Adopting Enterprise Risk Management inToday’s Wo.docx

Adopting Enterprise Risk Management in
Today’s World:
An Evidence-Based Guide for Implementation
by
Dr. Steven Deck
COPYRIGHT © Steven Deck, 2017

Biography
Dr. Steven Deck has over 25 years of experience developing and
implementing risk management, environmental health and
safety,
international safety and security, emergency response, and
continuity of
operation programs and processes in higher education and in
biomedical and
pharmaceutical industries. Dr. Deck has also lead efforts to
identify and treat
risks associated with implementing a strategic plan at a large
research
university. Hence, he has experience managing risks at both the
operational
and strategic level. He holds a doctorate in management, an
MBA, and a
bachelor’s degree in safety and industrial hygiene management.
Dr. Deck
also holds an associate in risk management and is a certified
industrial
hygienist, safety professional, and hazardous materials manager.

Dedication
This book is dedicated to the people who tirelessly work to
reduce
risks organizations face in today’s fast-paced world. Their
efforts sometimes
go unnoticed since, if successful, risk managers prevent adverse
events from
occurring or significantly reduce their impact on the
organization. A good
day for a risk manager is one that is uneventful with operations
continuing
without interruption. However, their work is critical to an
organization’s
ability to achieve its mission. By reducing risks that threaten an
organization’s survival, risk managers preserve the
organization’s ability to
offer people opportunities to earn a living and provide for their
families.
Indeed, a risk manager role is critical to the success of society
even if their
work sometimes goes unnoticed.

Acknowledgments
First, I would like to thank my advisory committee for my
dissertation,
Dr. Thomas Mierzwa and Dr. Denise Breckon. The research for
my
dissertation served as the foundation for the writing of this
book. Their hard
work and commitment to my growth as a scholar enabled me to
grow
intellectually and develop the skills needed to write this book. I
would also
like to acknowledge Dr. Roger Ward, Senior Vice President for
Operations
and Institutional Effectiveness and Vice Dean for the Graduate
School at the
University of Maryland Baltimore for encouraging me to pursue
my doctoral
degree and continuing to support me throughout my career.
Thanks also goes
to Dr. Lauren Sweetman for her guidance and editing of this
book. Last, and
most importantly, I would like to thank my wife, Bonnie, for

her patience and
support as I fulfilled the demanding requirements of a doctoral
program and
writing this book.
Table of Contents
Introduction
Part 1: Understanding Organizational Risk and Risk
Management
Chapter 1: Organizational Risk
Chapter 2: Traditional Risk Management
Chapter 3: Frameworks for ERM
Part 2: Management Science and ERM: From Theory to Practice
Chapter 4: Organizational Change I – Institutional Theory,
Legitimacy
Theory, and Organizational Culture
Chapter 5: Organizational Change II – Change Management
Chapter 6: Organizational Change III – Organizational Control
and
Resilience
Chapter 7: Organizational Change and COSO’s ERM
Framework
Chapter 8: Decision Making I – Sensemaking Theory
Chapter 9: Decision-Making II – Bias and Framing
Chapter 10: Decision Making and the COSO ERM Framework
Chapter 11: Organizational Learning I – Learning Organizations
Chapter 12: Organizational Learning II – Sensemaking-Based
and
Team-Based Learning
Chapter 13: Organizational Learning III – Action and

Absorptive
Capacity
Chapter 14: Organizational Learning and COSO’s ERM
Framework
Part 3: Factors Affecting ERM Adoption and Implementation
Chapter 15: The Program Implementation Process
Chapter 16: Why Organizations Adopt an ERM Strategy
Chapter 17: Factors Influencing the Implementation of an ERM
Program
Chapter 18: A Model for ERM Implementation in Complex
Organizations
Part 4: Seven Principles for ERM Adoption and Implementation
Chapter 19: The Seven Principles
Chapter 20: Concluding Remarks
References
Introduction
Risk is pervasive to conducting business. Consider any
operation an
organization performs: each requires identifying and managing
the risks that
can impede the execution of the operation. For example,
production units
must manage risks such as employee safety or the loss of a

