measured by 1-year excess stock returns (2% or better), to establish coefficients (best practices) of the firm characteristics of high performing firms. The authors then developed an optimum ERM score, which was compared with actual ERM scores. They found that the smaller the difference in optimum score and actual score, the greater the expected performance. The results of the study indicated that firms whose ERM initiative characteristics were properly aligned with the firm’s characteristics should experience greater firm performance.

Hoyt and Liebenberg (2011) performed a similar word search as Gordon et al. (2009) to identify insurance firms between 1998 and 2005 that had ERM initiatives. Using Tobin’s Q as a proxy for firm value, they found that firms with an ERM initiative had a higher median change in value than firms without an ERM initiative. On average, their results showed that firms with ERM initiatives were valued approximately 4% higher than firms without an ERM initiative. However, unlike Hoyt and Liebenberg (2011), Lin et al. (2012) found that the market responded negatively to ERM adoption in a study of insurance firms using Tobin’s Q and a similar word search to identify ERM adoption.

McShane, Nair, and Rustambekov (2011) also used Tobin’s Q as a proxy for firm value and the S&P ERM rating. The authors found that insurance firms experienced an increase in firm value as the firms increased their risk management sophistication in traditional risk categories. As the firms moved beyond silo risk management to a coordinated (holistic) approach, the firms did not see an increase in firm value. This suggests that firms achieve a higher level of performance as the firm improves overall risk management and controls, but further performance improvement is not apparent as firms move into more advanced ERM processes.

Gupta, Prakash, and Rangan (2012) examined 73 publicly traded firms, using a word search (1999-2009) to find the announcement of a CRO, and found that the market was more likely to react positively, as measured by increase in stock price, if the organization had few outside directors, suggesting that CRO appointments may lead to better governance.

Nair, Rustambekov, McShane, and Fainshmidt (2014) examined 60 insurance firms during the 2008 financial crisis to determine if the ERM processes align with the dynamic capabilities of the firm, allowing firms to better manage a changing environment. They calculated the stock decline between October 9, 2007 (S&P peak) and March 6, 2009 (S&P lowest point). Profitability return was calculated from the lowest point and post-crisis high in April 2011. Using the S&P rating, translated to a scale of 1 (weak) to 5 (excellent), they found that a superior ERM rating (5) resulted in a smaller stock decline during the downturn and superior profitability during the recovery period. ⁸

Baxter et al. (2013) examined 165 insurance and banking firm-years that received ERM ratings from S&P from 2006 to 2008 to investigate the rating in relation to firm performance as measured by return on assets (ROA) and Tobin’s Q. They found that firms with a higher ERM rating had higher operating performance (ROA) and higher Tobin’s Qs. The authors attributed this to ERM helping to mitigate risks and/or allowing the firms to take advantage of opportunities. The study also found that firms receiving a strong/excellent ERM rating initially had a stronger market reaction to the disclosure of the rating than those with lower ratings. In addition, they considered the time period before the global financial crisis, during the crisis, and after the crisis. They found a strong relationship between higher ERM ratings and market value only after the crisis and attributed this to investors looking for information such as the ERM rating to provide insight into a firm’s ability to address future risks.

In an additional study evaluating ERM maturity and firm value as measured by Tobin’s Q, Farrell and Gallagher (2015) used the Risk Management Society (RIMS) risk maturity model (RMM) to evaluate whether ERM maturity had an impact on firm value. Using the results collected from 2006 to 2011, which resulted in 225 firms across various industries, the authors found that there is significant evidence that ERM maturity has a positive impact on firm value. For firms with an overall RMM score of 3 to 5 (mature), firm value increased 25% and was highly significant as measured by Tobin’s Q. All of the areas of the RMM online tool were found to affect value, except risk appetite management and business resilience and sustainability.

In a study of U.S. insurers who answered the Tillinghast Powers Perrin ERM survey of 2004 and 2006, Grace, Leverty, Phillips, and Shimpi (2015) studied cash flow implications of the adoption of ERM and found that organizations having a cross-functional dedicated risk manager who reported to the board or CEO, along with a simple economic model, had significant increases in revenue and cost efficiency.

