Construction Management and Economics, 2013

Vol. 31, No. 12, 11991214, [Link]

Critical success factors for enterprise risk management in

Chinese construction companies
XIANBO ZHAO*, BON-GANG HWANG and SUI PHENG LOW
Department of Building, National University of Singapore, 4 Architecture Drive, Singapore, 117566 Singapore
Received 11 March 2013; accepted 17 November 2013

Construction businesses are risky ventures and enterprise risk management (ERM) has been advocated in
construction companies. To ensure ERM success and the subsequent benefits, it is necessary to understand
the key activities of ERM. The objectives are to identify the critical success factors (CSFs) for ERM and analyse
the interrelationships among these CSFs in Chinese construction companies (CCCs). To achieve this objective,
16 CSFs were identified through a comprehensive literature review and 89 completed survey questionnaires were
received. The results of the analysis show that the three most important CSFs are commitment of the board and
senior management, risk identification, analysis and response and objective setting. Additionally, the three
underlying CSF groupings are (1) execution and integration; (2) communication and understanding; and (3)
commitment and involvement of top management. The commitment and involvement of top management
positively contributed to the communication and understanding as well as the execution and integration of
ERM, while the communication and understanding facilitated the execution and integration of ERM. The
proposed framework indicating the key ERM practices and the inter-grouping relationships provides an in-depth
understanding of ERM in CCCs, compared with the existing not so relevant ERM frameworks in various other
industries.
Keywords: Construction companies, critical success factors, enterprise risk management, factor analysis, structural
equation modelling.

Introduction
Construction businesses are inevitably plagued with
complex and diverse risks. Thus, construction companies, especially those venturing into the overseas market, have emphasized and practised risk management.
In most cases, construction companies just emphasize
risk management at the project level as construction
projects are their main sources of revenue and profit.
However, overemphasis on project risk management
(PRM) tends to engender some problems, such as lack
of a holistic view of project risks, lack of transparency
across projects, inappropriate resource allocation
among projects, and difficulties in achieving the corporate strategic objectives (Zhao et al., 2012). The recent
trend has been to regard risk management as an enterprise-wide process that collectively considers the risks
that various projects face and links these events to the
corporate strategy (Gordon et al., 2009; Zhao et al.,

2013). The 2000s have witnessed the proliferation of

enterprise risk management (ERM) in the financial,
manufacturing, insurance and energy industries. As
ERM allows common risks that are traditionally
addressed at the project level to be more efficiently
and consistently managed across a company (Hallowell
et al., 2013), ERM was forecast to grow in the construction industry and construction companies have
been seen as prime candidates for ERM (Zhao et al.,
2013).
According to the Committee of Sponsoring Organizations of the Treadway Commission (2004), ERM is
defined as:
a process, effected by an entitys board of directors,
management and other personnel, applied in strategy
setting and across the enterprise, designed to identify
potential events that may affect the entity, and manage
risk to be within its risk appetite, to provide reasonable

*Author for correspondence. E-mail: zhaoxb1984@[Link]

2014 Taylor & Francis

1200
assurance regarding
objectives. (p. 2)

Zhao et al.
the

achievement

of

entity

Background
Enterprise risk management

Despite resources invested, successful

ERM
programmes can generate a number of benefits. For
example, in construction companies, ERM can positively contribute to performance indicators, improve
decision making and control on projects, and reduce
losses caused by risks (Liu et al., 2011; Low et al.,
2013). In reality, companies carry out ERM for these
potential benefits (Pagach and Warr, 2011) and ensure
that these benefits far outweigh the costs related to
ERM initiation (Hallowell et al., 2013). To ensure
ERM success and the subsequent benefits, the management should identify the critical success factors (CSFs),
and thus take measures to ensure the effective implementation of these key areas of ERM.
In 2006, the State-owned Assets Supervision and
Administration Commission of the State Council of
China (2006) issued the Guidance to Enterprise Risk
Management for Central Enterprises to drive ERM implementation in central enterprises. Central enterprises are
those entities owned by Chinas central government. As
some of the leading Chinese construction companies
(CCCs) are among the central enterprises, it can be
inferred that ERM has been initiated and practised by
them. The CCCs that are state-owned but not central
enterprises may also initiate ERM.
The objectives of this study are to identify the CSFs
for ERM and investigate the interrelationships among
these CSFs in CCCs. Despite studies on the ERM
implementation in the banking (Wu and Olson,
2008), insurance (Hoyt and Liebenberg, 2011), and
energy industries (Muralidhar, 2010), few have been
focused on ERM in the construction industry. Thus,
this study expands the existing literature relating to
ERM through identifying a list of CSFs for ERM in
construction companies. By identifying the CSFs, the
management may better predict the probability of
success and the necessary steps to avoid failure and
identify problematic areas to undertake necessary
corrective actions (Hwang and Lim, 2013). In addition, although this study focuses on ERM in CCCs,
the implication of this study is not limited to them.
The management and operation of CCCs have a wider
range of implications and tend to affect the international construction market because CCCs have
ventured into over 180 countries (National Bureau of
Statistics of China, 2012). Hence, the identification
of the CSFs allows other construction companies to
prepare their customized lists of CSFs for ERM and
to better understand the key areas that are worth paying
attention to for ERM success. Therefore, this study can
significantly contribute to the body of knowledge
relating to ERM.

Traditionally, risk management is segmented and conducted in separate business units or departments (i.e.
silos) within a company. Silo-based risk management
fails to consider the interactions between risks
(Chapman, 2006; Cendrowski and Mair, 2009),
creates inefficient coordination between silos and
duplication of risk management expenditure (Meulbroek, 2002; Hoyt and Liebenberg, 2011), and may
overlook the most significant risk (Collier, 2009).
Different from the silo-based approach, ERM treats
each risk as part of the entire risk portfolio of an enterprise rather than as a discrete risk (Cumming and
Hirtle, 2001; Liebenberg and Hoyt, 2003), and
concerns understanding the risk interactions and how
risk response measures can deal with multiple risks
across multiple business areas (Chapman, 2006). In
addition, ERM attempts to consolidate a risk management process across all the levels within the organization, and concerns not only an enterprises view of
risks, but also the degree of coordination and consolidation with which the enterprise manages the risks
(Culp, 2002). Furthermore, ERM is viewed as a
top-down approach to risk management as it needs
the sponsorship of top management and is related to
the corporate strategy (Olson and Wu, 2008).
Both ERM and PRM are approaches to dealing with
risks that a company faces, but at different levels (Liu
et al., 2011, 2013). Hence, ERM and PRM do not
contradict each other. They share a similar management
process, in which risk identification, analysis and
response are critical steps. However, ERM and PRM
have different goals due to their different levels of focus.
ERM deals with risks at the enterprise level, focusing on
the strategic, operations, reporting and compliance
objectives of a company (Cendrowski and Mair,
2009), while PRM addresses risks at the project level
and focuses on project objectives, such as time, cost,
quality and safety objectives. In addition, PRM is still
necessary and should not be considered as a hindrance
to implementing ERM in a construction company.
PRM has been considered as one of the nine project
management knowledge areas (Project Management
Institute, 2008), and is critical to the success of projects
and the survival of construction companies. PRM can
be regarded as an integral part of ERM because project
risks are within the entire risk profile of a construction
company and ERM should be implemented at all levels
of a company, including the project level. Effective
PRM practices, which properly deal with project risks,
can contribute to ERM effectiveness throughout a company. In turn, ERM provides a new way to improve

1201

Enterprise risk management

the CSFs for ERM, could constitute a new framework

specifically for CCCs.