critical supplier or
piece of equipment, human resource departments confront
potential claims of
unfair labor practices, and information technology groups must
be alert to
cyber threats. Moreover, organizations face external risks that
arise due to
advances in technology, changing economic and market
conditions, and
increased globalization. Even organizations that fall outside of
the traditional
conversation on risk must now consider these challenges.
Higher education
institutions (HEIs), for example, are under increased pressure
from the
government, public, and campus community to manage risks
(The Advisory
Board, 2008; University Risk Management and Insurance
Association
[URMIA], 2007). Such institutions must manage a wide range
of risks in
diverse areas such as safety and security, regulatory
compliance, academic
affairs, research, information technology, finance, human

resources, and
facilities management (Abraham, 2013). Furthermore, recent
events such as
hurricanes Katrina, Harvey, and Maria, the economic downturn,
and social
issues such as sexual assault on campus and protest actions
point out the
importance of managing risk in higher education. Indeed,
although the
institution may survive such events, leadership may not. For
example, both
the Penn State Jerry Sandusky sexual abuse scandal in 2011 and
the
University of Missouri social protests of 2015 resulted in
leadership changes
at these institutions.
Many organizations have historically deferred responsibility to
managing risks to individual operating units within the
organization.
However, this approach lacks an overarching strategy for
managing risks
from an institutional perspective. The lack of a comprehensive

risk
management strategy leads to inconsistent risk tolerance levels,
inefficient
resource allocation for risk control activities, and a lack of
knowledge on how
risk affects achieving the strategic objectives of the
organization. Here, an
approach known as enterprise risk management (ERM) provides
a method to
manage risks in organizations holistically. In this book, I
unpack this
approach both theoretically and practically, providing a hands-
on guide to
understanding, adopting, and implementing ERM within
complex
organizations. First, however, in the remainder of this
introduction, I describe
the concept of ERM along with the evidence on which this book
is based—
my doctoral research—and the systematic review methodology I
employed to
analyze it, followed by a brief summary of the structure of the
book.

What is ERM?
Enterprise risk management is a senior leadership initiative that
aims
to integrate an organization’s risk management practices in
order to enhance
the organization’s ability to achieve its strategic objectives (The
Committee
of Sponsoring Organizations [COSO], 2004; Hoyt &
Liebenberg, 2011). In
doing so, ERM moves beyond traditional risk management
approaches that
focus on managing risks in functional silos. Instead, ERM
aspires to manage
risks as a portfolio in order to capture the full range of risks and
multiple
interdependencies between them. It does this by positioning risk
management
as a senior leadership responsibility, assessing risk from an
entity-wide
perspective, aligning business strategies with risk tolerance
levels, and
integrating accountability for managing risks across the entity

(COSO, 2004;
Kimbrough & Componation, 2009; Kleffner, Lee, & McGannon,
2003;
McShane, Nair, & Rustambekov, 2011). Because of this holistic
approach,
ERM provides a means to manage organizational risk in a
comprehensive and
strategic manner.
Existing ERM models originate from the business sector and
were
developed by practitioners in such fields as auditing,
accounting, and
insurance (Andersen, 2010). Despite their comprehensive
approach, these
original frameworks tend to emphasize hierarchal management
structures,
quantifying risk exposure, and control systems for managing
risks. And, as
ERM is a relatively new management practice, there is limited
empirical
research on implementing the practice in complex
organizational settings.

Therefore, today’s organizations face the challenge of
introducing useful
ERM frameworks that are undeveloped for complex settings into
an
organizational culture that may already be skeptical of new
management
approaches due to their previous experiences with restructuring
and efforts at
organizational change. With the right tools and knowledge,
however, as I
show in this book, ERM can be utilized in any organizational
setting to
improve the risk management practices of the organization
effectively and
efficiently.
The Systematic Review: An Evidence Base for ERM
This book utilizes a broad evidence base on ERM that I
gathered
through the rigorous systematic review study I conducted for
my doctoral
research. In this study, I examined the utility of ERM
particularly in relation

