This article looks at challenges of risk management in modern firms. We review the different types of risk, the external and internal forces that shape risk exposures in firms, and the individual and group biases that confound decision making. Next we discuss the need for an enterprise-wide approach to risk management. The critical organisational factors for implementing an integrated approach to managing risk exposures are presented. These include the five pillars of ‘culture’, ‘leadership’, ‘alignment’, ‘structure’, and ‘systems’. We provide an overview of relevant tools and techniques for integrating risk management with business policy and governance. Finally, some implications for organisational change management are considered.
Get full access to this article
View all access options for this article.
References
1.
AlessandriT. M. and BettisR. A. (2003), ‘Surviving the bulls and the bears: Robust strategies and shareholder wealth’, Long Range Planning, 36 (1), pp. 13-35.
2.
BairdI. S. and ThomasH. (1985), ‘Towards a contingency model of strategic risk taking’, Academy of Management Review, 10 (2), pp. 230-243.
3.
BaucusD. A.GolecJ. H. and CooperJ. R. (1993), ‘Estimating risk-return relationships: An analysis of measures’, Strategic Management Journal, 14 (5), pp. 387-397.
4.
BazermanM. H. and WatkinsM. D. (2004), Predictable surprises, Boston: Harvard Business School Press.
5.
BowmanE. H. (1980), ‘A risk/return paradox for strategic management’, Sloan Management Review, 21 (3), pp. 17-31.
6.
ChatterjeeS.WisemanR. M.FiegenbaumA. and DeversC. E. (2003), ‘Integrating behavioural and economic concepts of risk into strategic management: The twain shall meet’, Long Range Planning, 36 (1), pp. 61-79.
7.
ChooC. W. (2005), ‘Information failures and organisational disasters’, Sloan Management Review, 46 (3), pp. 8-10.
8.
CreamerG. and FreundY. (2004), ‘Predicting performance and quantifying corporate governance risk for Latin American ADRs and Banks’, Proceedings of the Second IASTED International Conference on Financial Engineering and Applications, Cambridge, MA, pp. 91-101.
9.
CroweT. J.FongP. M.BaumanT. A. and Zayas-CastroJ. L. (2002), ‘Quantitative risk level estimation of business process reengineering efforts’, Business Process Management Journal, 8 (5), pp. 490-512.
10.
DrewS. A. W. (1994), ‘BPR in financial services: Factors for success’, Long Range Planning, 27 (5), pp. 25-41.
11.
DrewS. A. W.KelleyP. C. and KendrickT. (2006), ‘CLASS: Five Elements of corporate governance to manage strategic risk’, Business Horizons, 49 (1/2), to appear.
12.
EisenmannT. R. (2002), Internet business models: text and cases, New York: McGraw-Hill Irwin.
13.
FarrellJ. (2004), ‘Internal controls and managing enterprise-wide risks’, The CPA Journal, 74 (8), pp. 11-13.
14.
FiegenbaumA. and ThomasH. (2004), ‘Strategic risk and competitive advantage: An integrative perspective’, European Management Review, (1), pp. 84-95.
15.
FerrisG. J. (2002), ‘Response and recovery at Morgan Stanley’, Risk Management, 49 (12), pp. 24-28.
16.
KahnmenanD. and TverskyA. (1979), ‘Prospect theory: An analysis of decisions under risk’, Econometrica, 47, pp. 263-291.
17.
KahnemanD.SlovicP. and TverskyA. (1982), Judgment under uncertainty: Heuristics and biases, Cambridge: Cambridge University Press.
18.
KahnemanD. and TverskyA. (2000), Choices, values and frames.Cambridge: Cambridge University Press.
19.
KendrickT. (2004), ‘Strategic risk: Am I doing OK?’, Corporate Governance, 4 (4), pp. 69-77.
20.
KnightF. H. (1921), Risk, uncertainty and profit, New York: Harper & Row.
21.
LamJ. (1999), ‘A new role: Chief risk officer’, Ivey Business Journal, 64 (2), pp. 55-62.
22.
LamL. (2001), ‘Top ten requirements for operational risk management’, Risk Management, 48 (11),p. 1.
23.
McNamaraG. and BromileyP. (1999), ‘Risk and return in organisation decision making’, Academy of Management Journal, 42 (3), pp. 330-340.
24.
MillerK. D. and ReuerJ. R. (1996), ‘Measuring organisational downside risk’, Strategic Management Journal, 17 (9), pp. 671-692.
25.
NoyE. and SchmuelE. (2003), ‘Corporate risk strategy: Does it vary across business activities?’, European Management Journal, 21 (1), pp. 19-129.
26.
NuttP. (2002), Why decisions fail, San Francisco: Berrett-Koehler.
27.
PalmerT. B. and WisemanR. M. (1999), ‘Decoupling risk taking from income stream uncertainty: A holistic model of risk’, Strategic Management Journal, 20 (11), pp. 1037-1062.
28.
SandersW. G. and BoivieS. (2004), ‘Sorting things out: Valuations of new firms in uncertain markets’, Strategic Management Journal, 25 (2), pp. 167-186.
29.
SengeP. (1990), The fifth discipline: The art and practice of the learning organisation, New York: Currency Doubleday.
30.
ShapiraZ. (1997), Risk taking: A managerial perspective, New York: Sage.
31.
ShohamA. and FiegenbaumA. (2002), ‘Competitive determinants of organisational risk taking attitude: The role of strategic reference points’, Management Decision, 40 (1), pp. 127-141.
32.
SimonsR. (1999), ‘How risky is your company?’, Harvard Business Review, 77 (3), pp. 85-95.
33.
SimonsR. (1995), Levers of control.Boston: Harvard Business School Press.
34.
SitkinS. B. and PabloA. L. (1992), ‘Reconceptualizing the determinants of risk behaviour’, Academy of Management Review, 17 (1), pp. 9-39.
35.
SlywotzkyA. J. and MorrisonD. J. (2001), The profit zone, Chichester: Wiley.
36.
VeliyathR.HermansonH. M. and HermansonD. R. (1997), ‘Organisational control systems: Matching controls with organisational levels’, Review of Business, 18 (2), pp. 20-25.
37.
WangH.BarneyJ. B. and ReuerJ. J. (2003), ‘Stimulating firm-specific investment through risk management’, Long Range Planning, 36 (1), pp. 49-59.
38.
WeickK. E. and SutcliffeK. M. (2001), Managing the unexpected: Assuring high performance in an age of complexity, San Francisco: Jossey Bass.
39.
ZahraS. A. (1999), ‘The changing rules of global competitiveness in the 21st century’, The Academy of Management Executive, 13 (1), pp. 36-43.