PRM in construction companies (Liu et al., 2013)

because ERM implementation involves better communication of project risk information, thus helping management to make better informed decisions and deal
with project risks more effectively and efficiently.
An ERM framework is described as a specific set of
functional activities and the associated definitions that
define the ERM system in an organization and its relationship with the organizational system (Dafikpaku,
2011). To facilitate ERM implementation in various
industries, the Committee of Sponsoring Organizations
of the Treadway Commission (2004) developed a
three-dimensional ERM conceptual framework. This
framework specifies how the people from the four organizational levels (i.e. entity-level, division, business
unit, and subsidiary) across an enterprise implement
the eight interrelated ERM components in order to
achieve strategic, operations, reporting and compliance
objectives. The eight components consist of internal
environment, objective setting, event identification, risk
assessment, risk response, control activities, information and communication, as well as monitoring. However, Liu et al. (2011) found that no CCCs had
adopted this framework, indicating that CCCs may
need a framework specifically for themselves. Thus, it
is necessary to identify the key activities of ERM in
CCCs, and these activities, which are represented by
Table 1

Critical success factors

CSFs describe those few key activities in which favourable results are absolutely necessary for a manager to
reach his or her goals (Rockart, 1982). This approach
has been widely applied to identify the key activities
in construction management. For instance, Tabish
and Jha (2011) evaluated the CSFs for public construction projects; Tang et al. (2012) investigated the CSFs
for international market entry; and Hwang et al. (2013)
explored the CSFs for publicprivate partnership
(PPP) projects. To gain an in-depth understanding of
ERM in CCCs and ensure ERM success, it is necessary
to make explicit the key areas of activities that are
essential for ERM success. Thus, the CSF method is
adopted in this study to identify the key activities of a
successful ERM programme. The identification of the
CSFs allows the management staff to take measures
to ensure the effective implementation of the key areas
of ERM.
A literature review was conducted to identify the
CSFs for ERM. As there have been few studies on
ERM in construction companies, the analysed

CSFs for ERM

References

Code

CSFs for ERM

CSF01 Commitment of the board and senior

management
CSF02 ERM ownership
CSF03 Risk appetite and tolerance
CSF04 Risk-aware culture
CSF05 Sufficient resources
CSF06 Risk identification, analysis and response
CSF07 Iterative and dynamic ERM process steps
CSF08 Leveraging risks as opportunities
CSF09 Risk communication
CSF10 A common risk language
CSF11 A risk management information system
(RMIS)
CSF12 Training programmes
CSF13 Formalized key risk indicators (KRIs)
CSF14 Integration of ERM into business processes
CSF15 Objective setting
CSF16 Monitoring, review and improvement of ERM
framework

 

10 11 12 13 14 15 Sum

   

   



 
  

 

 
 
  

  


 




 
 


  








8
4
9
6
6
7
4
4
2
5







  


4
1
5
2
1

Notes: References are as follows:

1. Aabo et al. (2005); 2. AON (2010); 3. Barton et al. (2002); 4. Cendrowski and Mair (2009); 5. Bowling and Rieger (2005); 6. Dafikpaku
(2011); 7. Duckert (2011); 8. Economist Intelligence Unit (2007); 9. Professional Risk Managers International Association (2008); 10. Garvey
(2008); 11. Muralidhar (2010); 12. Gupta (2011); 13. Segal (2011); 14. Stroh (2005); 15. Hallowell et al. (2013).

1202
literatures were related to ERM in various industries.
Some literatures presented successful ERM case studies, while others explored the critical factors contributing to successful ERM programmes. Thus, as Table 1
indicates, a total of 16 CSFs for ERM are identified.
Table 1 also shows how many times the literatures
mentioned each CSF to indicate the attention it has
attracted. These CSFs can describe the key activities
of an ERM programme, and are therefore hypothesized
to be critical to ERM success in CCCs. The implementation levels of these key areas can be used to measure
ERM maturity (Zhao et al., 2013). The section on data
analysis and discussion presents the detailed descriptions of these CSFs.

Zhao et al.
Literature
review
Survey

Preliminary survey questionnaire

Pilot study
Final survey questionnaire

Importance of the CSFs

Data
analysis

Ranking
technique
CSF ranking

Exploratory factor
analysis
CSF groupings
Structural equation
modelling (confirmatory
factor analysis + path
analysis)

Method and data presentation

As a systematic method of collecting data based on a
sample, the questionnaire survey technique has been
widely used to collect professional views on the CSFs
in construction management research (e.g. Li et al.,
2005; Kulatunga et al., 2009; Tabish and Jha, 2011;
Tang et al., 2012; Hwang and Lim, 2013). Thus, a
questionnaire survey was undertaken to collect the professional views on the CSFs for ERM in CCCs. The
population consisted of all the industry practitioners
with extensive experience in risk management in
CCCs, and all the academics who have gained in-depth
knowledge of risk management in CCCs through
research. As there was no sampling frame in this survey,
the sample was a non-probability sample. The
non-probability sampling plan can be used to obtain a
representative sample (Patton, 2001), and has been
recognized as appropriate when the respondents were
not randomly selected from the entire population, but
were rather selected based on whether they were willing
to participate in the study (Wilkins, 2011). A list of
senior and middle management staff of CCCs in Mainland China and the overseas subsidiaries and a list of
academics from the universities located in Mainland
China and Hong Kong were obtained. From April to
June 2012, survey questionnaires were sent to all the
390 practitioners and academics on the two lists.
In addition to the literature review that supported
the development of the survey questionnaire, face-toface interviews were conducted with four professionals
to solicit comments on the readability, comprehensiveness and accuracy of the preliminary questionnaire (see
Figure 1). One of them was from academia while the
other three were from CCCs based in Singapore. Based
on their comments, the authors made revisions to
improve the readability and accuracy of the description
of the CSFs, and added footnotes to explain the terminologies used. The final questionnaire presented the

Identify the CSFs for ERM

Conceptual framework

Figure 1

Research method

ERM definition and research objectives to the respondents and collected their general information, including
their organizations, work and/or research experience,
and designations. In addition, the questionnaire presented the 16 CSFs with the respective descriptions
and requested the respondents to rate the importance
of each CSF according to a five-point scale (1 = very
low, 2 = low, 3 = medium, 4 = high, and 5 = very high)
(see Appendix). Measuring the relative importance of
CSFs has also been used in other previous studies that
explored CSFs in the construction management area
(e.g. Li et al., 2005; Chen and Chen, 2007; Yang
et al., 2009; Chan et al., 2010).
It should be clarified that the findings presented in
this current paper form Phase I of a much larger
research project. Because of the word limit, this paper
is only able to present the CSFs for ERM in CCCs.
For this Phase I, only the ranking and grouping of the
CSFs for ERM are presented in this paper to provide
a fundamental understanding of the key areas of
ERM activities. In Phase II of the aforementioned larger study, another survey was conducted (but not presented here) to assess the implementation level of each
CSF for ERM in the CCCs operating overseas.
A total of 89 completed questionnaires were
received, representing a response rate of 23%. The 89
responses were adequate compared with the past studies relating to CCCs (e.g. 31 in Low and Jiang (2006)
and 45 in Ling et al. (2012)). Out of the 89 respondents, 25 were academics and 64 were practitioners
(see Table 2). Among the 64 industry respondents,
37 were from China while 12, 11, 2 and 2 were from
the overseas divisions of CCCs in Asia, Africa, Europe
and Latin America, respectively. Some of the 37

1203

Enterprise risk management

Table 2

Profile of respondents
Industry (N = 64)

Academia (N = 25)

Overall (N = 89)

Characteristics

Categorization

Work experience

510 years
1115 years
1620 years
2125 years
Over 25 years
Prof.
Associate Prof.
Senior mgmt.
Department mgmt.
Project mgmt.
China
Asia (w/o China)
Africa
Europe
Latin America

40
8
7
4
5

14
12
38
37
12
11
2
2

63
13
11
6
8

22
19
59
58
19
17
3
3

3
6
9
4
3
11
14

25

12
24
36
16
12
44
56

100

43
14
16
8
8
11
14
14
12
38
62
12
11
2
2

48
16
18
9
9
12
16
16
14
43
70
14
12
2
2

Title

Location

domestic practitioners also had overseas work experience. Thus, the data probably reflected the opinions
on CSFs for ERM from CCCs in the global construction market. Moreover, 52% of the respondents had
more than 10 years experience in the industry or academia, which further ensured the response quality.