to complex organizations, using the case study of higher
education
environments as a frame for analysis. These environments
present a wide
range of risks that cross multiple organizational boundaries.
Traditionally,
such institutions had deferred risk management to the individual
units most
affected by the risks. Such an approach did not look at the
overall risk profile
of the institution and risks’ effects on achieving the
institution’s strategic
objectives. Consequently, higher education leaders had turned
to ERM as a
strategy to manage institutional risks. However, ERM is a
management
practice that originated from the corporate sector. This raised
the question as
to whether an ERM strategy for managing risks was appropriate
for higher
education. In addition, if an ERM strategy was deemed
appropriate for
managing risks in higher education, how should leadership
implement such a

program? Prior to my study, existing ERM frameworks lacked
information
on how to implement this practice in complex organization
settings.
Therefore, in my study I posed the following research question:
How do
critical success factors influence a decision to adopt and
implement ERM in
higher education institutions? To answer this question, I
reviewed both the
literature on this topic as well as its connections to academic
theories of
change management, decision making, and organizational
learning. Overall, I
showed how these theories could enhance the implementation of
ERM in
complex organizations—findings I now bring to you. Although
the study
used higher educational institutions as a framework for analysis,
the findings
and recommendations from the study are transferable to any
organization that

has a diverse range of operations, business units, and core
functions.
More specifically, in the systematic review, I used a series of
study
search terms related to ERM to search the electronic database
OneSearch for
credible scholarly sources on ERM. Initially, the search yielded
999 citations
(after duplications were removed). I reviewed all articles in
brief (e.g., titles,
abstracts, headings) based on the study’s inclusion and
exclusion criteria. I
looked specifically for primary research articles (articles
describing research
undertaken by the authors themselves) and articles directly
relevant to the
study’s research questions. After this stage, 53 primary studies
relevant to the
research question remained for review. I then conducted a
quality appraisal
process to ensure the rigor and validity of the research, which
resulted in the
further elimination of two studies due to poor quality. I
subsequently added

four grey literature studies (reports on ERM by organizations),
resulting in a
final dataset of 55 studies. Figure 1 provides a summary of the
results of the
search process.
Several observations can be made of the studies included in the
systematic review. First, the studies from peer-reviewed
journals included in
the dataset were published after 2003, with 84% published after
2009. This
highlights that ERM research is still in its infancy. Second, the
studies
published in peer-reviewed journals were found in the following
types of
publications: accounting and finance (n = 19), risk management
and
insurance (n = 14), engineering (n = 6), management sciences (n
= 5),
information technology (n = 4), energy management (n = 2), and
higher
education (n = 1). These results point to the strong influence the
accounting,

finance, risk management, and insurance fields have on ERM
research. The
results also highlight the limited number of studies published in
journals
dedicated to the management sciences.
As ERM is a global phenomenon, no geographic limitations
were
placed on the literature reviewed in my study. Consistent with
Scott’s (1992)
assertion that “we can understand much about a specific
organization from
knowing about other organizations” (p. 1), studies from sectors
outside of
higher education were also included in the study. This allowed
me to observe
which ERM implementation mechanisms worked or failed to
work across a
range of organizational settings. Due to the study’s focus on
ERM as a high-
level framework for managing risk and the challenges of
implementing ERM
in higher education, technical aspects of risk management were

outside the
scope of this study. Examples of these include mathematical
models for risk
assessment and developing information technology solutions for
ERM
programs.
Of the studies included in the review, 23 included findings from
U.S.-based organizations, while the remaining were from a
diverse set of
countries and regions including Australia, Brazil, Canada,
China, India, Italy,
Germany, Malaysia, the Middle East, New Zealand, the
Netherlands,
Scandinavia, Sri Lanka, Turkey, and Zimbabwe. The studies
looked at a wide
range of industry sectors, including banking, construction,
education, finance,
government agencies, insurance, manufacturing, nonprofit
organizations, oil
and gas, research institutions, services, suppliers, and utilities.
These results
indicate ERM is a management strategy that has received global

