Enterprise Risk Management: Improving Embedded Risk Management and Risk Governance

Abstract

We argue for an integrated, decision-oriented enterprise risk management (ERM) system focused on value drivers rather than risk minimization and using quantitative risk aggregation based on the best available information. Our holistic view on ERM includes cultural, organizational, and technical aspects, presenting seven areas for more effective risk governance and resilience grounded in a robust enterprise framework. Our analysis, supported by a structured literature review, covers these seven key areas for ERM development. Our review shows that risk aggregation, quantification, and decision-making support are only covered by a few publications. The paper offers insights on linking risk management with strategic decision-making using risk aggregation techniques (Monte Carlo simulation).

1. Introduction

Risk-oriented corporate management, especially enterprise risk management (ERM), aims to preventively address risks while fostering opportunities, moving beyond traditional risk management (McShane 2017; Hunziker 2019).

Numerous studies confirm that sustained economic success depends on the type and extent of risks taken, making risk management crucial to success (e.g., Krause and Tse 2016; Arrfelt et al. 2018). Joyce and Mayer (2012) indicate that low fundamental risk brings higher stock returns. The relevance of idiosyncratic risks, like those common in imperfectly diversified capital market operators, further justifies risk management, and the volatility anomaly reflects the well-known risk–return paradox (Budd 1993; Bowman 1980). In their meta-study, Horvey and Odei-Mensah (2023) also find that comprehensive ERM enhances profitability and value. We, therefore, believe that a sound risk management approach should inform management about potential crises timeously (risk management as an early-warning system) and provide information on risk exposure to facilitate decisions by making it possible to weigh risks against returns (risk management as a decision-oriented system).

Recent publications on risk management, including Hardy and Saunders (2022), Fraser et al. (2021), Froot et al. (1993), Kaplan and Mikes (2012, 2016), and Nocco and Stulz (2022), highlight a developing emphasis on integrative risk management and risk culture. Additional guidance comes from standards developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and their ERM framework (Hunziker 2019) and risk governance approach, as discussed by Stein and Wiedemann (2016), which extends and evolves ERM. Alternative frameworks such as those by Stein and Wiedemann (2016), Kaplan and Mikes (2016), and Mthiyane et al. (2022) (who focus on SMEs in developing countries) aim at improving risk management. While these publications have closed major gaps in the literature on conceptions of risk management, ERM concepts still focus on existing risks and potential mitigations, often overlooking how each action, especially strategic decisions, alters a company’s risk exposure, and do not adequately address value creation based on risk information.

This weak link between risk management and strategic decisions has complex roots: First, the importance of risk information in decision-making in general is sometimes undervalued since many companies treat risk management as a kind of ‘book-keeping’—as though risks were static—not adequately addressing the dynamism of risks as part of decision-making. Second, the two methods—aggregating risks based on corporate planning and linking the overall scope of risk with enterprise value as a decision criterion—receive scant attention in the ERM literature. Even current textbooks on quantitative ERM rarely discuss key topics such as risk aggregation. The deficits in most publications and frameworks are mirrored in the methodological gaps in available risk management systems, despite the fact that most managers now recognize that a focus on legal compliance is too narrow (Horvey and Ankamah 2020) and cannot aid decision-making.

By placing risk management in the strategic context of sustainable corporate safeguarding, making it decision oriented, and aligning it with value-based management, we diverge from existing frameworks. Our integrative approach addresses key challenges in modern companies, such as the inclusion of new kinds of risks—like ESG risks (economic, social, or governance)—and improves resilience to economic and geopolitical risks, all of which form part of a holistic risk management approach.

In this paper, we first outline the robust enterprise framework before detailing the outer layer of this framework—competence in risk management—divided into seven key areas of development:

• Risk identification;
• Risk quantification;
• Risk aggregation;
• Decision orientation;
• Value contribution of risk management;
• Integrative risk management;
• Risk culture and communication.

