Citationfromriskermacademiaref2012 proceeding pg1702 1715 libre

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1702 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

RISK MANAGEMENT, PERFORMANCE MEASUREMENT AND ORGANIZATIONAL PERFORMANCE: A CONCEPTUAL FRAMEWORK Siti Zaleha Abdul Rasid, Nargess Mottaghi Golshan, Wan Khairuzzaman Wan Ismail & Fauziah Sheikh Ahmad International Business School Universiti Teknologi Malaysia szaleha@ibs.utm.my ABSTRACT In the aftermath of recent global financial crisis and corporate failures, entity stakeholders are demanding greater oversight of key risks facing the enterprise to ensure that stakeholder value is preserved and enhanced. One response to these growing expectations is the emergence of a new paradigm known as “Enterprise Risk Management” or “ERM” as an internal control system. At the same time, organizations have been implementing Performance Measurement System (PMS) as one of management control systems vital for corporate success. Considering the importance of these two control systems, the possibility of incorporating ERM into the existing PMSs needs to be explored. It is expected that risk management will complement PMS by identifying and mitigating risks in achieving strategic objectives. Empirical evidence regarding this link is still lacking, therefore, this paper investigates the linkage between risk management and PMSs. In addition, it also discusses the impacts of these two systems on organizational performance. Finally, a conceptual model for integrating risk management and performance measurement is proposed.

Field of Research: Enterprise risk management, performance measurement, organizational performance

---------------------------------------------------------------------------------------------------------------------------

1. Introduction Identification and management of risk has become an integral part of a sound management and governance framework. In recent years, corporate failures, such as the collapse of Enron and World Com have increased the need for effective risk management. Merely recording history of performance measures is insufficient. Risk management and performance measurement should be linked together to enable enterprise to define and guide its overall risk profile, as well as to shape its strategic direction. IBM’s CFO study of 2007 revealed that effective organizations proactively manage risks for closing performance gaps (Rogers, Lukens, Lin, & Jon, 2007). Therefore, executing strategy aggressively that lacks control and balance may have disastrous effects on organizational performance.

Although there is a growing body of literature that examines the effect of enterprise risk management (ERM) on organizational performance as well as the effect of performance measurement system (PMS) on organizational performance, studies on how linking ERM and PMS can enhance the organizational performance is still lacking. While PMSs strictly focus on value

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1703 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

creation, they overlook the importance of value loss prevention. On the other hand, risk management practices mostly focus on value loss prevention but disregard the importance of how these risks relate to strategic objectives. Organizations should understand that a strategy, which lacks alignment with risk management, is not only insufficient but also risky. Hence, this study aims to fill this gap by discussing how ERM and PMS could be linked to enhance organizational performance.

This paper is structured so that the first section discusses how ERM has evolved from the traditional forms to a more integrated approach of risk management. Thereafter, PMSs utilized by organizations are discussed. Subsequently, the possible linkages of PMS and ERM are considered. Finally a framework for future empirical research is proposed.

2. The Journey From Traditional Risk Management to ERM 2.1 Risk Definition Risk is a phenomenon that by definition and by nature cannot be eliminated. Although risk and uncertainty are often used interchangeably, there is a distinction between them. Uncertainty is referred to not being sure of what is going to happen in the future and risk is the degree of this uncertainty. In other words risk is the degree of our uncertainty about what is going to occur (Fabozzi & Peterson, 2003).

In old days, self-assurance was considered as a method for risk management and later risk management was implemented through a silo-based perspective among firms. Now we have come to the era of ERM (Rochette, 2009). The traditional risk measures like value-at-risk (VAR) emphasized merely on the negative aspect of risk-taking activities. Additionally, the financial and operational risk estimates were made in silos and they never seemed integrated and embedded in the foundation of firms. However, the risk profession has evolved gradually and stopped considering risk only as negative. Today’s risk professionals also reveal the opportunities that come along with risk-taking activities.