attention
from a wide variety of industries.
Thirty-five studies employed quantitative methods to analyze
data
gathered from surveys, controlled studies, or publicly available
financial data
sources. Twelve studies were qualitative, using methodologies
such as case
studies and four used mixed methods. Two pieces of grey
literature were
based on survey findings and two were from roundtables.
Hence, research on
ERM has been conducted using multiple research
methodologies. Last,
consistent with the research question this study explored,
research on ERM
focused on two aspects of ERM: (a) why an organization would
adopt ERM
and (b) the critical factors that influence ERM implementation.
Overall, when
looking at the evidence-base as a whole, this book is based on
findings from
the 55 studies. This entails evidence from 5,614 survey
respondents, publicly

available data from 935 companies, and data from 35 case
studies.
A How-To Guide for ERM
In this book, I provide a detailed overview of ERM, along with
a guide
for its adoption and implementation. In Part 1, I explain the
concepts of
organizational risk and risk management in relation to the
complex
organization, unpacking traditional risk management approaches
as well as
ERM frameworks in more detail. Then, in Part 2, I review a
series of
management theories and concepts that can be utilized to
enhance
understanding and implementation of ERM, including:
institutional theory,
legitimacy theory, change management models, sensemaking
theory, decision
sciences, theories of action, absorptive capacity, and
organizational

resiliency. This is followed in Part 3 by a discussion of factors
that affect
ERM adoption and implementation. In Part 4, based on my
experience as a
practitioner tasked with identifying and mitigating risks in his
operational
unit, and later from my broader role in the University’s ERM
efforts, I
introduce seven principles for ERM adoption and
implementation, providing
a hands-on tool to guide the ERM process in complex
organizational settings.
Lastly, in the concluding remarks, I comment to the wide
applicability of
ERM for complex organizational settings, speaking to the
implications of this
adopting ERM and areas for future research.
Overall, this book will provide you with both practical and
theoretical knowledge for adopting ERM to improve
organizational
performance. This book expands the body of knowledge on
ERM by

identifying factors that influence ERM implementation in
complex
organizational settings, and linking them to a set of
management theories that
enhance ERM implementation. To date, existing frameworks on
ERM have
lacked practical information on implementing and integrating
ERM across
the organization (Fraser, Schoening-Thiessen, & Simkins,
2008). Indeed, a
key difference between ERM and traditional risk management
practices is
that ERM elevates managing risks to a senior leadership level.
This entails
managing risk across the institution. Therefore, implementing
ERM is a
broad organizational change initiative.
As a result, this book is useful for senior leadership and risk
management practitioners who are seeking evidence-based
guidance on how
to implement ERM in their organization. This book addresses
the interests of
senior leadership by providing answers as to why organizations

implement
ERM, and the benefits and pitfalls of implementing an ERM
program. This
book also demonstrates how ERM adoption and
implementation—and risk
management practices more generally—can be enhanced
through the
application of theories from management science on change
management,
decision making, and organizational learning.
Part 1: Understanding Organizational Risk and Risk
Management
At its core, adopting and implementing ERM is simply a
management
process for how an organization identifies and manages risks
that threaten
achieving its mission and business objects. As such, it entails
utilizing sound
management practices one would use when implementing a
management
process in an organization. However, ERM does have distinct
elements that

practitioners should be aware of when implementing an ERM
strategy.
Hence, in order to understand how and why ERM may be a good
choice for
the complex organization, we must first unpack in more detail
three key
concepts or focus areas that underpin this book: organizational
risk,
traditional risk management, and ERM. These concepts occur in
modern
organizational environments that can entail a wide range of
structures that
may change over time. In addition, such environments often
include varying
cultural and individual elements such as the culture specific to a
nation,
organization, or department, or may relate to certain
professional disciplines
(e.g., teacher, police officer, doctor, accountant, and lawyer). In
Part 1, I
describe the these three concepts in detail, in order to establish
an essential
set of knowledge before discussing management theory and
practice further