Data analysis and discussion

Ranking of the CSFs for ERM
The Cronbachs alpha coefficient was 0.920, which was
much higher than the threshold of 0.70 (Nunnally,
1978) and showed high data reliability. The ranking
technique has been widely used in previous studies
completed by others to rank the relative importance
of the CSFs in the construction management domain
(e.g. Yang et al., 2009; Chan et al., 2010; Hwang and
Lim, 2013). In this study, the 16 CSFs for ERM were
ranked based on their relative importance mean scores.
As Table 3 indicates, the importance mean scores of
the CSFs range from 3.40 to 4.55. To test whether
each CSF was significantly important to ERM success
in CCCs, the one-sample t-test was conducted. The
p-values of all the CSFs were 0, suggesting that all
the CSFs had significant importance. In addition, the
Spearman rank correlation coefficient was 0.849 with
statistical significance at the 0.05 level. This implied
that the practitioners and academics agreed on the
overall importance ranking of the 16 CSFs despite the
differences in mean scores. A total of six CSFs obtained
overall importance mean scores over 4.00. The ranking
of the CSFs would enable the practitioners to understand which areas of activities of ERM implementation

are worthwhile to pay more attention to and to prioritize for resource investments.
Commitment of the board and senior management received the top rating, suggesting that the tone
at the top was perceived as the most important. As
ERM is a top-down approach, support, encouragement
and commitment at the senior level are of great importance to ERM implementation. Also, commitment of
the board and senior management was found to be an
internal force that drives ERM implementation within
companies in various industries (Kleffner et al., 2003;
Gates, 2006). Thus, the board and senior management
in construction companies should be committed to
ERM implementation. Such commitment should be
visible to make employees perceive ERM as a priority
for the leadership, and more importantly, should not
be interrupted by changes in the ERM champion
because ERM implementation is a long-term journey
spanning many years (Bowling and Rieger, 2005).
Risk identification, analysis and response occupied
the second position, implying that CCCs attached great
importance to the actual execution of ERM as this CSF
describes the critical steps of a generic risk management
process. To implement ERM, a company should adopt
a formalized ERM process. Specifically, the management needs to identify all categories of potential risks
from internal and external sources, and then prioritize
them using risk analysis techniques. Thus, the management can develop a list of top risks or a risk map, which
has been used in successful ERM cases (Aabo et al.,
2005), and appropriate risk response measures to deal
with the critical risks.
The third ranked CSF was objective setting, indicating that clearly identified objectives at various levels

1204
Table 3

Zhao et al.
Ranking of the CSFs for ERM
Industry

Academia

Overall

Code

ERM maturity criteria

Mean

Rank

Mean

Rank

Mean

Rank

p-value

CSF01
CSF02
CSF03
CSF04
CSF05
CSF06
CSF07
CSF08
CSF09
CSF10
CSF11
CSF12
CSF13
CSF14
CSF15
CSF16

Commitment of the board and senior management

ERM ownership
Risk appetite and tolerance
Risk-aware culture
Sufficient resources
Risk identification, analysis and response
Iterative and dynamic ERM process steps
Leveraging risks as opportunities
Risk communication
A common risk language
A risk management information system
Training programmes
Formalized key risk indicators
Integration of ERM into business processes
Objective setting
Monitoring, review and improvement of ERM framework

4.47
4.13
3.56
3.78
3.95
4.17
3.95
3.63
3.92
3.48
3.83
3.95
3.88
3.92
4.20
3.92

1
4
15
13
6
3
6
14
9
16
12
6
11
9
2
9

4.76
4.24
3.36
3.92
4.16
4.56
4.00
3.56
3.84
3.20
3.60
3.84
3.92
4.48
4.40
4.08

1
5
15
10
6
2
8
14
11
16
13
11
10
3
4
7

4.55
4.16
3.51
3.82
4.01
4.28
3.97
3.61
3.90
3.40
3.76
3.92
3.89
4.08
4.26
3.97

1
4
15
12
6
2
7
14
10
16
13
9
11
5
3
7

0a
0a
0a
0a
0a
0a
0a
0a
0a
0a
0a
0a
0a
0a
0a
0a

Notes:
a
The one-sample t-test result is significant at the 0.05 level (two-tailed).The Spearman rank correlation coefficient is 0.849 and significant
( p-value = 0) at the 0.05 level (two-tailed).

were highly important to ERM success in CCCs. As

ISO 31000:2009 defines risk as the effect of uncertainty
on objectives (International Organization for Standardization, 2009a), risk is closely associated with objective
setting. Also, the Committee of Sponsoring Organizations of the Treadway Commission (2004) recognized
objective setting as the precondition to risk identification, assessment and response. Thus, the management
of construction companies should clearly identify and
express their objectives at all levels, and regularly assess
deviations from plans against the objectives (Hopkinson, 2011). More importantly, as ERM should be
applied in strategy setting, the management should
attach more importance to strategic objectives.
ERM ownership was ranked fourth, suggesting
that successful ERM implementation in CCCs needed
an owner to centralize risk management and take
charge of risk oversight. This result was consistent with
the ERM practices in other industries (Banham, 2004).
An ERM owner can be a dedicated senior executive, a
stand-alone department, a board-level risk committee,
or even a chief risk officer (CRO). In addition, the creation of the ERM owner can signal the corporate
emphasis on risk management to its employees and
investors (Cendrowski and Mair, 2009). Who the
ERM owner is should also be openly communicated
to all the staff. Zhao et al. (2012) investigated the
ERM implementation in a CCC based in Singapore
and found that the ERM responsibility was included
in the function of the managing director while the
board served as a risk committee.

The fifth ranked CSF was integration of ERM into

business processes. This result echoed the guidance
issued by the State-owned Assets Supervision and
Administration Commission of the State Council of
China (2006). This guidance stipulates that ERM
should be fully integrated into the management and
business processes of an enterprise. These processes
include, but are not limited to decision making and
strategic planning. In all decision-making processes,
especially in strategic decision making, the management should consistently consider the risk identified
and anticipate the emerging risks. In addition, the management should incorporate ERM at organizational
planning and strategy stages (Sharman, 2002) and integrate ERM with other initiatives (Chitakornkijsil,
2010). However, full integration of ERM is not easy
and can be time consuming, and it would take from
three to five years for this to materialize in large companies once ERM is initiated. This is because of the
delays in moving level by level in the company and
the need for change management to overcome inertia
(Shortreed, 2010).
Another highly ranked CSF was sufficient
resources, implying that sufficient resources, such as
funds, qualified staff, time, knowledge and expertise,
were inevitable and necessary for ERM implementation
in CCCs. Thus, to advance ERM implementation, the
management should consistently allocate resources for
improving the risk management process, tools, techniques and personnel skills. On the other hand, insufficient inputs of time, funds and staff, lack of internal

1205

Enterprise risk management

knowledge and expertise, and lack of risk management
techniques and tools would greatly hinder ERM implementation and success (Gates, 2006; Muralidhar,
2010).

Underlying CSF groupings

Exploratory factor analysis (EFA) identifies a relatively
small and manageable set of underlying (i.e. latent) factor groupings that can be used to represent the correlations among a large set of interrelated variables. EFA
requires two essential stages: (1) factor extraction,
which determines the initial number of the groupings
underlying a set of variables; and (2) factor rotation,
which makes the groupings more interpretable and
determines the final number of the underlying groupings (Norusis, 1992). Factor rotation can be orthogonal
or oblique. EFA has been widely used in the previous
studies that investigated CSFs in the construction management domain (e.g. Li et al., 2005; Chen and Chen,
2007; Chan et al., 2010; Ika et al., 2012), and can be
used as a precursor to latent variable modelling or confirmatory factor analysis (CFA) (DiStefano et al.,
2009). This method was therefore adopted to explore
the underlying groupings among the 16 CSFs for
ERM.
The ratio of sample size to the number of variables
in this study was 5.56, which was higher than the ratio
of 5.00 recommended by Gorsuch (1983). Thus, the
sample size was large enough for factor analysis. In
addition, the appropriateness of the factor analysis for
the factor extraction was assessed in various ways.
The Kaiser-Meyer-Olkin (KMO) value was 0.892,
indicating a high degree of common variance among
the CSFs. The value of the test statistic for Bartletts
sphericity was large (chi-square = 741.312) and the
p-value was 0, suggesting that the population correlation matrix was not an identity matrix. Hence, it can
be concluded that the data collected were appropriate
for EFA.
The principal components analysis was used to
identify the underlying grouped factors and obtained
a three-factor solution with eigenvalues over 1.000.
The three factor groupings explained approximately
62% of the variance, higher than the guideline of
60% recommended by Malhotra (2006).
The varimax rotation (i.e. orthogonal) method,
which has been widely used in previous CSF studies
(e.g. Chan et al., 2004; Li et al., 2005; Yang et al.,
2010), is actually problematic (Hetzel, 1996; Pett
et al., 2003; Matsunaga, 2010). First, the orthogonality
of factors is often an unrealistic assumption. In almost
all fields of social science, any factor is to some extent
related to other factors, and thus, arbitrarily forcing