2.2 Risk Management Risk management is one of those concepts that when managers are asked about it, they will unanimously respond, “Yes, we definitely need a risk management program”. However, risk management is one of the concepts that until recently had not been clearly understood among many organizations (Moeller, 2007). The Committee of Sponsoring Organizations of the Treadway Commission (COSO) standards-setting entity solved ERM’s clear definition problem by introducing its ERM framework in late 2004. This framework revealed a set of definitions and a structure to allow organizations of all types including for-profit-entities, not-for-profits, and governmental agencies and all sizes including large and small entities for better managing their risky circumstances.

As Ferreira (2006) has defined risk management, it involves managing to achieve a proper balance between realizing opportunities for gains while minimizing losses. As this definition implies, risk management is an integral part of a good management practice and an essential element of excellent corporate governance (Ferreira, 2006). Risk management is a repetitive process that constitutes steps that when taken consequently; it facilitates improved decision-making and performance. These steps include identifying, analyzing, evaluating, treating, monitoring and

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1704 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

communicating risks. This process enables organizations to maximize the gains and minimize the losses (COSO, 2004). According to Pagach and Warr (2011), the primary goal of risk management is to increase shareholders’ value to its maximum.

Traditionally when one talked about risk management, what came to mind was rather insurance, broker or auditor. The concern was on the negative impacts of risk exposures and the risk specialist job was only to diminish this negative impact to its least level. However in recent years the concept of ERM has emerged. In ERM the focus is on both positive and negative side of the risk (Rochette, 2009).

2.3 ERM ERM is sometimes referred to as “business risk management”, “strategic risk management”, “holistic risk management”, “integrated risk management”, “corporate risk management”, and “enterprisewide risk management”, which is the new substitute of traditional silo-based risk management. The main difference of ERM from the traditional silo-based risk management is that firms can enhance stakeholders’ value while mitigating risk when they pursue an ERM framework (Daud, Yazid, & Hussin, 2010).

There are various definitions of ERM in the literature. Chapman (2003) stated that ERM is a process of determination and analysis of risk from an integrated, enterprise-wide perspective. Liebenberg & Hoyt (2003) which is an often cited study in the field of ERM have mentioned that ERM enables organizations to take advantage of a broad and integrated approach to risk management which is more offensive and strategic unlike the silo-based risk management which was primarily a defensive method of managing risk. According to Stokes (2004) and Woon, Azizan, & Samad (2011), ERM is a fundamental element of modern business. Risk management’s focus has changed from merely operational hazards and financial risks to a much more strategic view of opportunities and threats. In their view, ERM is a robust and dynamic risk management framework, which elevates the appetite for upside risk.

And finally yet importantly COSO, which is known mainly as the inventor of ERM framework among scholars, has defined ERM as: “a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives (COSO, 2004)”.

In brief, ERM includes methods and processes that organizations use to manage risks and capture existing opportunities in order to achieve their goals. Indeed ERM addresses the requirements of various stakeholders, who desire to realize the broad spectrum of risks facing the organization, to ensure that the organization is being properly managed.

ERM’s major distinction from traditional silo-based risk management is that it examines all the risks faced by the firm and takes a holistic approach to manage these risks (Pagach & Warr, 2011). Based on the comprehensive elaboration of Rochette (2009), ERM is different from the traditional risk management in four aspects. Firstly, ERM should be present within overall governance structure of a firm. Secondly, ERM does not substitute the traditional risk management rather it complements it.

This implies that traditional risk management should be in place, especially in business units and ERM should be used at corporate level to manage the overall risks the company is facing. The third difference of traditional risk management and ERM comes from the necessity of presence of a risk

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1705 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

champion, usually in the role of chief risk officer (CRO). Traditionally chief financial officers (CFOs) were responsible for managing the risks the firm faces, but in the new concept of ERM it is insisted that the role of CFO and CRO is different, while CFO always attempts to ignore some risks and focuses on maximizing return. But the presence of CRO assures that the opportunities lying beyond the risks will be analyzed as well. Finally, ERM implementation should obey a top-down and forwardlooking approach while traditional risk management utilized bottom-up risk analysis which often resulted in deviation from strategic goals of the organization.