in Part 2.
Chapter 1: Organizational Risk
Prior to examining the ERM implementation process, it is
necessary to
examine why risk presents challenges for complex organizations
that
necessitate implementing an ERM strategy.
In this chapter, I discuss how the concept of risk has evolved
into a critical
management function requiring senior leadership attention. I
situate risk
within the context of the unpredictable, dynamic, and complex
business
environments in which organizations operate, and how this
influences an
organization’s decision to implement ERM.
Defining Risk
Definitions of risk associated with organizations operating in
the

modern business environment utilize several unique concepts.
For example,
Williams, Zainuba, and Jackson (2008) view risk as complex
and
multidimensional. The authors added that risk is unavoidable,
and defined
risk from a decision-maker’s perspective as
an assessment of whether an unfavorable outcome might occur
(possibility of loss), an assessment of the range of possible
unfavorable
outcomes (probabilities of such loss), and an assessment of the
extent to
which possible unfavorable outcomes can be managed or
controlled
(exposure to hazard or danger). (Williams et al., 2008, p. 59–
60)
A more precise definition of risk is “the uncertainty about
outcomes that can
be either negative or positive,” where risk management is
defined as “the
process of making and implementing decisions that will
minimize the adverse
effects of accidental losses to an organization” (Baranoff,

Harrington, &
Niehaus, 2005, p. 1.4–1.5).
Woon, Azizan, and Samad (2011) proposed three categories of
risks
that affect an organization’s financial performance: (a) tactical
risk, which
involves the uncertainty of expected earnings; (b) strategic risk,
which entails
the uncertainty of performance outcomes; and (c) normative
risk, which
addresses the risk penalty a firm pays for not conducting
business within the
accepted norms of the industry and society. Similarly, Kaplan
and Mikes
(2012) proposed a three-category system for classifying
organizational risks.
First, preventable risks are internal to the organization and arise
in the course
of business (e.g., safety hazards and improper employee
actions). Preventable
risks lack strategic benefit but must be actively managed due to
the negative

impact they can have on the organization. Second, strategic
risks are risks a
company voluntarily takes in order to generate desired
economic returns.
Strategic risks are not inherently undesirable but require
different strategies to
manage than those used to manage preventable risks. Last,
external risks
surface from outside the organization and are beyond the
control of the
organization. An organization must develop a process to
identify potential
external risks and prepare contingency plans to manage them if
they occur.
These two methodologies for categorizing risks illustrate that
not all risks are
created equal. Hence, complex organizations need to consider
the type of risk
when establishing risk assessment strategies and tolerance
levels.
Dimensions of Risk
Brinkmann (2013) identified the following six dimensions of

risk:
measurability, attributability, manageability, insurability,
voluntariness, and
moral responsibility. Measurability is the quantifiable
dimension of risk.
Attributability involves whether the risk can be ascribed to
organizational
decisions. Manageability concerns actions that can prevent or
eliminate the
risk. Insurability is whether the risk can be insured.
Voluntariness deals with
whether a risk is chosen using free will and with sufficient
knowledge to
make an informed decision. Finally, moral responsibility
involves whether
risk is taken with the informed consent of all parties involved in
the decision.
Each of Brinkmann’s dimensions suggests a certain level of
understanding
and control an organization has over the risks it faces. However,
it is
questionable to what extent the complex types of risks modern
organizations
face are measurable and are under the control of the

organization. Moreover,
complex organizations need to consider determining the
appropriate decision
maker(s) for a risk, whether affected people are informed about
the risk, and
if the financial liability for the risk can be controlled through
insurance or
other risk transfer mechanisms (e.g., by holding harmless
agreements or
contracting out the risk exposure).
Risk management processes tend to focus on analyzing risks
from an
event perspective to determine cause and effect relationships.
However, risk
is a complex phenomenon, and as Grabowski and Roberts
(1997) showed,
implementing a risk mitigation system in large organizational
settings is
difficult. The authors argued that such challenges are related to
four
characteristics of large systems: (a) simultaneous autonomy and
interdependence, (b) intended and unintended consequences, (c)