Table 4

Results of the EFA on CSFs for ERM

CSF grouping

CSF code
CSF06
CSF15
CSF13
CSF16
CSF05
CSF14
CSF07
CSF10
CSF09
CSF04
CSF11
CSF12
CSF08
CSF01
CSF02
CSF03
Eigenvalue
Variance (%)
Cumulative variance (%)

0.802
0.747
0.744
0.582
0.558
0.470
0.424
0.853
0.844
0.682
0.600
0.548
0.463

7.410
46
46

1.316
8
54

0.779
0.676
0.664
1.122
7
62

Notes: Grouping 1: Execution and integration. Grouping 2:

Communication and understanding. Grouping 3: Commitment and
involvement of top management.

the factors to be orthogonal may result in biasing the

reality. In addition, even if the factors are indeed uncorrelated, the orthogonality should be empirically verified
and revealed via EFA with an oblique rotation method
(Matsunaga, 2010). Therefore, the promax rotation
method, which is an oblique rotation method that provides solutions with correlated components, was
adopted in this study. This method was also adopted
in past construction management studies using EFA
(e.g. Lam et al., 2008; Lee and Chan, 2008; Chan
et al., 2010). Table 4 indicates the CSF groupings
based on the promax rotation.
The factor loading value reflects the degree of
contribution of individual CSFs to each underlying
grouping. Most CSFs obtained the factor loading
above the threshold of 0.45 (Comrey, 1973). Iterative and dynamic ERM process steps obtained the
lowest factor loading, which was slightly lower than
the threshold of 0.45 recommended by Comrey
(1973), but it was still above the lowest acceptable
level of 0.40 (Matsunaga, 2010). Thus, the 16 CSFs
were classified into three groupings: execution and
integration, communication and understanding, and
commitment and involvement of top management.
Each grouping was labelled by considering the CSFs
with high loadings in the grouping and what these
CSFs had in common.

1206
Execution and integration
This grouping accounted for 46% of the total variance
and consisted of seven CSFs, which were all associated
with the execution and integration of ERM. The CSF
with highest factor loading was risk identification,
analysis and response, which described the three critical steps in the PRM process. PRM can be seen as an
integral part of ERM because project risks are within
the entire risk profile of a construction company and
ERM should be implemented at all levels, including
the project level. Thus, executing the three risk management steps included in this CSF can be seen as executing an ERM process.
The CSF with the second highest factor loading was
objective setting. Clearly identified objectives are closely related to the ERM process execution because they
are the preconditions to risk identification, risk assessment and risk response (Committee of Sponsoring
Organizations of the Treadway Commission, 2004).
Another high-loading CSF was formalized key risk
indicators. A key risk indicator (KRI) is a measure to
indicate the potential, presence, level, or trend of a risk
(Hwang, 2010, p. 126). KRIs help monitor risks and
involve predetermined thresholds that will trigger
actions by management to adjust its strategies proactively to manage the risks accordingly (Beasley et al.,
2010). Duckert (2011) argued that well-defined KRIs
were critical to ERM success and that a data-centric
approach to ERM with KRIs would be the only sensible
way to establish it in the twenty-first century. Thus,
KRIs should be identified for all the critical risks that
a company faces and need to be periodically analysed
and revisited by risk owners (Risk and Insurance Management Society, 2008).
In addition, the effective ERM process execution
could be guaranteed by monitoring, review and
improvement of ERM framework and sufficient
resources. According to ISO 31000:2009, the management should periodically measure progress against the
risk management plan, and review whether the risk
management framework is still appropriate (International Organization for Standardization, 2009b). Considering the results of monitoring and reviews, the
management can make decisions on how to improve
the ERM framework. All the steps of an ERM process
need resources, including not only time, money and
people, but also knowledge and expertise.
This CSF grouping also contained integration of
ERM into business processes. To make risks effectively managed across an enterprise, ERM should be
fully integrated into the business and management processes of an enterprise although it is time consuming
(Shortreed, 2010). Thus, integration and execution of
ERM are closely related.

Zhao et al.
The last CSF in this grouping was iterative and
dynamic ERM process steps. An ERM process should
be iterative and dynamic, and thus can comprise a
continuous improvement cycle. Also, such an ERM
process allows the management to monitor, identify
and analyse new risks that may emerge following
changes in the environment (Garvey, 2008; AON,
2010; Dafikpaku, 2011).

Communication and understanding

This CSF grouping explained 8% of the total variance and included six CSFs for ERM. The CSF with
the highest factor loading was a common risk language, indicating that the CSF greatly contributed
to communication and understanding related to
ERM. A common risk language, which can explain
the terminologies and methodologies and contribute
to a common understanding of their meanings and
context throughout an enterprise, was viewed as a
key quality of an effective ERM programme (Duckert, 2011) and an imperative for successful ERM
deployment (Institute of Management Accountants,
2006). In addition to contributing to the understanding of risk management terminologies and methodologies, such a risk language would underpin risk
culture, facilitate risk communication, cut through
the layers and break down the silos (Espersen,
2007). Also, the common risk language should be
used consistently in all communications to become
a part of mainstream dialogue (Duckert, 2011). To
facilitate the acceptance of a risk language, a glossary
of risk terms, which provides risk management practitioners with a common reference resource for risk
terminologies (Espersen, 2007), can be created and
distributed within the enterprise. However, common
risk languages have not been widely used in CCCs
(Liu et al., 2011).
Risk communication obtained the second highest
factor loading. To be successful, ERM should have
proper communication flow between management
and the risk management function (Kleffner et al.,
2003). Relevant and reliable risk information obtained
from various sources should be communicated transparently across multiple projects and departments of a
company. Transparent risk communication should
encourage individual comments and expert views during the development of cross-functional understanding
of risks and risk management strategies (AON, 2010).
Also, there should be a communication mechanism to
ensure that critical risk information is reported to the
board and senior management in a periodic or timely
manner (Dafikpaku, 2011), and meanwhile, to ensure
that line managers, project managers and staff are

1207

Enterprise risk management

promptly notified of critical information and decisions
from the top management (Barton et al., 2002).
Another CSF with a high factor loading was riskaware culture. Nothing is more crucial to ERM success in an organization than a supportive culture
(Cendrowski and Mair, 2009; Brooks, 2010), which
can be called either a risk-aware culture (Protiviti,
2006; Brooks, 2010) or a risk culture (Collier,
2009; Sanchez et al., 2009) in the existing literature
about ERM. A risk-aware culture has been seen as
a success factor for ERM implementation (Stroh,
2005; Ward, 2006; KPMG, 2010) and requires the
buy-in of organizational individuals at all levels (Hopkin, 2010) and the embedment into the corporate
culture (AON, 2010). In addition, a risk-aware culture enables employees to speak up and then be listened to by decision makers, and thus allows
decision makers to understand the importance of
identifying and assessing risks in current and potential business activities and the importance of risk
communication (Brooks, 2010). Thus, a risk-aware
culture can contribute to risk communication and
understanding of ERM.
Also, communication and understanding can be
facilitated by the application of a risk management
information system (RMIS). It was suggested that
information and communication technology should
play a key role in enabling information flow across an
enterprise (Dafikpaku, 2011). Thus, a RMIS can serve
as a platform for risk communication and reporting,
record risk management activities, or even undertake
risk identification and analysis and provide response
plans.
Moreover, training programmes, which involve
communicating the ideas and perceptions regarding
ERM implementation, can be used to reduce
misunderstanding and anxiety about ERM among
employees and help them clearly understand the
ERM philosophy and policy, the ERM process, and
the value of ERM. Such programmes also enable
employees to understand that ERM is not a quick
process but a multi-year journey.
The last CSF in this grouping was leveraging
risks as opportunities. To clearly understand
ERM, management needs to first understand the
nature of risk. Risks are double-edged (Zou et al.,
2007) and encompass both threats and opportunities (Ward and Chapman, 2003). In addition to
dealing with downside risks (threats), ERM also
involves leveraging and exploiting the upside risks
(opportunities) for competitive advantage (Banham,
2004; Pagach and Warr, 2010; Dafikpaku, 2011).
Thus, this CSF is associated with the understanding
of ERM.