We then present insights derived from a concise literature analysis, examining the coverage of these seven areas in the existing literature before providing the conclusion. The seven areas we identify are covered in various risk management standards and maturity models, but these standards and models do not always explicitly name or emphasize these areas. Our areas are therefore not derived from a single standard or publication but are instead based on our own experiences and the wider literature.

2. Robust Enterprise Framework

For long-term success and resilience, we propose adopting the robust enterprise framework, characterized by Gleißner (2023) and shown in Figure 1:

• Financial sustainability at the core, aiming at a stable rating and/or low earnings risk;
• A robust strategy focusing on stable strategic potential for success driving future financial performance and enterprise value;
• High competence in managing risks (both opportunities and threats), especially in decision-making.

Here, risk management is not a separate function but rather one layer of a wider framework centered on financial sustainability and enclosing a robust strategy. These elements are detailed below.

2.1. Financial Sustainability

Robust enterprises aim at high financial sustainability (Gleißner et al. 2022) that emerges when the following occur:

(1)

The enterprise at least matches the growth of the industry, in real terms and over the long term;

(2)

The risk-dependent probability of insolvency (p) is low;

(3)

The earnings risk, expressed by the coefficient of variation (V) of profits, is acceptable to the owners;

(4)

Capital returns exceed the risk-based cost of capital.

High financial sustainability implies low risk of insolvency and a favorable risk position. Ensuring such sustainability serves as a secondary condition for owners seeking to limit risk (Telser 1955; Kataoka 1963). Financially stable companies are less risky and generate significant risk-adjusted excess returns over the long term (Gleißner et al. 2022).

2.2. Robust Strategies

Ensuring financial sustainability requires a robust strategy, and recent research has sought to identify the strategies that foster resilience during economic crises (Ayyub 2014; Buchner et al. 2021; Novak et al. 2021). A robust strategy is grounded in core competencies that have long-term value and are versatile and difficult to replicate. Such strategies create competitive advantages, enabling companies to differentiate themselves from competitors and retain customers. This allows companies to pass on cost fluctuations to business partners while avoiding unattractive fields of activity and customer groups, as well as critical dependencies. The value chain retains only those activities that cannot be outsourced, and operations maximize simplicity while balancing cost, risk, speed, and quality considerations.

Resilience is maintained by duplication of main resources, a competent workforce, and a financial cushion. Where possible, conditions aim to support self-organizing, agile structures that offer employees the freedom and incentives to act flexibly yet accountably. Diversifying and limiting losses and liabilities protects solvency from unexpected and negative events. Robust companies pursue strategies that are likely to ensure at least a sufficient minimum rating, even during major crises.

Along with a robust strategy, an effective risk early warning system is needed—particularly to identify strategic risks. Quantifying early warning signs also helps with planning.

2.3. Competence in Managing Risks

Addressing opportunities and threats (risks1) is vital to sustainable success. All employees should address risks openly and proactively. Deficits in existing risk culture (e.g., reckless behavior) must be addressed (Kunz and Heitz 2021). This should be accompanied by a sound methodology due to the central importance of understanding risks when pursuing positive outcomes (Kaplan and Mikes 2012). Since it is usually not an individual risk but rather a combination of risks that precipitates crises, risk aggregation based on risk quantification is crucial.

The two most relevant frameworks—the COSO ERM framework (COSO 2017) and the ISO 31000 standard (ISO 2018)—stress the importance of a portfolio view, hinting at risk quantification and risk aggregation, but permit qualitative approaches—a central weakness. Instead, we argue that only consistently quantifying all relevant risks as part of risk aggregation will render a portfolio view. We, therefore, now move on to a discussion of the major components of sound risk governance.

3. Sound Risk Governance

Robustness and resilience improve through early crisis detection via risk analysis and aggregation, making ERM as important as robust strategy and financial sustainability. An integrative risk management approach focused on supporting business decisions and tied to corporate planning via risk aggregation becomes the foundation of management control. The strategic, decision-oriented development of ERM has many commonalities with risk governance (see Stein and Wiedemann 2016; Stein et al. 2019; Wiedemann et al. 2022) as ERM’s decision orientation aligns with the risk governance approach (see, for example, Weigel et al. 2018). Moreover, risk governance is integrative, emphasizing the importance of involving all employees in risk culture. The highest maturity level is reached when all employees consciously manage risk (“embedded risk management”).

