Enterprise Risk Management and Risk Culture in Construction Public Listed Companies
Main Article Content
Abstract
Inadequate risk management and lack of risk culture can expose a company to unexpected risk events, which can negatively affect its performance. However, there are inconsistencies in suitable dimensions to measure the enterprise risk management (ERM) construct, as well as insufficient embedding strategies for risk culture. This study aims to identify the ERM practices and risk culture dimensions among the Malaysian construction public listed companies (PLCs). The roles of top management and chief risk officer/risk manager in influencing ERM and risk culture are also explored. A total of 46 annual reports and 10 interviews of industry practitioners were analysed using content analysis. The analysis of the annual reports found that risk policy and risk appetite/tolerance, monitoring key risk and accountability are the three dimensions of risk culture. In addition, based on the interviews, reward and recognition and internal relationships were identified as the two dimensions of risk. Top management and risk manager were found to be the primary drivers of ERM programme and risk culture in construction PLCs. The results of this study are used to formulate a survey instrument for the subsequent data collection to test the proposed theoretical model.
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
References
Akintoye, A. and MacLeod, M.J. (1997). Risk analysis and management in construction. International Journal of Project Management, 15(1): 31–38. https://doi.org/10.106/S0263-7863(96)00035-X.
Althonayan, A., Killackey, H. and Keith, J. (2012). ERM culture alignment to enhance competitive advantage. In Enterprise Risk Management Symposium. Washington DC: Casualty Actuarial Society, Professional Risk Managers' International Association and Society of Actuaries. Available at: https://web.actuaries.ie/sites/default/files/ermresources/keith_althonayan_killackey_paper_03_07_12.pdf
AS/NZS (Australia/New Zealand Standard) (2009). Risk Management: Principles and Guidelines. AS/NZS ISO 31000:2009. Sydney/Wellington: AS/NZS.
Ashby, S., Palermo, T. and Power, M. (2013). Risk Culture in Financial Institutions: A Research Report. London: London School of Economics and Political Science. Available at:
http://www.lse.ac.uk/accounting/CARR/pdf/Final-Risk-CultureReport.pdf.
Aureli, S. and Salvatori, F. (2012). An investigation on possible links between risk management, performance measurement and rewards schemes. Accounting and Management Information Systems, 11(3): 306–334. Available at: ftp://ftp.repec.org/opt/ReDIF/RePEc/ami/articles/11_3_1.pdf
Banks, E. (2012). Risk Culture: A Practical Guide to Building and Strengthening the Fabric of Risk Management. London: Palgrave Macmillan.
Beasley, M., Pagach, D. and Warr, R. (2008). Information conveyed in hiring announcements of senior executives overseeing enterprise-wide risk management processes. Journal of Accounting, Auditing and Finance, 23(3): 311–332. https://doi.org/10.1177/0148558X0802300303.
Bertinetti, G.S., Cavezzali, E. and Gardenal, G. (2013). The effect of the enterprise risk management implementation on the firm value of European companies. Working paper no. 10/2013. Università Ca' Foscari Venezia. https://doi.org/10.2139/ssrn.2326195.
Botosan, C.A. (1997). Disclosure level and the cost of equity capital. The Accounting Review, 72(3): 323–349. https://doi.org/10.1002/mde.1256.
Boultwood, B. and Dominus, M. (2014). Developing an effective risk culture. Electric Perspectives, June: 57–60.
Bryman, A. and Bell, E. (2011). Business Research Methods. 3rd Ed. New York: Oxford University Press Inc.
Bugalla, J., Kallman, J., Lindo, S. and Narvaez, K. (2012). The new model of governance and risk management for financial institutions. Journal of Risk Management in Financial Institutions, 5(2): 181–193.
Bursa Malaysia (2012). Statement on risk management and internal control guidelines for directors of listed issuers. Available at: http://www.bursamalaysia.com/misc/system/assets/4053/rules_lr_guides_intcontguid.pdf
Callahan, C. and Soileau, J. (2017). Does enterprise risk management enhance operating performance? Advances in Accounting, 37: 122–139. https://doi.org/10.1016/j.adiac.2017.01.001.
COSO (Committee of Sponsoring Organizations of the Treadway Commission) (2004a). Enterprise risk management: Integrated framework, executive summary. Available at: https://www.coso.org/Publications/ERM/COSO_ERM_ExecutiveSummary.pdf.
(2004b). Enterprise risk management: Integrated framework, application techniques. Available at: https://www.coso.org/pages/erm-integratedframework.aspx.
CSA (Committee of Casualty Actuarial Society) (2003). Overview of Enterprise Risk Management. Raleigh, NC: CSA.
Dafikpaku, E. (2011). The strategic implications of enterprise risk management: A framework. Paper presented at the 2011 Enterprise Risk Management Symposium. Chicago, 14–16 March.