Commitment and involvement of top

management
This CSF grouping was responsible for 7% of the total
variance and consisted of three CSFs. In this grouping,
the highest factor loading was achieved by commitment of the board and senior management. It is worth
iterating that such commitment has been recognized as
an internal driver for ERM implementation (Kleffner
et al., 2003; Gates, 2006) and should be visible and
continual because it is essential for organizational
buy-in, aligning risk strategy with organizational objectives, and incorporating a risk-based approach at the
planning and strategy stages (Sharman, 2002).
Another CSF that belonged to this grouping was
ERM ownership. In a CCC, the ERM responsibility
could be included in the function of a senior executive
and a board-level risk committee could be set up specifically for ERM implementation (Zhao et al., 2012).
Thus, the top management can be involved in ERM
implementation. However, ERM ownership may be
influenced by the company size because previous studies indicated that the size was associated with ERM
adoption (Beasley et al., 2005; Hoyt and Liebenberg,
2011). For example, in a large CCC, both a board risk
committee and a stand-alone department could be set
up for ERM implementation.
Risk appetite and tolerance was the last CSF in
this grouping. Risk appetite is the amount and type
of risk that an organization is willing to pursue and
retain, while risk tolerance is an organizations or
stakeholders readiness to bear the risk after risk
response in order to achieve its objectives (International Organization for Standardization, 2009a, p. 9).
Risk appetite, established by management with oversight by the board of directors, relates primarily to the
business model and is a guidepost in strategy setting,
while risk tolerance relates primarily to the organizations objectives and is tactical (Protiviti, 2006). Thus,
operating within the risk tolerance provides the management with greater assurance that the company is
within the risk appetite, which produces a higher degree
of comfort that the company will achieve its objectives.
According to the guidance issued by the State-owned
Assets Supervision and Administration Commission
of the State Council of China (2006), risk appetite
and tolerance should be determined by the board of
directors. Thus, this CSF can be closely associated with
the involvement of top management.

Conceptual framework and validation

Based on the EFA results, a conceptual framework was
developed to describe the key activities of ERM as well

1208

Zhao et al.
CSF01 CSF02 CSF03
CSF05
CSF04

Commitment and
involvement of top
management

CSF08
CSF09

CSF12

Figure 2

CSF07
CSF13

Hypothesis 1

CSF10
CSF11

CSF06

Communication and
understanding

Hypothesis 2

Execution and integration

Hypothesis 3

CSF14
CSF15
CSF16

Conceptual framework for ERM

as the hypothetical relationships among the three CSF

groupings (see Figure 2). This framework involves
three hypotheses as follows:
Hypothesis 1: The commitment and involvement of top
management positively influences the communication
and understanding relating to ERM.
Hypothesis 2: The commitment and involvement of top
management positively influences the execution and
integration of ERM.
Hypothesis 3: The communication and understanding
relating to ERM positively influences the execution
and integration of ERM.

The structural equation modelling (SEM) method has

been seen as one of the most suitable techniques for
analysing the possible relationships among variables
(Eybpoosh et al., 2011). Observable variables and
latent variables are used in SEM. The former can be
directly measured, while the latter are hypothetical or
theoretical constructs inferred from the observable variables. SEM consists of measurement and structural
models. In this study, the measurement model provides
the relationships between each CSF (the observable
variable) and its respective grouping (the latent variable), while the structural model presents the relationships among the CSF groupings (the latent variables).
This present study is aligned with the reflective model
because the CSFs denote the effects of the CSF grouping that they belong to.
As a second-generation multivariate statistical technique, SEM combines both econometric and psychometric perspectives in the statistical modelling and
enables a maximally efficient fit between data and a
structural model because both CFA and path analysis
can be executed simultaneously in a single structural
equation model (Lim et al., 2011). Thus, SEM is chosen
in this study.
In addition, there are two types of SEM: covariancebased SEM (CB-SEM) and partial least squares

structural equation modelling (PLS-SEM). Although

CB-SEM has been used in construction management
studies (e.g. Eybpoosh et al., 2011; Doloi et al., 2012),
PLS-SEM has some advantages over it. For instance,
PLS-SEM can analyse complex problems without
requiring a large sample size and normal distribution of
data, and estimate latent constructs as linear combinations of observable variables through weight relations
(Fornell and Bookstein, 1982; Chin, 1998; Hair et al.,
2012; Lim et al., 2012). Thus, PLS-SEM has gradually
been adopted in construction management research in
recent years. For example, Aibinu et al. (2011) adopted
PLS-SEM to analyse the organizational justice and
cooperative behaviour in the construction project claims
process while Lim et al. (2012) used PLS-SEM to
develop and validate mathematical models for predicting
organizational flexibility of construction companies in
Singapore. Because the number of the questionnaire
responses was not large, PLS-SEM was adopted to validate the conceptual framework. The three CSF groupings produced by the EFA served as the latent variables
in the structural and measurement models.
CFA is to test the hypothesis that the relationship
between the observable variables and their underlying
latent variable exists. The hypothesized model is based
on theory and/or previous analytic research. In addition,
CFA usually serves as the first step to assess the proposed measurement model. Most of the rules regarding
assessment of model fit and model modification in SEM
apply equally to CFA. In this study, CFA was conducted
to test whether the data fitted the measurement model,
i.e. to confirm the CSF groupings produced by the previous EFA. This hybrid approach combining EFA and
CFA was recommended by Thompson (2003) and
Matsunaga (2010). As the latent factors in CFA are usually specified to be interrelated, the promax rotation
used in the EFA helped maintain conceptual consistency across EFA and CFA.
The reliability and validity of the CSFs should be
assessed. Specifically, the factor loadings should be at

1209

Enterprise risk management

least 0.45 (Comrey, 1973); Cronbachs alpha coefficient should be at least 0.70 (Nunnally, 1978); the
composite reliability (CR) score should be at least
0.70 (Hair et al., 1998); the average variance extracted
(AVE) value should be at least 0.50 (Fornell and Larcker, 1981); and for adequate discriminant validity, the
square root of the AVE score of each construct should
exceed the inter-construct correlation (Fornell and Larcker, 1981; Chin, 1998). In addition, with respect to
the indicator reliability, indicators with factor loadings
below 0.70 should only be removed if deleting this indicator leads to an increase in CR above the suggested
threshold value (Hair et al., 2011). Nevertheless, the
indicators with loadings below 0.70 could be retained
because of their contributions to content validity (Hair
et al., 2011).
The results indicated that the CFA factor loadings
ranged from 0.596 to 0.878 and that the AVE, CR
and Cronbachs alpha values were above their respective thresholds (see Table 5). In addition, no correlation between any two CSF groupings was larger than
the square root of the AVEs of them (see Table 6),
which provided the evidence of discriminant validity
and suggested that the three groupings were different
from each other. Thus, the measurement model was
reliable and valid for the structural path modelling.
Then, the bootstrapping technique (Efron, 1987;
Davison and Hinkley, 1997) was applied to estimate
the significance of path coefficients and test the hypotheses. In this study, the number of bootstrap samples
was 5000, as recommended by Hair et al. (2011), and
Table 5

The reliability and validity of the CSFs

CSF
Grouping code
CITM

CU

EI

CSF01
CSF02
CSF03
CSF04
CSF08
CSF09
CSF10
CSF11
CSF12
CSF05
CSF06
CSF07
CSF13
CSF14
CSF15
CSF16

Factor
loading
0.827
0.795
0.769
0.795
0.596
0.878
0.739
0.792
0.773
0.707
0.726
0.722
0.745
0.723
0.791
0.815

AVE

CR

Cronbachs
alpha

0.636 0.840

0.713

0.588 0.849

0.857

0.599 0.899

0.868

Notes: CITM = commitment and involvement of top management;

CU = communication and understanding; and EI = execution and
integration.