Thus, risk governance supplies a suitable framework for improving resilience and robustness. This strategic form of risk management becomes essential for success and management control.

Below, we detail seven areas for improvement (see Figure 2), using embedded risk management as the new paradigm. This builds on existing ERM considerations as outlined in COSO (2017) and Nocco and Stulz (2022); we show how ERM requires further development to become foundational to corporate success.

3.1. Risk Identification

A well-designed ERM system analyses “strategic, financial, operational, and hazard risks under a single overarching process” (Ai et al. 2016, p. 1). Both the COSO ERM framework and ISO 31000 stress that risk management should be about “linking business objectives to risk [and] integrated with strategy-setting and performance” (COSO 2017, p. 10). Similarly, ISO 31000 (p. 2) states that the “purpose of risk management is the creation and protection of value” and that risk management “should be a part of […] the organizational purpose, governance, leadership and commitment, strategy, objectives and operations.” Despite this mention of operational and strategic risks, many companies focus solely on operational risks, such as potential failures of critical machinery. Though these are relevant, a company’s overall risk exposure is mostly determined by strategic and macroeconomic risks, which tend to be more severe.

Consequently, during risk analysis, the company’s business model and strategy must first be examined for strategic risks, arising, for example, from threats to key success factors. Serious threats to the company’s existence often result from macroeconomic risks and crises, which can create sharp drops in demand; rising inflation, interest rates, and raw material prices; and supply chain disruptions. Key strategic and macroeconomic risks should, therefore, be systematically monitored and analyzed. These can stem from the following:

• Threats to individual success potentials or the business strategy as a whole, often arising from technological or societal trends;
• Changes in competitive forces in the industry environment (e.g., removal of barriers to entry, increasing dependence on customers or suppliers, availability of substitutes);
• The macroeconomic environment.

Threats to a company’s potential for success can also arise if it fails to meet stakeholder expectations regarding the stability of the business model. Here, so-called sustainability risks arise, which can be reduced by introducing an ESG (economic, social, or governance) framework, such as one based on ESG scoring as a guideline (El Ghoul et al. 2018; Gupta 2018). A sound sustainability strategy requires systematic identification of relevant sustainability risks in all three ESG areas.

Risk identification should cover all potentially relevant risk areas and then focus on the most relevant ones for quantification, as resources are limited and these risks may have the highest impact. This does not mean excluding risks below the threshold altogether: risks that occur regularly and only have a minor impact can be quantified via modeling of fluctuations in items such as sales or material costs to be included in the overall risk exposure.

3.2. Risk Quantification

Many companies describe risks in terms of probability and expected damage, but this is seldom justifiable, as many risks cannot be described in this way. Risks differ in nature and require a quantitative description that models risk characteristics. Even “event-oriented” risks, such as catastrophic IT failures, have uncertain impacts, which should be modeled in the form of a range (Orlando 2021). An ERM system should use adequate probability distributions to form a sound foundation for risk aggregation (Vose 2008; Hargreaves 2021).

Sustainability risks must also be quantified to assess their contribution to risk exposure, which is challenging as the effects are both financial and non-financial. In addition, we must quantify the consequences of the indirect effects of the company’s business activities on the environment and society (and vice versa), and on its own reputation, which, in turn, influence sales and cash flows.

