COSO Enterprise Risk Management Framework Research Articles

Assessment of Reputational Risk Management Maturity Levels of Banks

Due to the nature of their activities, reputational risk is one of the main risks that should be managed for banks. Since corporate reputation is an intangible asset, it is extremely difficult to measure reputational risk. On the other hand, the maturity level of banks for the management of reputational risk is extremely important in terms of reducing the effects of reputational losses that may be exposed. The aim of this study is to develop a framework for evaluating the maturity level of reputational risk management in banks. For this purpose, based on the COSO Enterprise Risk Management Framework, the attributes that can be used in the evaluation of the reputational risk maturity level, the values related to these qualifications and the evaluation criteria for each attribute are defined. In addition, 5 different maturity levels were created for banks according to the total score obtained by combining the values calculated for each attribute, taking into account Bak and Jedynak (2023). This proposed framework can be used as a framework in which banks can evaluate themselves and legal authorities can evaluate banks in terms of determining the maturity level of reputational risk management.

The Effect of Enterprise Risk Management and Environmental Performance Toward Corporate Social Responsibility Disclosure (CSRD): Study in Mining Sector

The population is 47 Mining companies in IDX 2016-2018. Have PROPER rating and published annual report. The purpose to examine the effect of enterprise risk management(ERM) and environmental performance (EP) toward CSR Disclosure. Data were obtained from 63 samples and used sample selection method, purposive sampling method and IBM SPSS 26. The analysis statistic used is multiple linear regression analysis method. The ERM used COSO ERM Framework to disclosure 108 items, EP used PROPER rating represent in 5 ranking and CSRD used GRI G4 CSR index consisting 91 items, 3 categories. The study result shows that ERM have positive and significant effect on CSRD, while EP does not have significant affect on CSRD.

Enterprise Risk Management Practices in Kenya

Enterprise Risk Management (ERM) is a structured and coordinated approach for identifying, assessing, and managing risks faced by an organization. Implementing ERM standards and frameworks has several benefits, including improving focus and perspective on risk. ERM aids in developing leading indicators to detect potential risk events and provide early warning signals. ERM also incorporates key metrics and measurements of risk to improve reporting value and analysis and monitor possible changes in risk vulnerabilities or likelihood. An ERM facilitates an efficient risk management (RM) process, allowing businesses to manage risks efficiently across various departments through a robust risk management framework. This framework includes the related department’s team, working rules, and operational tools, covering all types of risks, including financial, strategic, operational, and accidental losses. The primary advantage of ERM is its ability to create a systematic and intentional process for identifying and addressing risks, treating risk management as a structured exercise where liabilities are addressed as part of a comprehensive framework rather than ad-hoc problem-solving. ISO 31000, NIST risk management framework, and COSO ERM framework are widely used frameworks for managing enterprise risks. Implementing a robust enterprise risk management standard has a positive relationship with business performance.

Review of Literature on Methodological Approaches of Assessing the Adoption of Enterprise Risk Management Practices

This study intends to examine the previous researches on Enterprise Risk Management (ERM). On examining the previous researches, it is evident that both primary data based (using robust models) and secondary data based (using Dummy variables) approaches adopted by the previous researchers and those are taken into account and have been reviewed in this paper. In here, researchers have identified that most of the recent studies have used robust models in assessing the adoption of ERM practices, while earlier researchers used dummy variables in assessing ERM practices. Here, in some cases, there are some contradictories of results of the studies in two approaches. Based on the recommendations, conclusions of prior research, and the analysis of the available literature, it has been recommended to use robust models like COSO ERM framework, ISO 31000 etc. in case of assessing the adoption of ERM practices in future studies.

COSO ERM Framework as the Basis of Strategic Planning in Islamic Banking

In digital era, every business entities must prepare a competitive strategy to compete with other competitors. Therefore, this study aims to provide management systems that can assist management in creating a competitive advantage. This study will describe the effect of Enterprise Risk Management (ERM) in strategic planning for Islamic banking use COSO ERM Framework approach. This study uses quantitative analysis method with purposive sampling technique on employees of Bank Syariah Mandiri (BSM) branch offices in DKI Jakarta. Descriptive analysis methods and verification analysis used to test hypotheses and structural models with the Smart Partial Least Square (PLS) program version 3.3.7. The results show that the ERM variable has a positive effect on strategy planning at Bank Syariah Mandiri (BSM). Strategic planning in BSM is 72.5% influenced by the risk management carried out by the company. In the strategic planning, management has made risk management report as a basis for analysis of the internal and external company. DOI: https://doi.org/10.26905/jkdp.v25i1.5123

Relationship Balanced Scorecard and COSO 2013 Risk Management to Improve Performance: A Case Study on BPR Chandra Mukti Artha Bank

