مدیریت ریسک سازمانی Enterprise risk management: history and a design-science proposal

1. Introduction Enterprise risk management (ERM) plays a corporate governance role in the holistic management of all risks to aid in decision making and increasing the likelihood of achieving operational and strategic objectives. Risks are typically classified with hazard, financial, operational, and strategic risks being four common categories (D’Arcy and Brogan, 2001; Elliott, 2013). Even though ERM scholarship has roots in the academic Finance/Risk Management and Insurance (RMI) discipline, research there has almost solely focused on hazard and financial risks. These more quantifiable types of risk suit the skills of RMI researchers, but for ERM to be truly holistic and play a strategic role in organizations, a broader research agenda must include difficult to quantify risks, such as the more ambiguous operational and strategic risks, and foundational ERM concepts, such as risk appetite, corporate governance, strategic view of risk, breaking down risk management silos, and implementation of ERM (Bharathy and McShane, 2014). Accounting research has brought a focus on the “management” part of ERM with broad efforts on the relationship of management control and corporate governance to risk management. This research has been active in advancing risk management research beyond Finance/RMI roots by employing multiple research paradigms, such as field and case study methods, contingency theories, and actor network theory (Mikes, 2009 and 2011; Hopper and Bui, 2016). Other disciplines have contributed also. Nair et al. (2014) and Bogodistov and Wohlgemuth (2017) discuss ERM from a dynamic capability perspective. Gatzert and Schmit (2016) integrate the management of reputation risks into the ERM framework.