3.3. Risk Aggregation

Neither the COSO ERM standard nor the bulk of the literature elaborates on the risk aggregation method required for decision-oriented risk management. References to risk aggregation are primarily found in countries where aggregation is required by law, as is the case in Germany (Berger and Gleißner 2018). Without risk aggregation, however, it is impossible to evaluate the combined effects of individual risks on target indicators. Even risk management scholars often limit the use of Monte Carlo simulations to risks where there is a wealth of historical data or to large companies. However, we have implemented such systems in smaller companies to quantify low-frequency risks or personnel risks. Some authors also distinguish between controllable and non-controllable risks (e.g., Kaplan and Mikes 2012, 2016), but this is neither necessary nor useful; both categories together determine the overall scope of risk, insolvency risk, and the need for equity to cover risk.

Aggregating quantified risks using a Monte Carlo simulation enables a well-supported assessment of insolvency risk (Saha and Malkiel 2012) from which a “bandwidth plan” can be derived. This creates transparency and allows for the calculation of equity and liquidity requirements in line with risk. In particular, it provides a basis for balancing risks and returns in decision-making. Furthermore, risk management and corporate finance benefit from calculating equity requirements.

3.4. Decision Orientation

All management decisions have uncertain effects because they are associated with opportunities and threats, that is, risks. Risk mitigation measures affect the scope of risk, but so do decisions to invest, alter strategy, acquire, or improve ESG scores. Accordingly, properly comparing the risk–return profiles of various options requires clarity about how the risk scope might change with each available option. In other words, hypothetical risks—those that would arise as a result of decisions that have not yet been taken—must also be considered.

Ordinary risk management systems primarily monitor existing risks to summarize the risk situation in a standardized format. However, this information is rarely incorporated into business decisions, limiting economic benefits. Risk management that focuses solely on transparency will fail to properly serve company interests.

Risk management analyses therefore must be included when preparing business decisions. This enables management to consider underlying risks and their potential effects before a decision is made. The concept of a decision-oriented approach to risk management is found in COSO’s ERM standard (Hunziker 2019), in Stein and Wiedemann’s (2016) risk governance concept, and in Beasley and Branson (2022).

3.5. Value Contribution of Risk Management

Reducing cash flow volatility improves planning certainty and reliability (Amit and Wernerfelt 1990). Predictable cash flows reduce the likelihood of forced reliance on external financing sources and defaults (Li and Wu 2009). Krause and Tse (2016) confirmed that “risk management increases firm value and returns, while reducing return and cash flow volatility”.

In many companies, risk management, management accounting, and value-oriented management approaches are siloed. Firms derive the value driver (i.e., the cost of capital or discount rate) from historical stock returns, so enterprise value and value-based performance measures fail to consider changes in the scope of risk, leaving management quasi “risk-blind”. Risks are excluded from decision-making in these capital market-oriented approaches, and risk management systems remain isolated. No meaningful information exchange occurs between management systems, and potential synergies are lost (Hunziker 2019). Gleißner (2019) and Ernst (2022) show that traditional finance approaches—especially CAPM—cannot be used to calculate the value contribution of risk management via the cost of capital (see Gleißner and Ernst 2023 with a case study on simulation-based company valuation).

Assuming imperfect capital markets, no model of perfect markets, including the CAPM, should be used to derive the cost of equity, and insolvency should always be seen as possible (see Shleifer and Vishny 1997; Campbell et al. 2008; Joyce and Mayer 2012; Dempsey 2013; Fama and French 2015; Rossi 2016; Fernández 2019).

Figure 3 shows how the cash flow (CF) distribution and default probability can be determined via risk aggregation and how this informs valuation. Such methods allow us to deduce the expected value E(CF) and the cost of capital directly from the scope of risk via a risk measure (R), such as standard deviation or value at risk (Dorfleitner and Gleißner 2018). The probability of insolvency—often overlooked but acting as a long-term negative growth rate—must also be taken into account (Gleißner 2019).