Table 6
Grouping
CITM
CU
EI

Discriminant validity of CSF groupings

CITM
0.797
0.537
0.637

CU

EI

0.767a
0.736

0.748a

Notes: The square root of AVE of each grouping.

CITM = commitment and involvement of top management; CU
= communication and understanding; and EI = execution and
integration.

the number of cases was equal to the number of

responses (i.e. 89). The critical t-value for a two-tailed
test was 1.96 (significance level = 0.05). The bootstrapping results showed that the three path coefficients
were positive and significant at the 0.05 level (see
Table 7), implying that the three hypotheses were supported and that the structural model was validated.
Therefore, the conceptual framework was validated.
The rationale behind this framework is discussed as follows. The commitment of top management tends to
drive ERM implementation (Kleffner et al., 2003;
Gates, 2006) and the leadership and involvement of
top management signal the emphasis on ERM to
employees. First, the commitment and involvement of
top management can guarantee the sponsorship of
training programmes, and ensure the creation of risk
communication mechanisms as well as the use of the
common risk language and RMIS. Also, the tone at
the top could help reduce the influence of unsupportive
culture and encourage the creation of a risk-aware culture. Thus, the commitment and involvement of top
management can facilitate the communication and
understanding relating to ERM.
Secondly, the commitment and involvement of top
management can ensure that sufficient resources are
invested in ERM execution, objectives at all levels are
clearly identified and expressed, and that KRIs are
identified for all the critical risks of a company. Additionally, it would take several years to fully integrate
ERM into business and management processes, during
which there may be changes in senior management
roles. Thus, continual commitment and involvement
of top management ensures that execution and integration would not be disrupted by changes within top
management.
Furthermore, effective risk communication across a
company provides reliable risk information to management and helps them execute the ERM process while a
risk-aware culture contributes to the identification of
emerging risks. Meanwhile, the understanding of
ERM would help reduce the resistance to ERM
practices resulting from a biased perception or misunderstanding, and facilitate the integration of ERM into

1210
Table 7

Zhao et al.
Path coefficients and significance

Hypothetical path
Hypothesis 1: CITM CU
Hypothesis 2: CITM EI
Hypothesis 3: CU EI

Path coefficient

t-value

Interpretation

0.537
0.324
0.582

5.873
3.612
7.610

Supported
Supported
Supported

Notes: CITM = commitment and involvement of top management; CU = communication and understanding; and EI = execution and
integration.

business and management processes. Therefore, communication and understanding can positively contribute to the execution and integration of ERM.

(2)

(3)

Conclusions and recommendations

The objectives are to identify the CSFs for ERM and
investigate the interrelationships among these CSFs in
CCCs. The analysis results implied that all the 16
CSFs identified from the literature review were significantly important to ERM success in CCCs, which was
consistent with the findings from the literature review
relating to CSFs for ERM in various other industries
outside construction. The top-ranked CSFs represented the most important areas of a successful ERM
programme. Given the resource constraints, the management would allocate resources for the most important areas rather than all the key areas.
In addition, the EFA results showed three underlying CSF groupings: execution and integration, communication and understanding, and commitment and
involvement of top management. The commitment
and involvement of top management positively contributed to the communication and understanding as well
as the execution and integration of ERM, while the
communication and understanding facilitated the execution and integration of ERM. The three CSF groupings and the inherent interrelationships constituted a
conceptual framework that described the key areas of
ERM activities in CCCs. Compared with the frameworks that had rarely been used in CCCs (Liu et al.,
2011), this proposed framework indicates the groupings of key ERM activities as well as the inter-grouping
relationships that are specifically for CCCs, thus providing for the first time a better understanding of
ERM in CCCs.
The managerial implications that can be drawn
from this study include the following:
(1)

Top management should have a visible and

continual commitment to ERM implementation and be involved in ERM implementation,
which is critical to other key areas of ERM.

(4)

(5)

(6)

The management should adopt and consistently

execute a formalized ERM process throughout
the company.
The management should clearly identify and
express objectives at all levels, and regularly
assess deviations from plans against the objectives.
The company should appoint a dedicated senior
executive, or set up either a stand-alone department or a board-level committee as the ERM
owner to take charge of ERM implementation.
The management should integrate ERM into all
daily management processes and consistently
consider risk information, risk tolerance and
appetite, and risk response strategies in all decision-making activities, especially in strategic
decision making.
The management should allocate sufficient
resources for the implementation of the key
areas of an ERM programme.

Although the objectives are achieved, there are

limitations to conclusions that may be drawn from the
results. First, the CSFs identified in this study may not
be exhaustive with the passage of time. Second, because
of the difficulty in constructing a sampling frame, this
study used the non-probability sample. Despite the
inherent limitation of this sampling method, it can still
be used to obtain a representative sample (Patton,
2001), and has been recognized as being appropriate
when the respondents were not randomly selected from
the entire population, but were rather selected based on
whether they were willing to participate in the study
(Wilkins, 2011). Also, as the data were collected
from the professionals with experience and knowledge
relating to ERM in CCCs, caution is warranted when
the analysis results are interpreted and generalized.
Nonetheless, the implications of this study are not
limited to CCCs because the management in other
companies could use the CSFs identified from the literature review and follow the research method adopted in
this study to prepare the customized list of CSFs for
ERM, according to the characteristics and real-world
circumstances faced by them. Also, the findings of this

Enterprise risk management

study provide valuable information for future studies
related to ERM in the global construction industry.
Hence, this study contributes to the body of knowledge
relating to ERM in the broader global community.
Future research is recommended to focus on the
theoretical nexus between the CSFs and ERM based
on an appropriately chosen quantitative and/or qualitative analysis. In addition, as the CSFs describe the key
areas that should be linked to the performance indicators (Hwang and Lim, 2013), future research should
develop a set of metrics to measure ERM performance,
based on the identification of the CSFs.

References
Aabo, T., Fraser, J.R.S. and Simkins, B.J. (2005) The rise
and evolution of the chief risk officer: enterprise risk management at Hydro One. Journal of Applied Corporate
Finance, 17(3), 6275.
Aibinu, A.A., Ling, F.Y.Y. and Ofori, G. (2011) Structural
equation modelling of organizational justice and cooperative behaviour in the construction project claims process:
contractors perspectives. Construction Management and
Economics, 29(5), 46381.
AON (2010) Global Risk Management Survey 2010, AON plc,
Chicago, IL.
Banham, R. (2004) Enterprising views of risk management.
Journal of Accountancy, 197(6), 6571.
Barton, T.L., Shenkir, W.G. and Walker, P.L. (2002) Making Enterprise Risk Management Pay Off, Financial Times/
Prentice Hall, Upper Saddle River, NJ.
Beasley, M.S., Clune, R. and Hermanson, D.R. (2005)
Enterprise risk management: an empirical analysis of factors associated with the extent of implementation. Journal
of Accounting and Public Policy, 24(6), 52131.
Beasley, M.S., Branson, B.C. and Hancock, B.V. (2010)
Developing Key Risk Indicators to Strengthen Enterprise Risk
Management. ERM Initiative at North Carolina State University and the Committee of Sponsoring Organizations of
the Treadway Commission, Raleigh, NC.
Bowling, D.M. and Rieger, L.A. (2005) Success factors for
implementing enterprise risk management. Bank Accounting & Finance, 18(3), 216.
Brooks, D.W. (2010) Creating a risk-aware culture, in Fraser,
J. and Simkins, B.J. (eds.) Enterprise Risk Management, John
Wiley & Sons, Hoboken, NJ, pp. 8796.
Cendrowski, H. and Mair, W.C. (2009) Enterprise Risk Management and COSO: A Guide for Directors, Executives, and
Practitioners, John Wiley & Sons, Hoboken, NJ.
Chan, A.P.C., Chan, D.W.M., Chiang, Y., Tang, B., Chan,
E.H.W. and Ho, K.S.K. (2004) Exploring critical success
factors for partnering in construction projects. Journal of
Construction Engineering and Management, 130(2), 18898.
Chan, A.P.C., Lam, P.T.I., Chan, D.W.M., Cheung, E. and
Ke, Y. (2010) Critical success factors for PPPs in infrastructure developments: Chinese perspective, Journal of
Construction Engineering and Management, 136(5), 48494.

