3rd INTERNATIONAL CONFERENCE ON BUSINESS AND

1702 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING

12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

RISK MANAGEMENT, PERFORMANCE MEASUREMENT AND ORGANIZATIONAL

PERFORMANCE: A CONCEPTUAL FRAMEWORK
Siti Zaleha Abdul Rasid, Nargess Mottaghi Golshan, Wan Khairuzzaman Wan Ismail & Fauziah
Sheikh Ahmad
International Business School
Universiti Teknologi Malaysia
szaleha@[Link]

ABSTRACT

In the aftermath of recent global financial crisis and corporate failures, entity stakeholders are
demanding greater oversight of key risks facing the enterprise to ensure that stakeholder value is
preserved and enhanced. One response to these growing expectations is the emergence of a new
paradigm known as “Enterprise Risk Management” or “ERM” as an internal control system. At the
same time, organizations have been implementing Performance Measurement System (PMS) as one
of management control systems vital for corporate success. Considering the importance of these two
control systems, the possibility of incorporating ERM into the existing PMSs needs to be explored. It is
expected that risk management will complement PMS by identifying and mitigating risks in achieving
strategic objectives. Empirical evidence regarding this link is still lacking, therefore, this paper
investigates the linkage between risk management and PMSs. In addition, it also discusses the
impacts of these two systems on organizational performance. Finally, a conceptual model for
integrating risk management and performance measurement is proposed.

Field of Research: Enterprise risk management, performance measurement, organizational

performance
---------------------------------------------------------------------------------------------------------------------------

1. Introduction

Identification and management of risk has become an integral part of a sound management and
governance framework. In recent years, corporate failures, such as the collapse of Enron and World
Com have increased the need for effective risk management. Merely recording history of
performance measures is insufficient. Risk management and performance measurement should be
linked together to enable enterprise to define and guide its overall risk profile, as well as to shape its
strategic direction. IBM’s CFO study of 2007 revealed that effective organizations proactively manage
risks for closing performance gaps (Rogers, Lukens, Lin, & Jon, 2007). Therefore, executing strategy
aggressively that lacks control and balance may have disastrous effects on organizational
performance.

Although there is a growing body of literature that examines the effect of enterprise risk
management (ERM) on organizational performance as well as the effect of performance
measurement system (PMS) on organizational performance, studies on how linking ERM and PMS
can enhance the organizational performance is still lacking. While PMSs strictly focus on value
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1703 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

creation, they overlook the importance of value loss prevention. On the other hand, risk
management practices mostly focus on value loss prevention but disregard the importance of how
these risks relate to strategic objectives. Organizations should understand that a strategy, which
lacks alignment with risk management, is not only insufficient but also risky. Hence, this study aims
to fill this gap by discussing how ERM and PMS could be linked to enhance organizational
performance.

This paper is structured so that the first section discusses how ERM has evolved from the traditional
forms to a more integrated approach of risk management. Thereafter, PMSs utilized by organizations
are discussed. Subsequently, the possible linkages of PMS and ERM are considered. Finally a
framework for future empirical research is proposed.

2. The Journey From Traditional Risk Management to ERM

2.1 Risk Definition

Risk is a phenomenon that by definition and by nature cannot be eliminated. Although risk and
uncertainty are often used interchangeably, there is a distinction between them. Uncertainty is
referred to not being sure of what is going to happen in the future and risk is the degree of this
uncertainty. In other words risk is the degree of our uncertainty about what is going to occur (Fabozzi
& Peterson, 2003).

In old days, self-assurance was considered as a method for risk management and later risk
management was implemented through a silo-based perspective among firms. Now we have come
to the era of ERM (Rochette, 2009). The traditional risk measures like value-at-risk (VAR) emphasized
merely on the negative aspect of risk-taking activities. Additionally, the financial and operational risk
estimates were made in silos and they never seemed integrated and embedded in the foundation of
firms. However, the risk profession has evolved gradually and stopped considering risk only as
negative. Today’s risk professionals also reveal the opportunities that come along with risk-taking
activities.