2.4 ERM Frameworks - COSO Framework COSO (2004) is one of the most popular ERM frameworks being implemented in different firms across the globe (Daud, et al., 2010). COSO (2004) ERM framework is built upon the earlier COSO’s Internal Control-Integrated framework (1992). COSO emphasizes that risk management’s primary focus is on identifying, understanding, and assessing intrinsic business risks and then it considers control as one possible risk response. COSO’s 2004 ERM framework comprises of eight interrelated components: (i) internal environment; (ii) objective setting; (iii) event identification; (iv) risk assessment; (v) risk response; (vi) control activities; (vii) information and communication and (viii) monitoring. In this framework, there is a direct relationship between the above eight ERM components and strategic, operations, reporting, and compliance objectives of a firm. This relationship is depicted in a three-dimensional matrix in figure 1.

Figure 1: Three-dimensional matrix of relationship between ERM components, firm’s objectives and firm’s units. Source: COSO (2004) 3. Performance Measurement Systems (PMS) Performance measurement can be defined as the process of quantifying the efficiency and effectiveness of action (Neely, Gregory, & Platts, 2005). Rouse & Putterill (2003) define it as the comparison of results against expectations with the implied objective of learning to do better. It is a process of assessing progress towards achieving pre-determined goals, including information on the efficiency by which resources are transformed into goods and services, the quality of those outputs and outcomes, and the effectiveness of organizational operations in terms of their specific contributions to organizational objectives (Amaratunga & Baldry, 2002). The primary goal of PMS is

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1706 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

to assess the progress of achieving objectives including both financial and non-financial. Meanwhile the output of PMS will be used to assure the efficiency and effectiveness of resource allocation in an organization (Acharyya, 2007).

Beamon (1996) has claimed that an effective PMS has four main characteristics. These characteristics include inclusiveness, measurability, consistency, and universality. Moreover, a PMS should be able to evaluate both internal and external environment of an organization. The output of PMS should be used by the senior management level of an organization to decide on setting new goals for the organization. PMS are vital tools, which assist organizations to translate their strategy in terms of desired behavior and results. Moreover, PMS help organizations to communicate their expectations, monitor the business processes, providing feedbacks, and motivating employees through performance-based compensations (Banker, Potter, & Srinivasan, 2000; Chenhall & Langfield-Smith, 2003; Ittner & Larcker, 1998; Kaplan & Norton, 2001).

There are many tools and techniques suggested in the literature for measuring performance in an organization. Four often-practiced ones include: Economic Value Added (EVA), BSC (BSC), Benchmarking, and Total Quality Management (TQM). BSC is a comprehensive PMS tool that has been widely practiced by many organizations in the world.

3.1 Balanced Scorecard (BSC) Kaplan & Norton first introduced the BSC in 1992. According to them a BSC is a PMS that provides top managers a quick but thorough perspective of how the business is doing. The word “Balance” in the name of the BSC comes from the fact that it includes both financial and operational measures. A generic BSC translated organization’s mission and objective into specific and measurable operational and performance metrics across four perspectives: (i) Financial performance; (ii) Customer satisfaction; (iii) Internal processes and (iv) Learning & growth (Kaplan & Norton, 1992). As it can be seen in figure 2, learning and growth perspective focuses on the employees’ competencies to improve internal business processes. Consequently customer satisfaction will enhance only if internal processes are improved. And finally, financial results would surpass through satisfied customers. This is how the four perspectives of Kaplan & Norton’s BSC are interrelated (Beasley, Chen, Nunez, & Wright, 2006).

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1707 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

Measures

To achieve the vision how will the organization sustain its ability to change and improve?