3.6. Organization-Wide Integrative Risk Management

In embedded risk management, the central idea is that risk management is decision-oriented and uses existing resources, processes, and tools, such as those employed for planning and budgeting. This improves the efficiency and acceptance of risk management organization wide. Integrating essential risk management tasks into other management systems should be commonplace (Berger and Gleißner 2018). For example, risks can be identified while planning and budgeting by recording the underlying assumptions, each of which is, by definition, uncertain and, therefore, a risk. Quality management can easily analyze and monitor technical risks using proven tools, such as failure mode and effects analysis. Essential risk management tasks can thus be included within the controlling, corporate planning, and budgeting processes (Gleißner 2020):

(a)

Planned values and budgets are based on assumptions (e.g., raw material prices). Every uncertain assumption is a risk. Therefore, it is efficient to explicitly record all assumptions as part of the planning process and to share this information for risk management.

(b)

A new risk is identified whenever a deviation from the plan is caused by an as-yet unrecorded risk.

(c)

Strategic management and control systems (e.g., the balanced scorecard) are used to implement corporate strategy by clearly describing strategic objectives, expressed as key performance indicators (KPIs), and assigning measures and responsibilities. Assigning risks to key indicators reveals whether they can trigger deviations from the plan, augmenting the traditional scorecard approach. Those responsible for a particular metric then monitor the associated risks, which incentivizes employees to identify risks that can cause deviations. Moreover, deviation analysis makes it possible to assign responsibility for deviations that have occurred according to their cause. As a rule, the effects of exogenous risks cannot be attributed to those responsible for the performance indicator in the performance assessment.

In order to implement a risk management system with a decision-oriented focus, we must seamlessly connect risk analyses to decision-making. This requires cooperation between risk management and management accounting—or the department responsible for preparing major decisions (see Section 3.4).

3.7. Risk Culture and Communication

Risks are unpleasant, and people often neglect unpleasant information, failing to develop necessary routines. Consequently, their ability to correctly assess risks intuitively is underdeveloped. Societies, industry practices, market competition, and occupational practices also influence the process. While these influences cannot be eliminated, cultural issues must be addressed to steer an organization toward a desirable risk culture (Kunz and Heitz 2021). These are the aims of risk communication and risk culture (Pan et al. 2020), ideally based on a sound risk policy.

Risk policies must align with the normative elements of corporate management (e.g., decision rules and ethical norms). Here, risk policy is a matter of documented behavioral rules aligned with corporate values. As the COSO ERM framework states, “culture supports the achievement of the entity’s mission and vision” (COSO 2017, p. 27). Definitions of risk culture often reference norms, values, and beliefs surrounding risk awareness, risk-taking, and decision-making; they also stress the importance of individual perceptions and cognitive processes (Kunz and Heitz 2021). Risk culture manifests itself in definitions of key terms, key indicators in dashboards, or the definition of roles and responsibilities.

Risk policies address, for example, decision criteria for weighing risks against profits, individual risk limits, and risk-bearing capacities, offering a starting point for creating a risk management organization that both documents behavioral rules involving all staff in the handling of risk but also lays the foundations for an enduring, established risk-conscious culture.

To effectively communicate risks, risk management systems must provide information in a format that supports the decision-making process. Risk communication mostly relies on lists and explanatory text, sometimes accompanied by ratios such as RORAC (return on risk-adjusted capital), and can be improved by adding charts and diagrams. The design of graphs is critical for transparency and functionality—people often fail to correctly interpret risk information from visual displays (e.g., Berger et al. 2022; Garcia-Retamero and Cokely 2013; Bao et al. 2017). To overcome issues such as distortions and end-anchoring, guidelines on the correct design of graphical displays in reporting should be followed. These issues deserve attention, as reports determine how people perceive a system, which then affects their decisions.

We now analyze how these seven areas are covered in the existing literature analysis on ERM systems.

4. Literature Analysis

We used Horvey and Odei-Mensah’s (2023) meta-study, which analyzed 37 studies on the measurement and performance of ERM, to examine the coverage of the seven areas of development. We defined a question for each:

• Risk identification: Do the authors include strategic and macroeconomic risks?
• Risk quantification: Do the authors mention risk quantification?
• Risk aggregation: Do the authors stress that risks must be aggregated via simulations?
• Decision orientation: Do the authors stipulate that risk analysis must be linked to business decisions?
• Value contribution: Do the authors mention how risk management can improve firm value?
• Integrative risk management: Do the authors view risk management integratively?
• Risk culture and communication: Are risk culture and communication referenced?