2.2 Risk Management

Risk management is one of those concepts that when managers are asked about it, they will
unanimously respond, “Yes, we definitely need a risk management program”. However, risk
management is one of the concepts that until recently had not been clearly understood among many
organizations (Moeller, 2007). The Committee of Sponsoring Organizations of the Treadway
Commission (COSO) standards-setting entity solved ERM’s clear definition problem by introducing its
ERM framework in late 2004. This framework revealed a set of definitions and a structure to allow
organizations of all types including for-profit-entities, not-for-profits, and governmental agencies and
all sizes including large and small entities for better managing their risky circumstances.

As Ferreira (2006) has defined risk management, it involves managing to achieve a proper balance
between realizing opportunities for gains while minimizing losses. As this definition implies, risk
management is an integral part of a good management practice and an essential element of
excellent corporate governance (Ferreira, 2006). Risk management is a repetitive process that
constitutes steps that when taken consequently; it facilitates improved decision-making and
performance. These steps include identifying, analyzing, evaluating, treating, monitoring and
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1704 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

communicating risks. This process enables organizations to maximize the gains and minimize the
losses (COSO, 2004). According to Pagach and Warr (2011), the primary goal of risk management is to
increase shareholders’ value to its maximum.

Traditionally when one talked about risk management, what came to mind was rather insurance,
broker or auditor. The concern was on the negative impacts of risk exposures and the risk specialist
job was only to diminish this negative impact to its least level. However in recent years the concept
of ERM has emerged. In ERM the focus is on both positive and negative side of the risk (Rochette,
2009).

2.3 ERM

ERM is sometimes referred to as “business risk management”, “strategic risk management”, “holistic
risk management”, “integrated risk management”, “corporate risk management”, and “enterprise-
wide risk management”, which is the new substitute of traditional silo-based risk management. The
main difference of ERM from the traditional silo-based risk management is that firms can enhance
stakeholders’ value while mitigating risk when they pursue an ERM framework (Daud, Yazid, &
Hussin, 2010).

There are various definitions of ERM in the literature. Chapman (2003) stated that ERM is a process
of determination and analysis of risk from an integrated, enterprise-wide perspective. Liebenberg &
Hoyt (2003) which is an often cited study in the field of ERM have mentioned that ERM enables
organizations to take advantage of a broad and integrated approach to risk management which is
more offensive and strategic unlike the silo-based risk management which was primarily a defensive
method of managing risk. According to Stokes (2004) and Woon, Azizan, & Samad (2011), ERM is a
fundamental element of modern business. Risk management’s focus has changed from merely
operational hazards and financial risks to a much more strategic view of opportunities and threats. In
their view, ERM is a robust and dynamic risk management framework, which elevates the appetite
for upside risk.

And finally yet importantly COSO, which is known mainly as the inventor of ERM framework among
scholars, has defined ERM as:

“a process, effected by an entity’s board of directors, management and other personnel, applied in
strategy setting and across the enterprise, designed to identify potential events that may affect the
entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the
achievement of entity objectives (COSO, 2004)”.

In brief, ERM includes methods and processes that organizations use to manage risks and capture
existing opportunities in order to achieve their goals. Indeed ERM addresses the requirements of
various stakeholders, who desire to realize the broad spectrum of risks facing the organization, to
ensure that the organization is being properly managed.

ERM’s major distinction from traditional silo-based risk management is that it examines all the risks
faced by the firm and takes a holistic approach to manage these risks (Pagach & Warr, 2011). Based
on the comprehensive elaboration of Rochette (2009), ERM is different from the traditional risk
management in four aspects. Firstly, ERM should be present within overall governance structure of a
firm. Secondly, ERM does not substitute the traditional risk management rather it complements it.
This implies that traditional risk management should be in place, especially in business units and ERM
should be used at corporate level to manage the overall risks the company is facing. The third
difference of traditional risk management and ERM comes from the necessity of presence of a risk
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1705 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

champion, usually in the role of chief risk officer (CRO). Traditionally chief financial officers (CFOs)
were responsible for managing the risks the firm faces, but in the new concept of ERM it is insisted
that the role of CFO and CRO is different, while CFO always attempts to ignore some risks and
focuses on maximizing return. But the presence of CRO assures that the opportunities lying beyond
the risks will be analyzed as well. Finally, ERM implementation should obey a top-down and forward-
looking approach while traditional risk management utilized bottom-up risk analysis which often
resulted in deviation from strategic goals of the organization.

