Making Risk Management Strategic: Integrating Enterprise Risk Management with Strategic Planning

• DOI: http://doi.org/10.1111/emre.12185
• Date: 01 September 2019
• Published date: 01 September 2019
• Author: Torben Juul Andersen,Johanna Sax

Making Risk Management Strategic:

Integrating Enterprise Risk Management with

Strategic Planning

JOHANNA SAX and TORBEN JUUL ANDERSEN

Department of International Economics and Management, Copenhagen Business School, Frederiksberg, Denmark

Enterprise risk management (ERM) is an established management practice and is increasing in prominence as

more firms spend substantial resources implementing ERM frameworks, partially induced by regulatory

requirements. Yet, there is a lack of knowledge as to whether such frameworks add value and, if so, how the

performanceenhancing dynamic works. Drawingon survey data from 260 of thelargest firms in Denmark, thisstudy

analyzes these empirical questions and finds that ERM is associated with higher profitability and lower financial

leverage, andthat strategic planning enforcesthese favorable outcomes.The study develops a new multidimensional

measure of adherence to ERM practices where earlier studies typically have relied on dichotomous proxies. We

discuss the implications of these findings for ERM practice and strategic management in general.

Introduction

Management scholars suggest that environmental

scanning, decision analysis, control systems, and

communication devices can help firms observe changes

and adapt in competitive industry contexts (Miller and

Friesen, 1978; Hambrick, 1982; Priem et al., 1995). Parts

of the strategy l iterature has also pointe d to strategic

planning as a way for firms to deal more systematically

with an uncertain environment as an analytical approach

to assess the future direction of the firm (Schendel and

Hofer, 1979; Kudla, 1980; Ansoff, 1988; Miller and

Cardinal, 1994; Brews and Hunt, 1999; Andersen, 2000;

O’Regan et al., 2008;). Recently, enterprise risk

management (ERM) practices have received much

attention as a way to conduct risk-based analyses within

the strategic management processes (Moeller, 2007;

Fraser and Simkins, 2009). With origins from

management accounting and control, ERM has presented

a shift in the way firms deal with risks by using essential

management approaches to holisticallyevaluate the major

risks faced by the firm (Power, 2009). Some proponents

argue that ERM has a significant potential to create

competitive advantage by identifying, assessing, and

managing the risks that affect the value of the firm,

thereby enhancing corporate risk awareness for better

operational and strategic decision-making (e.g. Arena

et al., 2011; Hoyt and Liebenberg, 2011).

Nonetheless, various studies providemixed support for

the claim that ERM enhances performance and the value

of the firm. A f3ew studies find positive effects (Gordon

et al., 2009; Hoyt and Liebenberg, 2011; Eckles et al.,

2014; Grace et al., 2015), others fail to find any effects

(Pagach and Warr, 2010; Quon et al., 2012; Sekerci,

2015), and Lin et al. (2012) find that it erodes f irm value.

This inconsistent empirical evidence raises serious

questions about the anticipated beneficial effects of

ERM practices. Some ERM proponentsfurther claim that

ERM should be integrated with the firms’strategic

planning processes to benefit from the holistic and

integrated risk management approaches. Yet, surprisingly

little academic attention has been devoted to analyze the

conjoint effectsof these essential managementapproaches

and how they interact. Most research on ERM draws on

the finance and accounting fields, where a joint focus on

the risk managementand strategic management literatures

is warranted (Beasley and Frigo, 2009; Frigo and

Anderson, 2011; Bromiley et al., 2014). This study

Correspondence:Johanna Sax, Departmentof InternationalEconomics and

Management, Copenhagen Business School, Frederiksberg, Denmark.

E-mail jsa.int@cbs.dk

DOI: 10.1111/emre.12185

©2018 European Academy of Management

European Management Review, Vol. 16, 719–616 , (2019 )

74740

74

responds to these calls by combining aspects of the

emerging ERM liter ature and the strategy literat ure to

improve our understanding of the relationship between

ERM and strategic planning. Hence, the study addresses

two research questions. First, does ERM contribute to

enhance performance outcomes? Second, how is this

potential effectrelated to strategic planning?This research

focus can help determine whether and how firms can

benefit from the conjoint emphasis on ERM and strategic

planning.