In the 21st century companies, especially in financial institutions (banks) face a complex business environment, full of opportunities, but pitted with risks, where they must make effective business decisions, improve interpersonal relationships, fulfill community obligations with the right strategy and managing risk. To overcome these challenges, companies need management tools that can help companies achieve their goals. In a very simple application, BPR Chandra Mukti Artha applies the Balanced Scorecard (BSC) and COSO Enterprise Risk Management (ERM) framework as a tool to link strategic objectives into the COSO ERM framework. They link high-level corporate strategies determined by top-level management with the daily activities of employees in the organization. Surprisingly, most companies view BSC and COSO ERM as separate and unrelated management initiatives. In this research, I study the feasibility of linking BSC with COSO ERM 2013, a framework for sophisticated risk management, similar to how BSC can be integrated with various business management frameworks and methods. The integration of these two management tools (BSC and COSO ERM Framework) is a natural step in the evolution of bank management to improve bank financial performance.

Why risk management frameworks fail to prevent wrongdoing

PurposeThe purpose of this paper is to consolidate research in whistleblowing, wrongdoing prevention and enterprise risk management (ERM) frameworks with the goal of creating a more comprehensive and effective framework for the prevention of wrongdoings.Design/methodology/approachA gap analysis based on organizational learning theory (OLT) is performed between the research fields of whistleblowing, wrongdoing prevention and ERM to identify enhancements that are needed for effective wrongdoing prevention.FindingsERM is an incomplete framework for wrongdoing prevention which omits the components of prevention and learning. A culture of continuous learning is required to minimize the experience component of learning and maximizing sharing. Storytelling can be used to protect individuals and provide transparency. The stakeholder dimension must be expanded beyond the borders of the legal entity to include all stakeholders. Every stakeholder experiences the climate of wrongdoing prevention differently, and the evaluation of these different perspectives is essential in establishing a culture of prevention. Personal psychological safety is a critical element in empowering stakeholders to discuss and address wrongdoings. Standards established through professional associations enable innovations to diffuse more quickly throughout society than legislation. Standards and standard setting processes that are able to adapt to changes in societal expectations proactively help organizations to independently protect stakeholders. Global standards are needed to overcome incongruences between countries and cultures.Research limitations/implicationsThe effectiveness of a prevention framework is difficult to measure. Declining incidence of wrongdoing within an institution is an incomplete picture. Rare and severe types of wrongdoing, and their prevention throughout society should require a more concerted, centralized approach which could be modeled upon the health system’s national centers for disease prevention. By combining the dimensions of the learning organization questionnaire(Marsick and Watkins, 2003) and Whistleblowing and Wrongdoing statistics, organizations should be able to develop complex KPIs and be able monitor their development over time. Researchers should be able to use the same strategy to confirm the assertions made here will improve the safety and security of all stakeholders.Practical implicationsOrganizations which use ERM frameworks may be unable to effectively prevent wrongdoings and protect stakeholders from the consequences of such wrongdoings. The shortcomings identified here provide specific clear points that organizations can address to be more effective in preventing wrongdoings. Any one of these actions and the scope of their impact within the organization and their environment represent substantial challenges for all stakeholders. Like the ascent of a great mountain, the planning of the each step taken and thorough understanding of the challenges faced along the path to each waypoint are essential to reach the summit and the achieve the objective.Social implicationsThis paper advocates for changes that may take decades or generations to fully accept: inter-organizational sharing; stronger use of guidelines instead of legislation; and enhanced transparency on all organizational levels. The resources required to drive change on this scale are considerable with the private sector and public sectors having unique needs and requiring potentially different approaches.Originality/valueThe novelty lies in the identification of shortcomings in ERM frameworks to effectively prevent wrongdoing, through the integration of OLT, Whistleblowing and Wrongdoing Literature and the COSO Enterprise Risk Management Framework.

Impact of Enterprise Risk Management Practices on Performance of Insurance Companies in Sri Lanka