2.4 ERM Frameworks - COSO Framework

COSO (2004) is one of the most popular ERM frameworks being implemented in different firms
across the globe (Daud, et al., 2010). COSO (2004) ERM framework is built upon the earlier COSO’s
Internal Control-Integrated framework (1992). COSO emphasizes that risk management’s primary
focus is on identifying, understanding, and assessing intrinsic business risks and then it considers
control as one possible risk response. COSO’s 2004 ERM framework comprises of eight interrelated
components: (i) internal environment; (ii) objective setting; (iii) event identification; (iv) risk
assessment; (v) risk response; (vi) control activities; (vii) information and communication and (viii)
monitoring. In this framework, there is a direct relationship between the above eight ERM
components and strategic, operations, reporting, and compliance objectives of a firm. This
relationship is depicted in a three-dimensional matrix in figure 1.

Figure 1: Three-dimensional matrix of relationship between ERM components, firm’s objectives

and firm’s units. Source: COSO (2004)

3. Performance Measurement Systems (PMS)

Performance measurement can be defined as the process of quantifying the efficiency and
effectiveness of action (Neely, Gregory, & Platts, 2005). Rouse & Putterill (2003) define it as the
comparison of results against expectations with the implied objective of learning to do better. It is a
process of assessing progress towards achieving pre-determined goals, including information on the
efficiency by which resources are transformed into goods and services, the quality of those outputs
and outcomes, and the effectiveness of organizational operations in terms of their specific
contributions to organizational objectives (Amaratunga & Baldry, 2002). The primary goal of PMS is
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1706 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

to assess the progress of achieving objectives including both financial and non-financial. Meanwhile
the output of PMS will be used to assure the efficiency and effectiveness of resource allocation in an
organization (Acharyya, 2007).

Beamon (1996) has claimed that an effective PMS has four main characteristics. These characteristics
include inclusiveness, measurability, consistency, and universality. Moreover, a PMS should be able
to evaluate both internal and external environment of an organization. The output of PMS should be
used by the senior management level of an organization to decide on setting new goals for the
organization. PMS are vital tools, which assist organizations to translate their strategy in terms of
desired behavior and results. Moreover, PMS help organizations to communicate their expectations,
monitor the business processes, providing feedbacks, and motivating employees through
performance-based compensations (Banker, Potter, & Srinivasan, 2000; Chenhall & Langfield-Smith,
2003; Ittner & Larcker, 1998; Kaplan & Norton, 2001).

There are many tools and techniques suggested in the literature for measuring performance in an
organization. Four often-practiced ones include: Economic Value Added (EVA), BSC (BSC),
Benchmarking, and Total Quality Management (TQM). BSC is a comprehensive PMS tool that has
been widely practiced by many organizations in the world.

3.1 Balanced Scorecard (BSC)

Kaplan & Norton first introduced the BSC in 1992. According to them a BSC is a PMS that provides
top managers a quick but thorough perspective of how the business is doing. The word “Balance” in
the name of the BSC comes from the fact that it includes both financial and operational measures. A
generic BSC translated organization’s mission and objective into specific and measurable operational
and performance metrics across four perspectives: (i) Financial performance; (ii) Customer
satisfaction; (iii) Internal processes and (iv) Learning & growth (Kaplan & Norton, 1992). As it can be
seen in figure 2, learning and growth perspective focuses on the employees’ competencies to
improve internal business processes. Consequently customer satisfaction will enhance only if internal
processes are improved. And finally, financial results would surpass through satisfied customers. This
is how the four perspectives of Kaplan & Norton’s BSC are interrelated (Beasley, Chen, Nunez, &
Wright, 2006).
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1707 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

Learning & Growth

Perspective

To achieve the

Measures
vision how will the

Goals
organization
sustain its ability to
change and
improve?