Goals

Learning & Growth Perspective

Measures

To satisfy our customers and shareholders, where should the organization excel in internal processes?

VISON AND STRATEGY

Goals

Internal Processes Perspective Measures

To achieve our vision how should we appear to our customers?

Goals

Customer Perspective

Measures

To improve financial outcome, how should we appear to our shareholders?

Goals

Financial Perspective

Figure 2: Integration of four perspectives of a BSC. Source: Adapted from Beasley, Chen, Nunez, & Wright (2006) In fact the best advantage of BSC is that it translates the organization’s vision and strategy into measurable metrics (Acharyya, 2007). Therefore by using a BSC it can be precisely assessed if the organization is moving across the defined strategy and is on the right way of achieving its objectives at any point of time.

4. ERM Adoption and Organizational Performance In the academic literature there are various studies, which have linked implementation of ERM with improved firm performance (e.g. COSO, 2004; Fong-Woon Lai, 2010; Gordon, Loeb, & Tseng, 2009; Hoyt & Liebenberg, 2010; Segal, 2011). In recent years the benefits of ERM have astonished managers. These benefits include:  Reduced cost of capital  Reduced earnings volatility which results in enhancing shareholders’ value  Reduced stock price volatility which results in enhancing shareholders’ value  Gaining competitive advantage through identifying those risks that can be exploited  Enhanced informed decision making ability  Builds confidence for investors (Liebenberg & Hoyt, 2003) and (Miccolis & Shah, 2000).

Meanwhile Woon et al. (2011) have proved that successful ERM implementation will result in value creation for shareholders through lowered cost of capital (via lowered risk premium) and enhanced business performance (i.e. higher price-to-earnings ratio for the firm’s shares). Pagach & Warr (2011)

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1708 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

have also indicated that firms adopt ERM for direct economic benefits rather than merely to comply with regulations’ pressure. In fact many organizations have intuitively recognized the benefits of ERM and have started to implement it in some form in the organization.

Various studies have shown that ERM implementation affects organizational performance extensively (e.g. Fong-Woon Lai, 2010; Gordon, et al., 2009; Hoyt & Liebenberg, 2010; Segal, 2011).

An example is the Ernst & Young study in 2005 that revealed that sixty-one percent of investors do not have any intention to invest in organizations who do not clearly identify risks (Oracle, 2009). Via establishment of a consistent and disciplined process of enterprise-wide risk management organizations would be able to improve their business results (Oracle, 2009). In brief it can be argued that ERM adoption would result in improved organizational performance. The discussion therefore suggests the following hypothesis: H1: There is a positive relationship between ERM adoption and organizational performance.

5. Performance Measurement System (PMS) and Organizational Performance PMS play a key role in developing strategic plans, evaluating the achievement of organizational objectives, and deciding about employees’ compensation (Ittner & Larcker, 1998). A well-designed PMS will include a sense of direction and purpose. PMS can provide useful tools for restructuring and for organizational performance management if they are effectively linked to the revised strategies and accompanied with appropriate rewards (Kaplan & Norton, 1992; Otley, 1999). PMS are an important part of continuous improvement. Meanwhile PMS help managers to focus their attention on achieving objectives, and use it as a crucial agent of change. Also PMS play an important role for the improvement of individual and organizational performance.

The BSC has proven to be an effective tool to capture, describe, and translate organization’s strategy into performance metrics and targets (Niven, 2006). Since its emergence in the early 90s, many companies have adopted it for measuring financial and non-financial performance of the organization. Consequently many studies have been conducted to gauge its effectiveness and to assess whether the BSC really adds value to the organizations (Chen, 2011; De Geuser, Mooraj, & Oyon, 2009; Hoque & James, 2000; Pollanen & Xi, 2011). As an example, De Geuser et al. (2009) in their study of 76 business units found that BSC has a positive impact on organizational performance and more specifically it improves the integration of management processes via a better translation of strategy into operational terms. Moreover, BSC makes strategizing a continuous process, and it results in greater alignment of various processes within the organization. Meanwhile, Pollanen & Xi (2011) in their recent research of 330 firms found that firm performance is a function of increased fit between BSC and firm characteristics such as strategy, industry, size, quality, structure, culture, and ownership. In summary, it can be concluded that the use of PMS or BSC as a comprehensive PMS framework is expected to enhance organizational performance to higher levels. Thus, the following hypothesis is suggested: H2: There is a positive relationship between PMS and organizational performance.