Enterprise risk management (ERM) has gained an increasing attention among the corporate managers in the recent past as a strategic approach to managing risk. This study empirically verifies whether the adoption of ERM has an impact on firm performance and uses both primary and the secondary data relating to the Sri Lankan insurance companies. 230 executive level employees from 26 Sri Lankan insurance companies have been selected as the sample of this study using stratified random sampling technique and primary data were collected using a structured questionnaire. Return on Assets (ROA) and Tobin’s Q are used as proxies to measure the firm performance and ERM practices have been measured based on the guidelines of COSO ERM framework. Descriptive statistics, Correlation analysis and regression analysis are used to analyze data. Results of the mean testing reveals that three components of COSO ERM framework namely, Internal Environment, Objective setting and Risk Assessment indicate a high level of practice. Further, correlation analysis indicates two independent variables namely, control environment and Information & communication have a significant relationship with ROA. At the same time, two independent variables namely, objective setting and Information & communication have a significant relationship with Tobin’s Q. Hypotheses testing identified that Control activities; Information & communication and monitoring are the most crucial variables which have a positive impact on the performance of the insurance industry. These results indicate that, even though the level of implementation of ERM practices in Sri Lankan insurance industry is moderate / high levels, the other than Control activities, Information & communication and monitoring all other five components are not showing significant impact towards the performance. It implies that the expected value addition from the ERM practices have not been achieved by the Sri Lankan insurance companies yet. Findings of this study contributes methodologically as researcher used robust model to measure ERM practices and the results may be helpful to Insurance companies in Sri Lanka to improve their ERM practices and to adopt efficient strategies to improve firm financial performance through the implementing proper ERM practices.

Research on Risk Assessment of International Factoring Financing Business: Illustrated by the Example of Bank A Zhejiang Branch

This thesis studies on the international factoring financing business of Bank A Zhejiang Branch. It reviews the course of concentrated outbreak and responses of risks since 2012, and by taking the examples of two typical risk events, reveals the decision making process of risk control measures and the deficiencies existing in practice, which leads to the predicament of the business. Then it brings up the question of how to do a good job in the risk assessment of international factoring financing business. Based on the case content, this thesis, introduces the eight management elements in the COSO enterprise risk management framework as theoretical basis, analyzing the item identification and risk assessment on the international factoring business matters of Bank A. With the above overall analysis, this thesis proposes to improve risk assessment efficiency by using COSO enterprise management framework and asymmetric theory.

Corporate governance and the information system: how a framework for IT governance supports ERM

Purpose – The purpose of this paper is to illustrate how information technology (IT) governance supports the process of enterprise risk management (ERM). In particular, the paper illustrates how the Control Objectives for Information and related Technology (COBIT) framework helps a company reach its objectives by integrating and supporting the Enterprise Risk Management by the Committee of Sponsoring Organizations (COSO ERM) framework. Design/methodology/approach – This paper explains how the integration between the two frameworks (COSO ERM and COBIT 5) can represent, for any organization, a good way to achieve the objectives of internal control and risk management and, more generally, corporate governance. Findings – The paper identifies some gaps in the COSO ERM and illustrates how the COBIT framework facilitates the implementation of an adequate system of internal control. Originality/value – The originality of the work presented here is in analyzing the COBIT 5 together with the COSO ERM framework. This paper highlights that is not enough to apply only an internal control framework for achieving the risk management and internal control system objectives. An IT governance framework, such as COBIT 5 is proposed as a tool that support risk management in order to develop an adequate system of internal control.

A comprehensive investigation of the applicability of process mining techniques for enterprise risk management

Process mining techniques and tools perfectly complement the existing set of enterprise risk management approaches. Enterprise risk management aims at minimizing the negative effects of uncertainty on the objectives, while at the same time promoting the potential positive effects. Process mining research has proposed a broad range of techniques and tools that could be used to effectively support the activities related to the different phases of risk management.This paper contributes to the process mining and risk management research by providing a full exploration of the applicability of process mining in the context of the eight components of the COSO Enterprise Risk Management Framework. The identified applications will be illustrated based on the risks involved in insurance claim handling processes.

The Enterprise Risk Management (ERM) and role of internal auditors in the ERM implementation: A review of related literature on measurement instruments

The primary objective of this study is to comprehensively review the literature concerning existing instruments on the measures of the ERM implementation and roles of internal auditing (IA) in the Enterprise Risk Management (ERM) implementation. The study involves review of existing ERM instruments from 2001 to 2011. The present instrument were critically reviewed in which the contributions and limitations of each is appropriately identified and summarized. The review identified four main limitations of the existing ERM instruments that limit its applicability in academic setting. First, there is no consistency on the attributes used to tap the construct, that is, the ERM. Second, most of the instruments were not based on any well accepted ERM framework. Third, almost all of the instruments do not incorporate the roles of IA in the ERM. Finally, all of the instruments do not attempt to appropriately quantify the measurement of the ERM and this is evidenced by the use of categorical scales. This review could add value to academic research by providing analysis, comments and summary of various ERM instruments for ten years. This may assist more studies in this area that currently lack academic-based measurement tools. This present review could be among the significance source of reference for academic research especially on the measurement of the ERM implementation and IA roles in the implementation. It also could serve as guidance for the development of new academic-based instrument. Further, this review offers new solution to critical research questions concerning the structure, framework and measurement procedures. Key words: Enterprise risk management (ERM), internal auditing (IA), IA roles, COSO ERM framework, corporate governance, risk assessment tools.