In

Table 1. Literature analysis: results.

Authors	Identification	Quantification	Aggregation	Decision Orientation	Value Contribution	Organization	Risk Culture
(Ai et al. 2016)	YES	Partly	NO	Partly	Partly	YES	Partly
(Annamalah et al. 2018)	Partly	NO	NO	Partly	NO	Partly	Partly
(Anton 2018)	NO	NO	NO	Partly	Partly	Partly	Partly
(Baxter et al. 2013)	NO	Partly	NO	NO	Partly	Partly	NO
(Beasley et al. 2005)	NO	Partly	NO	NO	Partly	YES	NO
(Beasley et al. 2008)	YES	YES	YES	Partly	YES	YES	Partly
(Bohnert et al. 2018)	NO	NO	NO	NO	YES	YES	NO
(Callahan and Soileau 2017)	NO	NO	NO	NO	YES	Partly	NO
(Chen et al. 2020)	NO	Partly	NO	NO	Partly	YES	Partly
(Eckles et al. 2014)	Partly	YES	YES	YES	YES	YES	YES
(Farrell and Gallagher 2015)	NO	NO	YES	YES	YES	YES	YES
(Farrell and Gallagher 2019)	YES	Partly	NO	Partly	YES	YES	Partly
(Florio and Leoni 2017)	NO	NO	NO	NO	NO	YES	NO
(Golshan and Rasid 2012)	NO	Partly	NO	NO	Partly	YES	NO
(Gordon et al. 2009)	Partly	YES	Partly	YES	YES	YES	Partly
(Grace et al. 2014)	NO	Partly	NO	YES	NO	YES	NO
(Hanggraeni et al. 2019)	NO	NO	NO	NO	Partly	YES	NO
(Horvey and Ankamah 2020)	NO	NO	NO	Partly	YES	YES	NO
(Hoyt and Liebenberg 2011)	NO	Partly	NO	NO	Partly	YES	NO
(Khan et al. 2016)	NO	Partly	NO	NO	YES	YES	YES
(Lechner and Gatzert 2018)	NO	NO	NO	YES	YES	YES	NO
(Liebenberg and Hoyt 2003)	NO	Partly	Partly	NO	YES	YES	Partly
(Lin et al. 2012)	NO	NO	NO	YES	YES	YES	YES
(Malik et al. 2020)	YES	YES	NO	NO	Partly	YES	Partly
(Mardessi and Arab 2018)	Partly	NO	YES	YES	YES	YES	Partly
(McShane et al. 2011)	NO	NO	YES	YES	YES	YES	Partly
(Miloš Sprčić et al. 2016)	NO	NO	NO	YES	Partly	NO	YES
(Nair et al. 2014)	NO	NO	NO	NO	Partly	YES	NO
(Nasr et al. 2019)	NO	NO	NO	NO	NO	Partly	NO
(Nguyen and Vo 2020)	NO	Partly	YES	Partly	Partly	YES	NO
(Otero González et al. 2020)	NO	Partly	NO	NO	Partly	YES	NO
(Pagach and Warr 2011)	NO	YES	NO	NO	Partly	YES	NO
(Ping and Muthuveloo 2015)	YES	Partly	NO	Partly	Partly	Partly	NO
(Quon et al. 2012)	NO	Partly	Partly	Yes	Partly	YES	NO
(Saeidi et al. 2021)	NO	Partly	NO	Partly	Partly	YES	YES
(Silva et al. 2019)	NO	Partly	NO	Partly	Partly	YES	Partly
(Zou et al. 2019)	NO	NO	NO	Partly	Partly	YES	NO
Share “Yes”	13.5%	13.5%	16.2%	27.0%	37.8%	81.1%	16.2%
Share “No”	75.7%	43.2%	75.7%	43.2%	10.8%	2.7%	51.4%

, we assigned a “YES” if the authors elaborated on these topics;2 “Partly” if the authors included a literature reference only, pointed to a standard, or included a relevant term but provided no details; and “NO” if the topic was not addressed in one of the above ways.