6. ERM and PMS One effective way for organizations to understand the value of the ERM framework is to link it with their PMS (Acharyya, 2007). A study of CFOs by IBM Global Business Services in 2008 revealed that

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1709 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

only 29 percent of organizations have aligned risk with performance. Therefore, there is still much room for improvement by aligning PMS with ERM in an organization. When ERM and PMS are linked, the value of an ERM framework can be effectively and efficiently understood within an organization.

In other words if ERM framework would be integrated with an organization’s PMS, the ERM framework would definitely enhance shareholders’ value. Only when organizations understand that ERM framework is adding value to the company, they would be motivated to invest more resources in ERM framework implementation in order to drive strategic decisions for meeting organizational objectives and maximizing long-term shareholder value (Acharyya, 2007).

The achievement of business value and strategic objectives will be ascertained by aligning corporate strategy, strategic planning, and ERM (Oracle, 2009). Since ERM attempts to aid the achievement of strategic objectives, it aligns the interests of the risk manager with those of entity as a whole. Hence, it should be possible to integrate ERM with the existing PMS within an organization. There has been a call for integrating the balance scorecard (BSC) as a strategic PMS and ERM as a proposed best practice of risk management (Ballou, Brewer, & Heitger, 2006; Beasley, et al., 2006; Calandro Jr & Lane, 2006; McWhorter, Matherly, & Frizzell, 2006; Nagumo, 2005; Scholey, 2006; Woods, 2007).

However this integration may raise the issue of professional rivalry between risk managers and internal auditors (Woods, 2007). But ultimately there is no difference between the aim of ERM and PMS, while both focus on shareholders’ value maximization. There are a few studies, which claim that, ERM and PMS should converge to create, enhance, and protect shareholders’ value (see Beasley, et al., 2006; Calandro Jr & Lane, 2006; Oracle, 2009). One commonly used PMS is the BSC. The scorecard can be enhanced by including goals and objectives for risk management and by capturing performance-based risk metrics.

BSC provides a suitable infrastructure for implementation of ERM in an organization. In other words, a BSC can be leveraged to provide an ERM framework. Leveraging a BSC to include ERM strengthens the scope of management’s focus by precisely and clearly linking risk management to performance measurement. If risks would be managed separately from other strategic objective, which indicates that ERM and BSC would run in parallel, managers may have difficulty in prioritizing the defined targets. Rather if the two systems would be integrated, the influences of various types of risks on the strategic objectives become explicit.

Therefore, on one hand BSC provides a suitable base for ERM implementation. On the other hand the integration of ERM and BSC will result in a more effective BSC (Beasley, et al., 2006). Meanwhile, when ERM would be embedded in the existing BSC of an organization, there would be less requirement of creating a new function of risk management, since risk components are incorporated into every staff’s responsibility. However, the ultimate responsible party for risk control will remain to be the board of directors. Figure 3 plots how ERM and BSC processes can be linked together.