1211
Chapman, R. (2006) Simple Tools and Techniques for Enterprise
Risk Management. John Wiley & Sons, Chichester.
Chen, W.T. and Chen, T.T. (2007) Critical success factors
for construction partnering in Taiwan. International Journal
of Project Management, 25(5), 47584.
Chin, W.W. (1998) The partial least squares approach to
structural equation modeling, in Marcoulides, G.A. (ed.)
Modern Methods for Business Research, Lawrence Erlbaum
Associates, Mahwah, NJ, pp. 295335.
Chitakornkijsil, P. (2010) Enterprise risk management, International Journal of Organizational Innovation, 3(2), 30937.
Collier, P.M. (2009) Fundamentals of Risk Management for
Accountants and Managers. Butterworth-Heinemann, Oxford.
Committee of Sponsoring Organizations of the Treadway
Commission (2004) Enterprise Risk Management: Integrated
Framework: Executive Summary & Framework, COSO,
Jersey City, NJ.
Comrey, A.L. (1973) A First Course in Factor Analysis,
Academic Press, New York.
Culp, C.L. (2002) The revolution in corporate risk management: a decade in innovations in process and products.
Journal of Applied Corporate Finance, 14(4), 826.
Cumming, C. and Hirtle, B. (2001) The challenges of risk
management in diversified financial companies. FRBNY
Economic Policy Review, 7(1), 117.
Dafikpaku, E. (2011) The strategic implications of enterprise
risk management: a framework. Paper presented at the
2011 Enterprise Risk Management Symposium, Chicago,
IL, 1416 March.
Davison, A.C. and Hinkley, D.V. (1997) Bootstrap Methods
and Their Application, Cambridge University Press, Cambridge.
DiStefano, C., Zhu, M. and Mindrila, D. (2009) Understanding and using factor scores: considerations for the
applied researcher. Practical Assessment, Research & Evaluation, 14(20), 111.
Doloi, H., Sawhney, A. and Iyer, K. (2012) Structural equation model for investigating factors affecting delay in Indian
construction projects. Construction Management and Economics, 30(10), 86984.
Duckert, G.H. (2011) Practical Enterprise Risk Management: A
Business Process Approach, John Wiley & Sons, Hoboken, NJ.
Economist Intelligence Unit (2007) Best Practice in Risk Management, EIU, London.
Efron, B. (1987) Better bootstrap confidence intervals.
Journal of the American Statistical Association, 82(397),
17185.
Espersen, D. (2007) The language of risk. Internal Auditor, 64
(3), 6973.
Eybpoosh, M., Dikmen, I. and Birgonul, M.T. (2011) Identification of risk paths in international construction projects
using structural equation modeling. Journal of Construction
Engineering and Management, 137(12), 116475.
Fornell, C. and Bookstein, F.L. (1982) Two structural equation models: LISREL and PLS applied to consumer exitvoice theory. Journal of Marketing Research, 19(4), 44052.
Fornell, C. and Larcker, D.F. (1981) Evaluating structural
equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 3950.

1212
Garvey, P.R. (2008) Analytical Methods for Risk Management.
CRC Press, Boca Raton, FL.
Gates, S. (2006) Incorporating strategic risk into enterprise
risk management: a survey of current corporate practice.
Journal of Applied Corporate Finance, 18(4), 8190.
Gordon, L.A., Loeb, M.P. and Tseng, C.Y. (2009) Enterprise risk management and firm performance: a contingency perspective. Journal of Accounting and Public Policy,
28(4), 30127.
Gorsuch, R.L. (1983) Factor Analysis, 2nd edn, Erlbaum,
Hillsdale, NJ.
Gupta, P.K. (2011) Risk management in Indian companies:
EWRM concerns and issues. Journal of Risk Finance, 12
(2), 12139.
Hair, J.F., Anderson, R.E., Tatham, R.L. and Black, W.C.
(1998) Multivariate Data Analysis with Readings, International edn, Prentice Hall, Englewood Cliffs, NJ.
Hair, J.F., Ringle, C.M. and Sarstedt, M. (2011) PLS-SEM:
indeed a silver bullet. Journal of Marketing Theory and Practice, 19(2), 13951.
Hair, J.F., Sarstedt, M., Pieper, T.M. and Ringle, C.M.
(2012) The use of partial least squares structural equation
modeling in strategic management research: a review of
past practices and recommendations for future applications. Long Range Planning, 45(56), 32040.
Hallowell, M.R., Molenaar, K.R. and Fortunato, B.R. (2013)
Enterprise risk management strategies for state departments of transportation. Journal of Management in Engineering, 29(2), 11421.
Hetzel, R.D. (1996) A primer on factor analysis with comments on patterns of practice and reporting, in Thompson,
B. (ed.) Advances in Social Science Methodology, Vol. 4, JAI,
Greenwich, CT, pp. 175206.
Hopkin, P. (2010) Fundamentals of Risk Management, Kogan
Page, London.
Hopkinson, M. (2011) The Project Risk Maturity Model: Measuring and Improving Risk Management Capability, Gower,
Burlington, VT.
Hoyt, R.E. and Liebenberg, A.P. (2011) The value of enterprise risk management. Journal of Risk and Insurance, 78(4),
795822.
Hwang, B.G. and Lim, E.S.J. (2013) Critical success factors
for key project players and objectives: case study of Singapore. Journal of Construction Engineering and Management,
139(2), 20415.
Hwang, B.G., Zhao, X. and Gay, M.J.S. (2013) Public private
partnership projects in Singapore: factors, critical risks and
preferred risk allocation from the perspective of contractors.
International Journal of Project Management, 31(3), 42433.
Hwang, S. (2010) Identifying and communicating key risk
indicators, in Fraser, J.R.S. and Simkins, B.J. (eds.) Enterprise Risk Management, John Wiley & Sons, Hoboken, NJ,
pp. 12540.
Ika, L.A., Diallo, A. and Thuillier, D. (2012) Critical success
factors for World Bank projects: an empirical investigation.
International Journal of Project Management, 30(1), 10516.
Institute of Management Accountants (2006) Enterprise Risk
Management: Frameworks, Elements, and Integration, IMA,
Montvale, NJ.