De Jonghe, F., Edelsten, M. and Xavier, I. (2013). The cultural revolution in risk management. Journal of Financial Perspectives, 1(1): 179–187.
Deloitte (2017). Global risk management survey, 10th edition. Available at: https://dupress.deloitte.com/dup-us-en/topics/risk-management/global-risk-management-survey.html.=
. (2015). Global risk management survey, 9th edition. Available at: https:// dupress.deloitte.com/dup-us-en/topics/risk-management/global-risk -management-survey-financial-services.html.
. (2012). Cultivating a risk intelligent culture: Understand, measure and strengthen. Available at: https://www2.deloitte.com/content/dam/Deloitte/us/Documents/center-for-corporate-governance/us-ccg-cultivating-a-risk -intelligent-culture-050212.pdf.
EY (Ernst & Young Global Limited) (2014). Shifting Focus: Risk Culture at the Forefront of Banking. Available at: http://www.ey.com/Publication/vwLUAssets/eyshifting-focus-risk-culture-at-the-forefront-of-banking/$FILE/ey-shifting-focusrisk-culture-at-the-forefront-of-banking.pdf.
. (2013). Remaking Financial Services: Risk Management Five Years After the Crisis. London: EY. Available at: http://www.ey.com/Publication/vwLUAssets/Remaking_financial_services:_risk_management_five_years_after_the_crisis/$FILE/Remaking_financial_services_risk_management_five_years_after_the_crisis.pdf.
Financial Stability Board (2014). Guidance on Supervisory Interaction with Financial Institutions on Risk Culture. London: Financial Stability Board. Available at: http://www.fsb.org/wp-content/uploads/140407.pdf.
Florio, C. and Leoni, G. (2017). Enterprise risk management and firm performance: The Italian case. British Accounting Review, 49(1): 56–74. https://doi.org/10.1016/j.bar.2016.08.003.
Gatzert, N. and Martin, M. (2013). Determinants and value of enterprise risk management: Empirical evidence from the literature. Risk Management and Insurance Review, 18(1): 29–53. https://doi.org/10.1111/rmir.12028.
Gatzert, N. and Schmit, J. (2015). Supporting strategic success through enterprisewide reputation risk management. Working paper.
Friedrich-AlexanderUniversity (FAU) of Erlangen-Nürnberg. Available at: https://www.vwrm.rw.fau.de/files/2016/05/ERM_2013-11-23_WP.pdf.
Golshan, N.M. and Siti Zaleha, A.R. (2012). Determinants of enterprise risk management adoption: An empirical analysis of Malaysian public listed firms. World Academy of Science, Engineering and Technology, 62: 453–460.
Grace, M.F., Leverty, J.T., Phillips, R.D. and Shimpi, P. (2014). The value of investing in enterprise risk management. Journal of Risk and Insurance, 82(2): 289–316. https://doi.org/10.1111/jori.12022.
Gupta, P.K. (2011). Risk management in Indian companies: EWRM concerns and issues. Journal of Risk Finance, 12(2): 121–139. https://doi.org/10 .1108/15265941111112848.
Hallowell, M.R., Molenaar, K.R. and Fortunato, B.R. (2013). Enterprise risk management strategies for state departments of transportation. Journal of Management in Engineering, 29(2): 114–122. https://doi.org/10.1061/(ASCE)ME.1943-5479.0000136.
Hardy, K. (2015). Enterprise Risk Management: A Guide for Government Professionals. San Francisco, CA: Jossey-Bass.
Hoyt, R.E. and Liebenberg, A.P. (2011). The value of enterprise risk management. Journal of Risk and Insurance, 78(4): 795–822. https://doi.org/10.1111/j.1539-6975.2011.01413.x.
Ingram, D., Underwood, A. and Thompson, M. (2014). Risk culture, neoclassical economics and ERM. Available at: https://www.soa.org/globalassets/assets/files/resources/essays-monographs/2014-erm-symposium/mono-2014-erm-ingram.pdf.
IRM (Institute of Risk Management) (2019a). From the Cube to the Rainbow Double Helix: A Risk Practitioner's Guide to the COSO ERM Frameworks. London: IRM. Available at: https://www.theirm.org/media/6885/irm-report-review-of-thecoso-erm-frameworks-v2.pdf.
. (2019b). A Risk Practitioners Guide to ISO 31000:2018. London: IRM. Available at: https://safety4tradies.co.nz/wp-content/uploads/2019/06/IRM-Report-ISO-31000-2018-v3.pdf.
. (2012). Risk Culture: Under the Microscope Guidance for Boards. London: IRM. https://doi.org/10.1057/9781137263728.
IRM, AIRMIC (Association of Insurance and Risk Manager) and ALARM (Public Risk Management Association) (2002). A Risk Management Standard. London: IRM, AIRMIC and ALARM.