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1710 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my BSC: Formulating Strategies

ERM: - Articulating Risk Appetite - Setting Objectives (strategic, operations, reporting, compliance) BSC: Strategic Feedback and learning

ERM-BSC Process Cycle

ERM: - Risk reporting - Information and communication

BSC: Executing Strategies ERM: - Risk Identification - Risk Response - Risk Control

BSC: Evaluating Performance ERM: - Risk Monitoring

Figure 3: ERM-BSC process cycle. Source: Adapted from Kaplan & Norton (Kaplan & Norton, 1996), Nagumo (2005), and Segal (2005)

7. Integrating ERM and BSC Kaplan & Norton first introduced the BSC in 1992. Interestingly it was the same year that COSO also introduced its internal control framework. However it took some years for the practitioners to discover how strategies and ERM should be linked. COSO’s ERM framework introduced in 2004 was an initiation of this linkage. However, still after almost eight years since the introduction of ERM framework by COSO, only a few studies have considered how ERM and BSC can be linked. Table 1 provides an overview of these studies: Table 1: Studies on the possible linkages between BSC and ERM, Source: Authors’ Compilation Title Author(s) Type Focus Aligning ERM with Strategy Nagumo (2005) Case Study How Bank of TokyoThrough the BSC: The Bank Mitsubishi undertook the of Tokyo-Mitsubishi integration of BSC and Approach ERM Linking risk management to strategic controls: a case study of Tesco PLC

Woods (2007)

Case Study

The extent of overlap between ERM and BSC

An introduction to the Enterprise Risk Scorecard

Calandro Jr & Lane (2006)

Conceptual Paper

Designing a risk scorecard based on Kaplan and Norton’s BSC

Working hand-in-hand: ERM and BSC

Beasley, Chen, Nunez, & Wright

Conceptual paper

Leveraging BSC into ERM to strengthen scope of

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1711 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING Title

12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

Author(s) (2006)

Type

Focus management’s focus on broader sets of risks

The focus of a BSC is on continuous improvement and it links an organization’s vision and strategy to certain performance measures (Beasley, et al., 2006). Therefore it is obvious that the BSC takes a holistic enterprise wide approach for measuring organization’s performance. Hence it provides an excellent infrastructure for an enterprise-wide risk management system. BSC assess an organization’s progress towards achieving strategic goals. On the other hand, ERM is a tool for organization leaders to detect the positive and negative events that may affect achievement of their goals. Thus a combination of the BSC and ERM will increase the probability of achieving goals and objectives.

8. Integrated ERM-BSC Effect on Organizational Performance After almost two decades since the inception of BSC by Kaplan and Norton (1992), many companies all around the world have adopted it as a PMS tool. On the other hand ERM is a relatively new concept and still not many companies have adopted this framework. In fact adoption of ERM is still a voluntary concept among the firms. The empirical evidences are the studies of Liebenberg and Hoyt (2003) who have identified only 26 firms in the US that have adopted ERM during 1997 to 2001, and even the most recent study of Pagach and Warr (2011) detected only 138 firms in the US, which have adopted ERM framework during 1999 to 2005. Another example is the survey results of the Economist Intelligence unit, which discovered that only 41 percent of companies in Europe, North America, and Asia have adopted some form of ERM. As scholars have tried to find the reason behind low adoption rates of ERM, they cite some common barriers and challenges such as the resistance of board of directors or senior executives. Another challenge to successful implementation of ERM is the improper understanding of top-down approach that should be taken for this purpose (Tax Management Inc., 2011).

However, as Beasley et al. (2006) has suggested, BSC can serve as an infrastructure for ERM adoption. Therefore challenges such as board of directors’ resistance and requirement of a top-down approach will be solved and organizations would find it easier to implement an effective ERM framework. Meanwhile, there are already some organizations which have integrated their ERM framework with BSC. Examples include Bank of Tokyo-Mitsubishi and Tesco PLC (Nagumo, 2005; Woods, 2007). Also, Mobil, Chrysler, and the US Army have associated their scorecards with risk management (Olson & Wu, 2010, p. 185). It is expected that integrating the two management tools would enhance organizational performance to higher levels than practicing two frameworks in parallel without any linkage. Hence, the following hypothesis is suggested: H3: The combined effect of ERM and PMS would lead to enhanced organizational performance.

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1712 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

Based on all the arguments above, a conceptual framework is suggested as shown in figure 4.