Zhao et al.
International Organization for Standardization (2009) Guide
73:2009 Risk Management: Vocabulary, ISO, Geneva.
International Organization for Standardization (2009) ISO
31000:2009 Risk Management: Principles and Guidelines,
ISO, Geneva.
Kleffner, A.E., Lee, R.B. and McGannon, B. (2003) The
effect of corporate governance on the use of enterprise risk
management: evidence from Canada. Risk Management and
Insurance Review, 6(1), 5373.
KPMG (2010) Charting a Safe and Sustainable Growth
Journey: Singapore Enterprise Risk Management Survey
2010, KPMG in Singapore, Singapore.
Kulatunga, U., Amaratunga, D. and Haigh, R. (2009) Critical success factors of construction research and development. Construction Management and Economics, 27(9),
891900.
Lam, E.W., Chan, A.P. and Chan, D.W. (2008) Determinants of successful design-build projects. Journal of Construction Engineering and Management, 134(5), 33341.
Lee, G.K. and Chan, E.H. (2008) Factors affecting urban
renewal in high-density city: case study of Hong Kong.
Journal of Urban Planning and Development, 134(3),
1408.
Li, B., Akintoye, A., Edwards, P.J. and Hardcastle, C. (2005)
Critical success factors for PPP/PFI projects in the UK
construction industry. Construction Management and Economics, 23(5), 45971.
Liebenberg, A.P. and Hoyt, R.E. (2003) The determinants of
enterprise risk management: evidence from the appointment of chief risk officers. Risk Management and Insurance
Review, 6(1), 3752.
Lim, B.T.H., Ling, F.Y.Y., Ibbs, C.W., Raphael, B. and Ofori, G. (2011) Empirical analysis of the determinants of
organizational flexibility in the construction business.
Journal of Construction Engineering and Management, 137
(3), 22537.
Lim, B.T.H., Ling, F.Y.Y., Ibbs, C.W., Raphael, B. and Ofori, G. (2012) Mathematical models for predicting organizational flexibility of construction firms in Singapore.
Journal of Construction Engineering and Management, 138
(3), 36175.
Ling, F.Y.Y., Li, S., Low, S.P. and Ofori, G. (2012) Mathematical models for predicting Chinese A/E/C firms competitiveness. Automation in Construction, 24, 4051.
Liu, J.Y., Low, S.P. and He, X. (2011) Current practices and
challenges of implementing enterprise risk management
(ERM) in Chinese construction enterprises. International
Journal of Construction Management, 11(4), 4963.
Liu, J.Y., Zou, P.X.W. and Gong, W. (2013) Managing project risk at enterprise level: exploratory case studies in
China. Journal of Construction Engineering and Management,
139(9), 126874.
Low, S.P. and Jiang, H. (2006) Analysing ownership, locational and internalization advantages of Chinese construction MNCs using rough sets analysis. Construction
Management and Economics, 24(11), 114965.
Low, S.P., Liu, J.Y., Ng, S.H.M. and Liu, X. (2013) Enterprise risk management and the performance of local con-

Enterprise risk management

tractors in Singapore. International Journal of Construction
Management, 13(2), 2741.
Malhotra, N.K. (2006) Marketing Research: An Applied Orientation, 5th edn, Pearson/Prentice Hall, Upper Saddle River, NJ.
Matsunaga, M. (2010) How to factor-analyze your data right:
dos, donts, and how-tos. International Journal of Psychological Research, 3(1), 97110.
Meulbroek, L. (2002) A senior managers guide to integrated
risk management. Journal of Applied Corporate Finance, 14
(4), 5670.
Muralidhar, K. (2010) Enterprise risk management in the
Middle East oil industry: an empirical investigation across
GCC countries. International Journal of Energy Sector Management, 4(1), 5986.
National Bureau of Statistics of China (2012) China Statistical
Yearbook 2012, China Statistics Press, Beijing.
Norusis, M.J. (1992) SPSS for Windows, Professional Statistics,
Release 5.0, IL, Chicago.
Nunnally, J.C. (1978) Psychometric Theory, 2nd edn,
McGraw-Hill, New York.
Olson, D.L. and Wu, D. (2008) Enterprise Risk Management,
World Scientific Publishing, Singapore.
Pagach, D.P. and Warr, R.S. (2010) The effects of enterprise
risk management on firm performance, Working Paper,
North Carolina State University, Raleigh, NC.
Pagach, D.P. and Warr, R.S. (2011) The characteristics of
firms that hire chief risk officers. Journal of Risk and Insurance, 78(1), 185211.
Patton, M.Q. (2001) Qualitative Research & Evaluation Components, 3rd edn, Sage, Thousand Oaks, CA.
Pett, M.A., Lackey, N.R. and Sullivan, J.J. (2003) Making
Sense of Factor Analysis: The Use of Factor Analysis for Instrument Development in Health Care Research, Sage, Thousand
Oaks, CA.
Professional Risk Managers International Association (2008)
Enterprise Risk Management (ERM): A Status Check on
Global Best Practices, PRMIA, Northfield, MN.
Project Management Institute (2008) A Guide to the Project
Management Body of Knowledge, PMI, Newtown Square, PA.
Protiviti (2006) Guide to Enterprise Risk Management, Protiviti
Inc, Menlo Park, CA.
Risk and Insurance Management Society (2008) RIMS State
of ERM Report 2008, RIMS, New York.
Rockart, J.F. (1982) The changing role of the information
systems executive: a critical success factors perspective.
Sloan Management Review, 24(1), 313.
Sanchez, H., Robert, B., Bourgault, M. and Pellerin,
R. (2009) Risk management applied to projects, programs,
and portfolios. International Journal of Managing Projects in
Business, 2(1), 1435.
Segal, S. (2011) Corporate Value of Enterprise Risk Management, John Wiley & Sons, Hoboken, NJ.
Sharman, R. (2002) Enterprise risk management: the KPMG
approach. British Journal of Administrative Management, 31,
268.

1213
Shortreed, J. (2010) ERM framework, in Fraser, J. and
Simkins, B.J. (eds.) Enterprise Risk Management, John Wiley
& Sons, Hoboken, NJ, pp. 97123.
State-owned Assets Supervision and Administration Commission of the State Council of China (2006) Guidance to
Enterprise Risk Management for Central Enterprises, SASAC,
Beijing.
Stroh, P.J. (2005) Enterprise risk management at United
Healthcare. Strategic Finance, 87(1), 2635.
Tabish, S.Z.S. and Jha, K.N. (2011) Identification and evaluation of success factors for public construction projects.
Construction Management and Economics, 29(8), 80923.
Tang, L.C., Atkinson, B. and Zou, R.R. (2012) An entropybased SWOT evaluation process of critical success factors
for international market entry: a case study of a mediumsized consulting company. Construction Management and
Economics, 30(10), 82134.
Thompson, B. (2003) Exploratory and Confirmatory Factor
Analysis: Understanding Concepts and Applications, American
Psychological Association, Washington, DC.
Ward, J. (2006) ERM: Evolving, Resonating, and Maturing
Down Under, Standard & Poors, New York.
Ward, S. and Chapman, C. (2003) Transforming project risk
management into project uncertainty management. International Journal of Project Management, 21(2), 97105.
Wilkins, J.R. (2011) Construction workers perceptions of
health and safety training programmes. Construction Management and Economics, 29(10), 101726.
Wu, D. and Olson, D.L. (2008) Enterprise risk management:
financial and accounting perspectives, in Olson, D.L. and
Wu, D. (eds.) New Frontiers in Enterprise Risk Management,
Springer, Heidelberg, pp. 2538.
Yang, J., Shen, G.Q., Ho, M., Drew, D.S. and Chan, A.P.C.
(2009) Exploring critical success factors for stakeholder
management in construction projects. Journal of Civil Engineering and Management, 15(4), 33748.
Yang, J., Shen, G.Q., Drew, D.S. and Ho, M. (2010) Critical
success factors for stakeholder management: construction
practitioners perspectives. Journal of Construction Engineering and Management, 136(7), 77886.
Zhao, X., Hwang, B.G. and Low, S.P. (2012) Implementing
enterprise risk management in a Chinese construction firm
based in Singapore, in Senaratne, S. and Sandanayake,
Y.G. (eds) Proceedings of World Construction Conference
2012, Colombo, Sri Lanka, 2830 June, Ceylon Institute
of Builders, pp. 43444.
Zhao, X., Hwang, B.G. and Low, S.P. (2013) Developing
fuzzy enterprise risk management maturity model for construction firms. Journal of Construction Engineering and
Management, 139(9), 117989.
Zou, P.X.W., Zhang, G. and Wang, J. (2007) Understanding
the key risks in construction projects in China. International
Journal of Project Management, 25(6), 60114.

1214

Zhao et al.

APPENDIX
The survey questionnaire

Rating the Importance (1 = very low, 3 =

medium, 5 = very high)
No.

ERM maturity criteria

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Commitment of the board and senior management

ERM ownership
Risk appetite and tolerance
Risk-aware culture
Sufficient resources
Risk identification, analysis and prioritization
Iterative and dynamic ERM process steps
Leveraging risks as opportunities
Risk communication
A common risk language
A risk management information system
Training programmes
Formalized key risk indicators
Integration of ERM into business processes
Objective setting
Monitoring, review and improvement of ERM framework

Copyright of Construction Management & Economics is the property of Routledge and its
content may not be copied or emailed to multiple sites or posted to a listserv without the
copyright holder's express written permission. However, users may print, download, or email
articles for individual use.