Enterprise Risk Management For Fishing Tournaments

The fishing tournament industry is confronted with many of the same risks as other industries (such as financial statement misstatements), share some risks specific with others (such as cheating in casinos), and face some unique risks (such as the risk of competitors adding weight to fish).This teaching case explores some of the risks inherent in the fishing tournament industry. Students are given background information about a how a tournament operates and then asked to perform an overall risk assessment using the COSO enterprise risk management framework. Elements of the assignment include assessing the internal environment, setting of objectives, and then identifying, prioritizing, and responding to risks. Students are also asked to make recommendations for improving the information and communications process and for improving monitoring activities.The case contains the following elements:Case Narrative Instructors ManualCase ObjectivesBasic Pedagogy (course, level, position in the course, prerequisite knowledge)Teaching MethodsCase SummaryKey IssuesDiscussion questions and suggested responsesTeaching TipsInstructor TablesHandoutsEpilogueThe case is suited for use in several business courses at the undergraduate or graduate level. It can be used in part or in its entirety, and can be adjusted for difficulty levels. It is also adaptable to any of the major risk management models.

On how to understand and express enterprise risk

In this paper, we address the problem of describing enterprise risk. Several international standards on risk management provide guidelines for this purpose, including the COSO enterprise risk management framework which defines risk as the possibility that an event will occur that adversely affects the achievement of objectives, and the ISO standard on risk management which defines risk as the effect of uncertainty on objectives. However, these perspectives on risk can be challenged, in particular the idea of founding the concept of risk on meeting defined objectives. Our concern is that such a perspective could easily lead to the wrong focus – meeting some more or less arbitrary objectives rather than finding the overall best solutions and measures from a value creation point of view. In the paper we argue that the consequence dimension of risk is better expressed by some impact or severity scales, in line with risk perspectives stating that risk has two main components: 1 the impact of events and consequences (outcomes) 2 the associated uncertainties (probabilities). An example case of a large oil company is used to illustrate the ideas and perspectives.

Risk Management at Crunch Time: Are Chief Risk Officers Compliance Champions or Business Partners?

Risk management departments in financial institutions have been undergoing major transformations. New regulatory requirements have raised the bar on compliance and expanded the remit of risk management significantly. The compliance imperative requires banks to implement a firm-wide risk management framework complete with analytical models for the measurement and control of quantifiable risks. In addition, recent corporate governance guidelines advocate the 'business partner' role of risk management. The COSO Enterprise Risk Management framework (2004) explicitly defines risk management as a high-level strategic activity, contributing to board-level decision making, planning and performance management. This role requires that senior risk officers possess an understanding of key strategic uncertainties, and that they communicate these to senior management and the business lines. But how do senior risk officers strike a balance between the twin roles of compliance champion and business partner? Too much reliance on the regulatory crutch may erode the credibility of the risk function as a business partner, while too much emphasis on the business advisory function might weaken its policing capability. In this paper, I assess the roles that risk functions and, in particular, senior risk officers play in fifteen international banks. Because the research was carried out between June 2006 and June 2007, it offers a rare snapshot of the 'calm before the storm' - the state of risk management at fifteen large players before the liquidity and credit crunch became apparent in the second half of 2007. The findings suggest that the role of chief risk officers (CROs) had expanded dramatically, with more than half of them frequently involved in firm-level strategic decisions. However, various compliance and risk modeling initiatives were still works-in-progress in the majority of these large international banks at the onset of the market turmoil. CROs voiced divergent views on the uses, benefits and limitations of risk models, suggesting that they promoted different 'calculative cultures' (quantitative enthusiasm versus quantitative skepticism). Strategically involved CROs therefore interpreted the business-partner role of their function in different ways. Some risk functions aspired for an influential expert voice in key business decisions (the risk function as strategic advisor), while others strived for the formal integration of risk management with performance management (the risk function as strategic controller). The achievement of the Strategic Advisor role in some banks and the Strategic Controller role in others, calls for a clarification of stakeholder expectations on risk management. This would reduce the danger of an expectations gap opening around particular risk management approaches that are adequate for certain banks but ill-suited for others.

The COSO ERM framework: a critique from systems theory of management control

COSO's (2004) framework on Enterprise Risk Management (ERM) makes a valuable contribution to the emerging practice of ERM, but suffers serious limitations. It fails to provide a workable standard for identifying ERM effectiveness. Its definition of 'risk' diverts attention from opportunities and from uncertainties that fall outside its closed rational systems perspective. By taking a command and control approach, it ignores shared management of uncertainties with external parties and social implications of ERM. As a result, threats will be created if this framework is widely followed, which seems likely as ERM is institutionalised within regulations, professional practice and expected norms of good management.