Customer Perspective Internal Processes Perspective

Measures

To satisfy our

Measures
To achieve our VISON AND
Goals

customers and

Goals
vision how should STRATEGY shareholders, where
we appear to our should the organization
customers? excel in internal
processes?

Financial Perspective
Measures

To improve
Goals

financial outcome,
how should we
appear to our
shareholders?

Figure 2: Integration of four perspectives of a BSC. Source: Adapted from Beasley, Chen, Nunez, &
Wright (2006)

In fact the best advantage of BSC is that it translates the organization’s vision and strategy into
measurable metrics (Acharyya, 2007). Therefore by using a BSC it can be precisely assessed if the
organization is moving across the defined strategy and is on the right way of achieving its objectives
at any point of time.

4. ERM Adoption and Organizational Performance

In the academic literature there are various studies, which have linked implementation of ERM with
improved firm performance (e.g. COSO, 2004; Fong-Woon Lai, 2010; Gordon, Loeb, & Tseng, 2009;
Hoyt & Liebenberg, 2010; Segal, 2011). In recent years the benefits of ERM have astonished
managers. These benefits include:
 Reduced cost of capital
 Reduced earnings volatility which results in enhancing shareholders’ value
 Reduced stock price volatility which results in enhancing shareholders’ value
 Gaining competitive advantage through identifying those risks that can be exploited
 Enhanced informed decision making ability
 Builds confidence for investors (Liebenberg & Hoyt, 2003) and (Miccolis & Shah, 2000).

Meanwhile Woon et al. (2011) have proved that successful ERM implementation will result in value
creation for shareholders through lowered cost of capital (via lowered risk premium) and enhanced
business performance (i.e. higher price-to-earnings ratio for the firm’s shares). Pagach & Warr (2011)
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1708 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

have also indicated that firms adopt ERM for direct economic benefits rather than merely to comply
with regulations’ pressure. In fact many organizations have intuitively recognized the benefits of ERM
and have started to implement it in some form in the organization.

Various studies have shown that ERM implementation affects organizational performance
extensively (e.g. Fong-Woon Lai, 2010; Gordon, et al., 2009; Hoyt & Liebenberg, 2010; Segal, 2011).
An example is the Ernst & Young study in 2005 that revealed that sixty-one percent of investors do
not have any intention to invest in organizations who do not clearly identify risks (Oracle, 2009). Via
establishment of a consistent and disciplined process of enterprise-wide risk management
organizations would be able to improve their business results (Oracle, 2009). In brief it can be argued
that ERM adoption would result in improved organizational performance. The discussion therefore
suggests the following hypothesis:

H1: There is a positive relationship between ERM adoption and organizational performance.

5. Performance Measurement System (PMS) and Organizational Performance

PMS play a key role in developing strategic plans, evaluating the achievement of organizational
objectives, and deciding about employees’ compensation (Ittner & Larcker, 1998). A well-designed
PMS will include a sense of direction and purpose. PMS can provide useful tools for restructuring and
for organizational performance management if they are effectively linked to the revised strategies
and accompanied with appropriate rewards (Kaplan & Norton, 1992; Otley, 1999). PMS are an
important part of continuous improvement. Meanwhile PMS help managers to focus their attention
on achieving objectives, and use it as a crucial agent of change. Also PMS play an important role for
the improvement of individual and organizational performance.