ISO (International Standards Organizations) (2009). ISO 31000 Risk Management: Principles and Guidelines. Geneva: ISO.
Izah, M.T. and Ahmad, R.R. (2011). The relationship between ERM and firm value: Evidence from Malaysian public listed companies. International Journals Economics and Management Science, 1(2): 32–41.
Jackson, P. (2015). Understanding risk culture and its challenges. Banking Perspective, 2: 48–54. Keith,
J.L. (2014). Enterprise risk management: Developing a strategic ERM alignment framework-finance sector. PhD diss. Brunel University London.
Kimbrough, R.L. (2006). The relationship between perceptions of organizational culture and implementation of ERM. PhD diss. University of Alabama.
Kommunuri, J., Narayan, A., Wheaton, M., Jandug, L. and Gonuguntla, S. (2016). Firm performance and value effects of enterprise risk management. Journal of Applied Business Research, 14(2): 17–29.
Levy, C., Krivkovich, A., Ouali, M.E. and Graf, J. (2015). Managing the people side of risk: Risk culture transformation. Available at: https://www.mckinsey.com/media/McKinsey/dotcom/client_service/Risk/PDFs/Managing_the_people_ side_of_risk.ashx.
Liebenberg, A.P. and Hoyt, R.E. (2003). The determinants of enterprise risk management: Evidence from the appointment of chief risk officers. Risk Management and Insurance Review, 6(1): 37–52. https://doi.org/10.1111/1098-1616.00019.
Lloyd-walker, B.M., Mills, A.J. and Walker, D.H.T. (2014). Enabling construction innovation: The role of a no-blame culture as a collaboration behavioural driver in project alliances. Construction Management and Economics, 32(3): 229–245. https://doi.org/10.1080/01446193.2014.892629.
Lundqvist, S.A. (2014). An exploratory study of enterprise risk management: Pillars of ERM. Journal of Accounting, Auditing and Finance, 29(3): 393–429. https://doi.org/10.1177/0148558X14535780.
Majid, J.K., Dildar, H. and Waqar, M. (2016). Why do firms adopt enterprise risk management (ERM)? Empirical evidence from France. Management Decision, 54(8): 1886–1907. https://doi.org/10.1108/09564230910978511.
McConnell, P.J. (2013). A risk culture framework for systematically important banks. Journal of Risk and Governance, 3(1): 24–67.
McGing, S. and Brown, A. (2014). Risk culture leadership, measurement and management: A comparison across industries. Available at: https://www.actuaries.asn.au/Library/Events/FSF/2014/BrownMcGIng.pdf.
McShane, M.K., Anil, N. and Rustambekov, E. (2011). Does enterprise risk management increase firm value? Journal of Accounting, Auditing and Finance, 26(4): 641–658. https://doi.org/10.1177/0148558X11409160.
Meek, G.K., Roberts, C.B. and Gray, S.J. (1995). Factors influencing voluntary annual report disclosures by US, UK and Continental European multinational corporations. Journal of International Business Studies, 26(3): 555–572. https://doi.org/10.1057/palgrave.jibs.8490186.
Mikes, A. (2014). The triumph of the humble CRO. Available at: https://doi.org/10.13140/2.1.4913.3124.
Mikes, A. and Kaplan, R.S. (2014). Towards a contingency theory of enterprise risk management. Available at: https://doi.org/10.2139/ssrn.2311293.
Mills, A. (2001). A systematic approach to risk management for construction. Structural Survey, 19(5): 245–252.
Ng, T., Chong, L. and Ismail, H. (2012). Is the risk management committee only a procedural compliance?: An insight into managing risk taking among insurance companies in Malaysia. The Journal of Risk Finance, 14(1): 71–86. https://doi.org/10.1108/15265941311288112.
Norlida, A.M., Isahak, K. and Mohd, R.H. (2010). Enterprise-wide risk management (EWRM) practices: Between corporate governance compliance and value. International Review of Business Research Papers, 6(2): 239–252.
Paape, L. and Speklé, R.F. (2012). The adoption and design of enterprise risk management practices: An empirical study. European Accounting Review, 21(3): 533–564. https://doi.org/10.1080/09638180.2012.661937.
Protiviti (2014a). Establishing and Nurturing an Effective Risk Culture. California: Protiviti Inc. Available at: https://www.protiviti.com/sites/default/files/united_states/insights/cro-series4-establishing-and-nurturing-an-effective-risk-culture-protiviti.pdf.
. (2014b). Board Perspectives: Risk Oversight. California: Protiviti Inc. Available at: https://www.protiviti.com/sites/default/files/united_states/insights/board-perspectives-risk-oversight-issue50-5-risk-oversight-questions-protiviti.pdf.