long
incubation periods that allow problems to develop, and (d) risk
migration. As
large systems, complex organizations are likely to encounter
these challenges
during ERM implementation.
Boisot and McKelvey (2010) used Ashby’s law of requisite
variety
to explain complexity in organizational settings. According to
Ashby’s law,
“only variety can destroy variety” (p. 421). As such, for an
organism or social
entity to be adaptive, it must be able to match the variety of
external stimuli
imposed on it. Consequently, the authors proposed that for an
organization to
be adaptive, it must have a variety of responses available that
match the
variety of external constraints or threats imposed on the
organization.
Moreover, when the external variety exceeds the capacity of the
organization,
adaptive tension develops that seeks to fill the gap between the
system’s

capability and external demands so the system can survive.
Consequently,
Boisot and McKelvey’s (2010) separation of complexity into
three regions
(chaotic, complex, and ordered) helps explain why certain types
of risks can
be understood and controlled by the organization, where other
risks are more
difficult to recognize and comprehend. The chaotic region is
typified by
stimuli that have no discernible regularities, while the complex
region—
where most challenges fall—presents some regularity, though it
may be
difficult to discern. The ordered region involves stimuli that, in
theory, can be
planned for and controlled.
For example, Andersen (2010) suggested strategic risks can
involve
significant exposure to organizations due to their high level of
uncertainty.
Thus, strategic risks often lack easily discernible regularities

yet present
significant risk to the organization. Hence, strategic risks share
the
characteristics of the chaotic or complex regions depicted by
Boisot and
McKelvey (2010). Despite this high exposure level, Andersen
(2010)
suggested that most risk management approaches tend to focus
only on
recognized exposures, and are ill-equipped to handle complex
risks
associated with high levels of uncertainty. This is a particularly
salient
challenge for ERM since ERM aspires to look at a broad range
of
organizational risks, including those at the strategic level.
However,
methodologies for evaluating risks are often based on assessing
risks that are
more easily identified, measured, and controlled. Examples
include risks such
as safety hazards or failing to meet regulatory requirements.
Uncertainty and ambiguity can add to the complexity of
identifying and

understanding an organization’s risk exposure. Scott (1992)
identified five
dimensions of uncertainty. First, the degree of
homogeneity/heterogeneity
involves the level of diversity of customers and stakeholders an
organization
must manage. Second, the degree of stability/variability is the
extant an
organization experiences change. Third, the degree of
threat/security
concerns how vulnerable an organization is to its environment.
Forth, the
degree of interconnectedness/ isolation involves how dependent
an
organization is on other organizations or agencies. Last, the
degree of
coordination/noncoordination is the extent to which an
organization deals
with external groups whose actions are coordinated. Due to the
diverse set of
customers and stakeholders complex organizations regularly
interact with and

the increasing complexity of the environment in which they
operate, the
context within which organizations must identify, evaluate, and
act on risks
also contains a high level of uncertainty. Indeed, Power (2007)
stated that
“when uncertainty is organized, it becomes a risk to be
managed” (p. 6).
The concept of risk is further complicated since leadership
involves
taking risks and leading organizations through areas where
success is not
guaranteed (Brinkmann, 2013). March and Shapira (1987) added
that leaders
often define risk differently than the theoretical literature, and
that even two
individuals can see the same risk differently. The authors
explained that
leaders see risk as something they can control, and risk-taking
as part of their
job and identity as leaders. The authors also found that leaders
place more
weight on the potential positive outcomes of an activity over

negative results.
Furthermore, leaders do not see risk as simply a statistical or
probability
concept, or see value in reducing risk to a single quantifiable
measure.
Risk also has social dimensions when situated within the
context of
an organizational environment. Indeed, Power (2007) suggested
risk has
“acquired social, political, and organizational significance as
never before”
(p. 3). Weick (1995) proposed that organizations are networks
of people
socially interacting through the use of shared meanings and
language, and
that internal …

Adopting Enterprise Risk Management inToday’s Wo.docx

More Related Content

Similar to Adopting Enterprise Risk Management inToday’s Wo.docx

More from SALU18

Recently uploaded

Adopting Enterprise Risk Management inToday’s Wo.docx