Our analysis is obviously limited as we used only the publications included in Horvey and Odei-Mensah (2023). In addition, we reviewed that document as it stood without contacting the researchers. It is, therefore, possible that the authors addressed all seven areas in their research but included only a short or no reference in the publication. Our categorization is also open to challenge, as such groupings are always somewhat subjective. We nevertheless believe that this analysis supports our view of these seven areas as crucial to the theoretical and practical improvement of integrated risk management systems.

We analyzed all the sources featured in Horvey and Odei-Mensah’s (2023) literature review, not biasing the analysis with our own filtering process. These publications offer consensus only for the integration of risk management, with most papers insisting that risk management be integrated—perhaps because Horvey and Odei-Mensah explicitly focused on ERM-related studies. Similar reasoning explains why many of the studies discuss the value implications of ERM: Horvey and Odei-Mensah explicitly used the term “value of ERM” in their analysis. The other five areas are inadequately covered in the empirical literature.

Particularly surprising is the treatment of risk aggregation, which only six publications include more than a passing mention of. Bohnert et al. (2018), one notable exception, states that “by aggregating risks into one risk portfolio … firms are able to improve the understanding of their overall risk exposure” (p. 3). Using Standard and Poor’s ERM rating (S&P Global 2005) as a proxy for the quality of an ERM system, they found a positive relation to the value of an insurance company. The COSO ERM framework also mentions such a portfolio view, although it is unclear whether this is based on a thorough risk aggregation like that provided by Monte Carlo simulation.

Farrell and Gallagher (2015) also mention risk aggregation, noting that “the ultimate goal of [ERM] is to model, measure, analyze, and respond to … risks in a holistic manner, treating each risk exposure not in isolation, but rather in a portfolio context” (p. 625). Grace et al. (2014) are the only ones who include simulations to aggregate risks as part of a maturity model. Some publications do therefore highlight the importance of risk modeling, aggregation, and other important areas for developing meaningful, effective, and integrated risk management, but this is not adequately emphasized. Companies frequently pay inadequate attention to this when implementing risk management systems, resulting in poor risk cultures where risks are neither quantified nor considered in decision-making. In addition, these publications describe risk aggregation as a stand-alone tool for deriving risk exposure but do not elaborate on its integration with business planning, as we suggest.

5. Conclusions

All important strategic and operational decisions should be assessed with reference to the risk-adjusted earnings value, and—because of the uncertainties inherent in decisions and actions—all forms of management are in fact risk management. Risk management supports the analysis, monitoring, and management of risks. Personnel skilled in dealing with business opportunities and threats are therefore essential to corporate success, incentivizing the expansion of corporate risk management capabilities. This requires designing a risk management system that can provide the information required for such decisions. We outline seven areas for development based on assessing current risk management concepts, giving special consideration to the following:

(a)

Decision orientation and links to value-oriented corporate management: risk management should reveal how the risk scope changes before a decision is made and how this change should factor into the decision calculus.

(b)

Risk quantification, including commonly disregarded risk areas such as economic, geopolitical, and non-financial sustainability risks.

(c)

Risk aggregation procedures that link corporate planning to risk analysis using Monte Carlo simulations, facilitating decision-oriented risk management.

Robust strategy undergirds financial sustainability, stable ratings, acceptable earnings risks, and capital returns. Effective risk management means strategic risks that could endanger the enterprise are identified early on and properly considered in decision-making. The integrative, decision-oriented approach of embedded risk management enables as many employees as possible to address identified risks and is highly consistent with risk governance. Our analysis shows that the seven areas presented in this article—particularly risk aggregation based on corporate planning via simulation methods—are inadequately covered in the literature and should receive more attention.