Culture and ERM

Three of the major organizational change initiatives of recent decades, reengineering, total quality management (TQM), and firm downsizing, have had less than stellar success (Cameron & Quinn, 2006). Lack of organizational culture fit to an initiative was given as a common reason for failure, leading to the belief that an organization’s culture and strategy must be aligned to be successful. As ERM is a change initiative similar to the previously mentioned initiatives, it is reasonable to assume that an organization’s culture would be a significant factor in explaining the strategic value of ERM.

Mikes (2009) found in a longitudinal study of two banks that two cultures emerged, “ERM by the Numbers,” driven by a strong shareholder value imperative, and “Holistic ERM,” driven by a risk-based internal-control imperative. The ERM by the Numbers firm relied heavily on calculations for quantitative risks, which resulted in a diagnostic risk model. The Holistic ERM firm quantified risks but did not rely solely on the numbers. Also, senior risk managers with intimate knowledge of the business sectors responded to management’s concerns and thus influenced the actions beyond what the numbers might have shown.

In a follow-on study, Mikes (2011) interviewed 53 individuals in risk management positions at five major banks over the period of 2001-2010. The article sought to determine if the pursuit of expanding risk measurement in risk management was leading to a dysfunctional environment, as espoused by Power (2009) and Tabel (2007), and if the type of culture as defined in Mikes (2009) explained why some organizations become committed to risk measurements, whereas others do not. The author used boundary-work to suggest that organizations that are “ERM by the Numbers” create risk measurements that imply the expertise on risk lies in the risk organizations and can lead to greater organizational control. Mikes described these organizations as having “quantitative enthusiasm” and being dedicated to risk measurements. Organizations that approach ERM in a holistic manner focus on combining risk measures with experience and intuition to develop soft measurements, which better reflect the risk of non-measurable strategic risks. The approach seems to leave the boundaries blurred as to where the expertise lies in an organization. These organizations were described as having “quantitative skepticism” and providing top management with alternative scenarios on emerging risks.

Cooper, Faseruk, and Khan (2013) performed a meta-analysis of practitioner studies to determine the relationship between ERM and organizational culture. By grouping relevant questions from 14 major risk studies published from 2006 through 2010, the authors analyzed the responses from the perspective that organizational culture was a “major benefit” or a “major barrier” to implementation of ERM. Their study did not put forth an answer to this question but did find that a significant number of entities consider organizational culture important to ERM implementation.

A common way of describing organizational culture is on a continuum from mechanistic to organic (Burns & Stalker, 1961). Mechanistic cultures have a chain of command structure in the form of rankings of positions, vertical communication paths, and decisions driven down to employees from top management. On the other end of the continuum, organic cultures have a network of control and authority, lateral communication paths, and employees who receive information and advice in a cooperative manner rather than instructions from supervisors.

Kimbrough and Componation (2009) used an instrument, Organizational Culture Assessment (OCA; Reigle, 2001, 2003), which was based on the mechanistic/organic continuum of Burns and Stalker (1961), to study how the organizational culture framework is related to ERM implementation. In a study of 116 firms from 21 different industries, the authors found that organizations with higher organic scores were more likely to have a risk management program, were more likely to state that culture aided in the speed and effectiveness of ERM implementation, and were more satisfied overall with the effectiveness of the firm’s ERM program. Firms with higher OCA scores (organic culture) were more likely to answer “yes” to the question of whether the firm’s culture has been modified to support ERM. This finding is not surprising given that organic firms are more open to change and innovation. The study did not find that culture was related to the presence of a CRO, but for the firms that did have a CRO, the firms with organic cultures were more likely to have a formal risk management process and to be further along in the ERM implementation. Similarly, Kleffner, Lee, and McGannon (2003) found that a hindrance to ERM adoption was a silo mentality at firms due to the firms’ organizational structure, which could be interpreted as a characteristic of a mechanistic culture.