H1 ERM

H3

Organizational Performance

PMS

H2 Figure 4: Conceptual Framework 9. Conclusion The aim of this paper was first to introduce one alternative way of how ERM and PMS frameworks could be integrated. For this purpose it has been shown that in principle both ERM and BSC (as the most utilized PMS) are simply two types of strategic management control systems and they have various similarities. Moreover, strategy and risk management are two sides of the same coin; they should be considered simultaneously. Debate over the advantages and disadvantages of different ways of integrating ERM and BSC are beyond the scope of this paper but remain as an interesting area for future research. Meanwhile an empirical approach should be taken to test the effectiveness of the proposed framework of this research which indicates that leveraging the current BSC of an organization with ERM framework would enhance organizational performance.

References Acharyya, M. (2007). Proposing a conceptual framework to measure the performance of Enterprise Risk Management from an empirical study of four major European insurers. Paper presented at the 34th Seminar of the European Group of Risk and Insurance Economists, Cologne.

Amaratunga, D., & Baldry, D. (2002). Moving from performance measurement to performance management. Facilities, 20(5/6), 217-223.

Ballou, B., Brewer, P. C., & Heitger, D. L. (2006). Integrating the Balanced Scorecard and Enterprise Risk Management. Internal Auditing-Boston-Warren Gorham And Lamont Incorporated, 21(3), 34.

Banker, R. D., Potter, G., & Srinivasan, D. (2000). An empirical investigation of an incentive plan that includes nonfinancial performance measures. Accounting Review, 65-92.

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1713 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

Beamon, B. M. (1996). Performance measures in supply chain management.

Beasley, M., Chen, A., Nunez, K., & Wright, L. (2006). Working Hand in Hand: Balanced Scorecards and Enterprise Risk Management-Taking a total look at all the potential risks to a company, or enterprise risk management, is becoming the minimum standard. Strategic Finance, 87(9), 49-55.

Calandro Jr, J., & Lane, S. (2006). An introduction to the enterprise risk scorecard. Measuring Business Excellence, 10(3), 31-40.

Chapman, C. (2003). Bringing ERM into focus. Internal Auditor, 60(3), 30-36.

Chen, W. (2011). The indicators of performance evaluation for nursing home by balanced scorecard.

Chenhall, R. H., & Langfield-Smith, K. (2003). Performance measurement and reward systems, trust, and strategic change. Journal of Management Accounting Research, 15, 117.

COSO. (2004). Enterprise Risk Management- Integrated Framework.

Daud, W. N. W. D., Yazid, A. S., & Hussin, H. M. R. (2010). The Effect Of Chief Risk Officer (CRO) On Enterprise Risk Management (ERM) Practices: Evidence From Malaysia. International Business & Economics Research Journal (IBER), 9(11).

De Geuser, F., Mooraj, S., & Oyon, D. (2009). Does the balanced scorecard add value? Empirical evidence on its effect on performance. European Accounting Review, 18(1), 93-122.

Fabozzi, F. J., & Peterson, P. P. (2003). Financial management and analysis (Vol. 100): John Wiley & Sons Inc. Ferreira, G. (2006). AS/NZS 4360: 2004 Australian Standard for Risk Management: Jan. Fong-Woon Lai, F. A. S. (2010). ERM Framework and the Empirical Determinants of its Implementation.

Gordon, L. A., Loeb, M. P., & Tseng, C. Y. (2009). Enterprise risk management and firm performance: A contingency perspective. Journal of Accounting and Public Policy, 28(4), 301-327.

Hoque, Z., & James, W. (2000). Linking balanced scorecard measures to size and market factors: impact on organizational performance. Journal of Management Accounting Research, 12, 1-18.

Hoyt, R. E., & Liebenberg, A. P. (2010). The value of enterprise risk management. Journal of Risk and Insurance.

Ittner, C. D., & Larcker, D. (1998). Innovations in performance measurement: trends and research implications.

