This study examines the strategic and tactical measures companies exploit as a source of competitive advantage to outlive risk challenges and to seize the attendant opportunities in a volatile economic environment. Results from a series of in-depth interviews with senior executives of Hong Kong-based successful enterprises in the textile and apparel industry show that the participant companies have, though not under the banner of enterprise risk management (ERM), adopted to varying extents a proactive, enterprise-wide and holistic approach to combat and manage risks. The findings of the ERM maturity analysis attest that the tendency to use formal approaches to manage risk issues is positively related to an organization's size, scope of operations, and legal structure. The analyses also underpin that effective enterprise risk management should embrace proactive, future and external oriented strategic initiatives that create and enhance organizational resilience through the involvement of internal as well as external stakeholders.
TopIntroduction
Business is about creating and maximizing the value of investments by implementing effective strategies and taking risks. Competing in an environment swarming with both known and unknown risks, it is imperative for organizations today, both large and small, to address various uncertainties and the associated myriad of risks, which vary substantially in their nature, quantity and complexity (Hallikas, Virolainen, & Tuominen, 2002). Risks, classified in a variety of ways (e.g. Rogachev, 2008; Muzzy, 2008; Walker, Shenkir, & Barton, 2002), are traditionally defined as uncertain events or actions that may diminish or interfere with an organization’s ability to achieve its business objectives and hence are to be avoided or reduced (Frigo & Anderson, 2011; Damodaran, 2008). Traditional risk management, therefore, centers on loss prevention and risk reduction. A broader, expansive view of risks emphasizes the duality of risks, coupling both the downside probability and the potential for opportunity (Damodaran, 2008; Harvey, 2015; International Organization for Standardization (ISO), 2015). Evidence from a growing body of research on risk management advocates for the necessity of taking the latter perspective on risks to benefit from the “upside of risk”, in order to successfully create and protect shareholder value (Frigo & Anderson, 2011; Foss & Klein, 2012; ISO, 2015). Enterprise risk management, while still an emerging paradigm (Mikes & Kaplan, 2014), has now become a key concern of organizations, as there is a pressing need for organizations to turn risk management from a “silo”, or a functional endeavor, into an enterprise-wide, strategic undertaking.
Enterprise risk management (ERM) is a top-down, holistic approach to identifying, assessing, prioritizing, and controlling risk exposures and their integral and cumulative effects throughout an organization in a coordinated, consistent manner (Agarwal & Ansell, 2016; Rogachev, 2008; Muzzy, 2008). ERM goes beyond systematically conducting an in-depth analysis of existing risks by extending the scope of risks to cover new and possible risks associated with high-level goals and strategic decisions (Committee of Sponsoring Organizations of the Treadway Commission (COSO), 2004; Beasley, Hancock, & Hanson, 2009; Harner, 2010). Research in support of ERM suggests that it adds value to strategy formulation and informs entrepreneurial judgment by identifying and assessing risks embedded in each strategic alternative, thus providing management with critical information on potential risks and opportunities (Khan, Hussain, & Mehmood, 2016; Foss & Klein, 2012; Beasley & Frigo, 2007; Abrams, von Känel, Müller, Pfitzmann, & Ruschka-Taylor, 2007). A review of the academic literature indicates the prevalence of ERM (e.g., Bromiley & Rau, 2016; Mikes & Kaplan, 2014), and denotes several emerging conceptual frameworks (Agarwal & Ansell, 2016; Choi, Ye, Zhao, & Luo, 2016; Sax & Torp, 2015; Mikes & Kaplan, 2014).