Does the hiring of chief risk officers align with the COSO/ISO enterprise risk management frameworks?

Abstract

Purpose There are two main industry-sanctioned enterprise risk management (ERM) models, that is, COSO 2004 and ISO 31000:2009, that firms refer to when implementing ERM programs. Taken together, the two ERM models specify that firms should implement ERM programs to meet a strategic need, improve operations and reporting or to comply with government regulations or industry best practices. In addition, the focus of ERM implementation should be either the subsidiary, business unit, division, firm/entity or global level. The purpose of this study is to investigate whether firms are aligning their ERM implementations with these tenets: strategy, operations, reporting, compliance and the level of implementation. Design/methodology/approach The proxy for ERM implementation is the hiring of a Chief Risk Officer (CRO). The research data come from a sample of 122 US firms that issued a press release following the hiring of a CRO between 2010 and 2014. The press releases were retrieved and aggregated through content analysis in LexisNexis Academic. Findings The results reveal that many ERM implementations are occurring at the firm/entity level, and with the exception of reporting, firms consider ERM to be a strategic firm resource capable of improving business operations and compliance initiatives. Originality/value There is a dearth of research studies specifically investigating whether ERM programs adopted by firms are aligned with the specification of COSO 2004 and ISO 31000:2009 frameworks. The apparent lack of a clear understanding of the alignment between the firm ERM programs and the industry’s ERM frameworks may limit the development and implementation of ERM and the eventual realization of the benefits associated with a successful ERM implementation.

Enterprise Risk Management in Accounting Research: A Literature Review

“…3 The target period of the literature search extends up to October 2017, as at the time of writing this paper. Many studies discuss the advantages and disadvantages of ERM frameworks (Arena, Arnaboldi, & Azzone, 2010;Beasley, Clune, & Hermanson, 2005;Choo & Goh, 2015;Hayne & Free, 2014;Karanja, 2017;Paape & Speklé, 2012;Tekathen & Dechow, 2013), and many agree with the usefulness of COSO's ERM-IF. In Fraser, Schoening-Thiessen, and Simkins (2008) survey, 74% of respondents had read COSO's ERM-IF, making it the most widely-read publication about risk.…”

“…First, studies show that ERM frameworks such as the COSO ERM-IF and ISO 31000 are factors that promote the introduction of ERM (Beasley et al, 2005;Choo & Goh, 2015;Karanja, 2017). Beasley et al (2005) showed that COSO's ERM-IF was a key factor in the ERM introduction stage statically.…”

“…Choo and Goh (2015) showed that when firms adopt the Six Sigma Define-Measure-Analyze-Improve-Control (DMAIC) system, they could smoothly introduce ERM. Karanja (2017) revealed that 95 out of 122 US companies developed ERM in accordance with COSO's ERM-IF and ISO 31000. This result differs from that of Paape and Speklé (2012), and whether or not firms introduce ERM by applying COSO's ERM-IF or ISO 31000 may depend on the country.…”

The Mediating Effect of Top Management Support on the Relationship between Organizational Culture and Enterprise Risk Management Effectiveness among Malaysian Public Listed Companies: A Conceptual Framework

“…ERM was defined as the management of operational and financial risks simultaneously in order to maximize the costeffectiveness of risk management within the constraints of the organization's tolerance for risk (Kleffner, Lee, & McGannon, 2003). There are two main industry-sanctioned ERM models, that is, COSO 2004 and ISO 31000:2009, that organizations refer to when implementing ERM programs (Karanja, 2017).…”

The Effect of Internal Control Factors on the Accountability of the Auditor at the Inspectirate of Jombang District

“…Control environment is an individual atmosphere in an organization in conducting activities and carrying out responsibility for control in its field (Rendon & Rendon, 2016;Tauringana & Mangena, 2012). Management risk assessment as a part in designing and implementing internal controls to minimize errors and fraud within an organization (de Zwaan, Stewart, & Subramaniam, 2011;Karanja, 2017). Control activities are policies and procedures developed by the organization to face risks in order to achieve organizational goals (Rama & Jones, 2008).…”