ERM has been described as an obscure and under-

specified concept with several definitions (Mikes, 2005),

which by itself can explain the mixed findings of the

relationship between ERM and firm performance (Kraus

and Lehner, 2012). Most of the research on ERM relies

on publicly accessible data, measuring ERM as the

appointment of a chief risk officer (CRO), or based on a

word search for ‘ERM’in financial reports and other

media. These dichotomous variablesare necessarily crude

and only allow little variance that might bias the results

(Boyd et al., 2005; Nielsen, 2014). These measures do

not capture the extent of ERM implementation (Beasley

et al., 2008) or the qualityof the adopted risk management

practices (Mikes and Kaplan, 2014). Mikes and Kaplan

(2014: 8) argue that ERM is ‘deployed at different levels,

for differentpurposes, by different staff groupsin different

organizations’. Furthermore, lack of a formal ERM

framework and not announcing a CRO may not

necessarily indicate that ERM inspired practices are

absent from the organization. Firms may not have an

explicit articulation of the ERMvocabulary, but could still

employ the implied risk management practices as part of

their managerial tactics (Corvellec, 2009). Rather than

addressing only those firms that explicitly subscribe to a

specific ERM framework (e.g. COSO, 2004; ISO31000,

2009), this study assumes that the ERM principles are

embedded in the firms’practices and tactics even though

not always formally articulated asERM. Hence, the study

develops an ERM measurebased on the risk management

practices described in the literature to advance prior

empirical risk m anagement studies.

This study contributes to the management field in

several important ways. The study sheds new light on

the implied performance effects of ERM practices that

updates prior risk management studies and thereby

reduces the ambiguity of earlier results. It does so by

introducing a new ERM measure based on the firms’

adherence to basic dimensions of established ERM

practices and thereby avoids the shortcomings of

dichotomous indicators. Thereby thestudy heeds a recent

call to analyze effects of specific managerial techniques

applied in firmsadopting a practice-basedview of strategy

(Bromiley and Rau, 2014). The study further investigates

the intricate relationship between risk management and

strategic planning to determine the dynamic interaction

between the two. This contributes to the strategyliterature

discussing how risk management practices may increase

the ability to process environmental information on

emerging risks and opportunities as the basis for further

planning of strategic responses, which in turn leads to

improved performance outcomes.

The remainderof the paper is divided into four sections.

The first section outlines the theoretical arguments for the

proposed model relationships between ERM practices,

strategic planning, and performance outcomes expressed

in a number of hypotheses. Subsequent sections describe

the methodology applied in the empirical study and

present the analytical results. The final section discusses

the findings from the study, evaluates limitations, and

considers implications for future research and

management practice.

Theoretical background and hypotheses

The current status of the enterprise risk management

literature.

The numerous debacles from corporate frauds and

scandals to financial crisis as witnessed over recent years

have created a demand from institutional investors, rating

agencies, stockexchanges, and regulators thatfirms take a

more systematic approach to handle the risks that can

affect firm performance. The combinationof a vulnerable

business environment and mounting legal and regulatory

requirements have spurred a growth of different risk

management frameworks (Arena et al., 2010). Hence,

adopting ERM is regarded as a signal of sound corporate

governance where firms put themselves at risk if they

discard it (Martin and Power, 2007). Several frameworks

have been advanced to implement a systematic, holistic,

and integrated approach to deal with the many risksfaced

by the firm (e.g. COSO, 2004; ISO31000, 2009).

According to these frameworks, firms should seek to

identify and evaluate all major risks, design mitigating

response strategies, monitor the process and make

adjustments if necessary, while reporting the corporate

exposures to top management and the board (Olson and

Wu, 2008). These activities are executed across the

organization according to standardized procedures

(Moeller, 2007). The risks are handled in an integrated

manner rather thanin separate uncoordinated departments

(Barton et al., 2002). ERM represents an integrated

approach where all risks are analyzed in aggregation

across the entire organization including those risks for

which probability, timing and impact can be hard to

predict such as the risk inherent in strategic decisions

(Dickinson, 2001). While there are numerous risk

management frameworks, COSO has become one of the

templatesfor best practice (Power, 2007,2009). However,

the prescribed risk management practices across the

720 J. Sax and T.J. Andersen

©2018 European Academy of Management