. (2012). Risk Culture: Not A Tick-Box Exercise. California: Protiviti Inc. Available at: https://web.actuaries.ie/press/erm-resource-database/risk-culture-not-just-tick-box-exercise-survey
Protiviti and RMA (Risk Management Association) (2014). Risk culture from theory to evolving practice. The Risk Management Association Journal, January: 24–26.
Ring, P.J., Bryce, C., McKinney, R. and Webb, R. (2016). Taking notice of risk culture: The regulators approach. Journal of Risk Research, 19(3): 364–387. https://doi.org/10.1080/13669877.2014.983944.
Roeschmann, A.Z. (2014). Risk culture: What it is and how it affects an insurer's risk management. Risk Management and Insurance Review, 17(2): 277–296. https://doi.org/10.1111/rmir.12025.
Saudah, A., Ng, C. and McManus, L.A. (2014). Enterprise Risk Management (ERM) implementation: Some empirical evidence from large Australian companies. Procedia – Social and Behavioral Sciences, 164: 541–547. https://doi.org/10.1016/j.sbspro.2014.11.144.
Sayilir, Ö. and Farhan, M. (2017). Enterprise risk management and its effect on firm value in Turkey. Journal of Management Research, 9(1): 86–99. https://doi.org/10.5296/jmr.v9i1.10124.
Schein, E.H. (2004). Organisational Culture and Leadership. 3rd Ed. San Francisco, CA: Jossey-Bass Inc.
Securities Commission Malaysia. (2017). Malaysian Code on Corporate Governance 2017. Kuala Lumpur: Securities Commission Malaysia. Available at: https://www.sc.com.my/api/documentms/download.ashx?id=70a5568b-1937-4d2b-8cbf-3aefed112c0a.
Smart, A. and Creelman, J. (2013). Defining strategy: The question of appetite. In A. Smart and J. Creelman (eds.), Risk-Based Performance Management: Integrating Strategy and Risk Management. Hampshire, UK: Palgrave Macmillan, 85–120.
Soltanizadeh, S., Siti Zaleha, A.R., Golshan, N., Quoquab, F. and Rohaida, B. (2014). Enterprise risk management practices among Malaysian firms. Procedia – Social and Behavioral Sciences, 164: 332–337. https://doi.org/10.1016/j.sbspro.2014.11.084.
Spr?i?, D.M., Kožul, A. and Pecina, E. (2017). Managers' support: A key driver behind enterprise risk management maturity. Zagreb International Review of Economics and Business, 20(S1): 25–39. https://doi.org/10.1515/zireb-2017-0003.
Tao, N.B. and Hutchinson, M. (2013). Corporate governance and risk management: The role of risk management and compensation committees. Journal of Contemporary Accounting and Economics, 9(1): 83–99. https://doi.org/10.1016/j.jcae.2013.03.003.
Tapestry Networks Inc. (2014). Developing effective and sustainable risk cultures in banks. Bank Governance Leadership Network ViewPoints, 29 May. Available at: http://www.ey.com/Publication/vwLUAssets/EY-Developing-effective-and-sustainable-risk-cultures/$FILE/EY-ViewPoints-Developing-effective-and-sustainable-risk-cultures-in-banks.pdf.
. (2012). Progress on the risk governance journey, but key challenges remain. Bank Governance Leadership Network ViewPoints, 12 January. Available at: http://www.ey.com/Publication/vwLUAssets/What_lies_ahead_on_the_bank_risk_governance_journey/$FILE/BGLNViewPoints_12_January_2012.pdf.
Taylor, L. (2014). Practical Enterprise Risk Management: How to Optimise Business Strategies through Managed Risk Taking. London: Kogan Page Limited.
Teoh, A.P. and Muthuveloo, R. (2015). The impact of enterprise risk management on firm performance: Evidence from Malaysia. Asian Social Science, 11(22): 149–159. https://doi.org/10.5539/ass.v11n22p149.
Zhao, X., Hwang, B.G. and Low, S.P. (2014a). Investigating enterprise risk management maturity in construction firms. Journal of Construction Engineering Management, 140(8): 05014006. https://doi.org/10.1061/(ASCE)CO.1943-7862.0000873.
. (2014b). Enterprise risk management implementation in construction firms: An organizational change perspective. Management Decision, 52(5): 814–833. https://doi.org/10.1108/MD-02-2014-0082.
. (2013). Critical success factors for enterprise risk management in Chinese construction companies. Construction Management and Economics, 31(12): 1199–1214. https://doi.org/10.1080/01446193.2013.867521.
. (2012). Implementing ERM in Chinese construction firm based in Singapore. In S. Senaratne and Y.G. Sandanayake (eds.), World Construction Conference: Global Challenges in Construction Industry. Colombo, Sri Lanka: Building Economics and Management Research Unit, Department of Building Economics, University of Moratuwa, 434–444.