Kaplan, R. S., & Norton, D. P. (1992). The balanced scorecard--measures that drive performance.

Harvard Business Review, 70(1).

Kaplan, R. S., & Norton, D. P. (1996). Using the balanced scorecard as a strategic management system. Harvard Business Review, 74(1), 75-85.

Kaplan, R. S., & Norton, D. P. (2001). Transforming the balanced scorecard from performance measurement to strategic management: Part 1. Accounting Horizons, 15(1), 87-104.

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1714 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

Liebenberg, A. P., & Hoyt, R. E. (2003). The determinants of enterprise risk management: evidence from the appoitnment of chief risk officers. Risn Management and Insurance Review, 6(1), 37-52. doi: 10.1111/1098-1616.00019/,DanaInfo=onlinelibrary.wiley.com McWhorter, L. B., Matherly, M., & Frizzell, D. M. (2006). The connection between performance measurement and risk management. Strategic Finance-Montvale-, 87(8), 50.

Miccolis, J., & Shah, S. (2000). Enterprise Risk Management- An Analytic Approach: Tillinghast – Towers Perrin.

Moeller, R. R. (2007). COSO enterprise risk management: understanding the new integrated ERM framework: John Wiley & Sons.

Nagumo, T. (2005). Aligning enterprise risk management with strategy through the BSC: the Bank of Tokyo-Mitsubishi approach. Balanced Scorecard Report(September-October), 3-6.

Neely, A., Gregory, M., & Platts, K. (2005). Performance measurement system design: a literature review and research agenda. International Journal of Operations & Production Management, 25(12), 1228-1263.

Niven, P. R. (2006). Balanced scorecard step-by-step: maximizing performance and maintaining results: Wiley.

Olson, D. L., & Wu, D. (2010). Enterprise Risk Management Models: Springer.

Oracle. (2009). Risk Management: Protect and Maximize Stakeholder Value.

Otley, D. (1999). Performance management: a framework for management control systems research.

Management accounting research, 10(4), 363-382.

Pagach, D., & Warr, R. (2011). The characteristics of firms that hire chief risk officers. Journal of Risk and Insurance.

Pollanen, R., & Xi, K. (2011). The Use of Balanced Scorecard Measures in Executive Incentives and Firm Performance.

Rochette, M. (2009). From risk management to ERM. Journal of Risk Management in Financial Institutions, 2(4), 394-408.

Rogers, S., Lukens, S., Lin, S., & Jon, E. (2007). Balancing risk and performance with an integrated finance organization: the global CFO study 2008. IBM Corporation in cooperation with The Wharton School and Economist Intelligence Unit. October, 159-151.

Rouse, P., & Putterill, M. (2003). An integral framework for performance measurement.

Management Decision, 41(8), 791-805.

Scholey, C. (2006). Risk and the balanced scorecard. CMA Management, 32, 32-35.

Segal, S. (2005). Value-Based Enterprise Risk Management. The Actuary, June/July.

Segal, S. (2011). Corporate Value of Enterprise Risk Management: The Next Step in Business Management: John Wiley & Sons.

Stokes, M. (2004). Taking full advantage of enterprise-wide risk management. The Treasurer.

3rd INTERNATIONAL CONFERENCE ON BUSINESS AND 1715 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING 12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA ISBN: 978-967-5705-05-2. WEBSITE: www.internationalconference.com.my

Tax Management Inc., a. B. C. (2011). Coordinating Risk Management and Performance Measurement. In I. The Bureau of National Affairs (Ed.), Accounting Policy & Practice Series.

Woods, M. (2007). Linking risk management to strategic controls: a case study of Tesco plc.

International Journal of Risk Assessment and Management, 7(8), 1074-1088.

Woon, L. F., Azizan, N. A., & Samad, M. F. A. (2011). A Strategic Framework For Value Enhancing Enterprise Risk Management. Journal of Global Business and Economics, 2(1), 23-48.