The BSC has proven to be an effective tool to capture, describe, and translate organization’s strategy
into performance metrics and targets (Niven, 2006). Since its emergence in the early 90s, many
companies have adopted it for measuring financial and non-financial performance of the
organization. Consequently many studies have been conducted to gauge its effectiveness and to
assess whether the BSC really adds value to the organizations (Chen, 2011; De Geuser, Mooraj, &
Oyon, 2009; Hoque & James, 2000; Pollanen & Xi, 2011). As an example, De Geuser et al. (2009) in
their study of 76 business units found that BSC has a positive impact on organizational performance
and more specifically it improves the integration of management processes via a better translation of
strategy into operational terms. Moreover, BSC makes strategizing a continuous process, and it
results in greater alignment of various processes within the organization. Meanwhile, Pollanen & Xi
(2011) in their recent research of 330 firms found that firm performance is a function of increased fit
between BSC and firm characteristics such as strategy, industry, size, quality, structure, culture, and
ownership. In summary, it can be concluded that the use of PMS or BSC as a comprehensive PMS
framework is expected to enhance organizational performance to higher levels. Thus, the following
hypothesis is suggested:

H2: There is a positive relationship between PMS and organizational performance.

6. ERM and PMS

One effective way for organizations to understand the value of the ERM framework is to link it with
their PMS (Acharyya, 2007). A study of CFOs by IBM Global Business Services in 2008 revealed that
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1709 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

only 29 percent of organizations have aligned risk with performance. Therefore, there is still much
room for improvement by aligning PMS with ERM in an organization. When ERM and PMS are linked,
the value of an ERM framework can be effectively and efficiently understood within an organization.
In other words if ERM framework would be integrated with an organization’s PMS, the ERM
framework would definitely enhance shareholders’ value. Only when organizations understand that
ERM framework is adding value to the company, they would be motivated to invest more resources
in ERM framework implementation in order to drive strategic decisions for meeting organizational
objectives and maximizing long-term shareholder value (Acharyya, 2007).

The achievement of business value and strategic objectives will be ascertained by aligning corporate
strategy, strategic planning, and ERM (Oracle, 2009). Since ERM attempts to aid the achievement of
strategic objectives, it aligns the interests of the risk manager with those of entity as a whole. Hence,
it should be possible to integrate ERM with the existing PMS within an organization. There has been
a call for integrating the balance scorecard (BSC) as a strategic PMS and ERM as a proposed best
practice of risk management (Ballou, Brewer, & Heitger, 2006; Beasley, et al., 2006; Calandro Jr &
Lane, 2006; McWhorter, Matherly, & Frizzell, 2006; Nagumo, 2005; Scholey, 2006; Woods, 2007).

However this integration may raise the issue of professional rivalry between risk managers and
internal auditors (Woods, 2007). But ultimately there is no difference between the aim of ERM and
PMS, while both focus on shareholders’ value maximization. There are a few studies, which claim
that, ERM and PMS should converge to create, enhance, and protect shareholders’ value (see
Beasley, et al., 2006; Calandro Jr & Lane, 2006; Oracle, 2009). One commonly used PMS is the BSC.
The scorecard can be enhanced by including goals and objectives for risk management and by
capturing performance-based risk metrics.

BSC provides a suitable infrastructure for implementation of ERM in an organization. In other words,
a BSC can be leveraged to provide an ERM framework. Leveraging a BSC to include ERM strengthens
the scope of management’s focus by precisely and clearly linking risk management to performance
measurement. If risks would be managed separately from other strategic objective, which indicates
that ERM and BSC would run in parallel, managers may have difficulty in prioritizing the defined
targets. Rather if the two systems would be integrated, the influences of various types of risks on the
strategic objectives become explicit.

Therefore, on one hand BSC provides a suitable base for ERM implementation. On the other hand
the integration of ERM and BSC will result in a more effective BSC (Beasley, et al., 2006). Meanwhile,
when ERM would be embedded in the existing BSC of an organization, there would be less
requirement of creating a new function of risk management, since risk components are incorporated
into every staff’s responsibility. However, the ultimate responsible party for risk control will remain
to be the board of directors. Figure 3 plots how ERM and BSC processes can be linked together.
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1710 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

BSC:
Formulating Strategies

ERM:
- Articulating Risk Appetite
- Setting Objectives (strategic,
operations, reporting, compliance)
BSC: BSC:
Strategic Feedback Executing
and learning ERM-BSC
Strategies
Process
ERM: Cycle ERM:
- Risk reporting - Risk Identification
- Information and - Risk Response
communication - Risk Control

BSC:
Evaluating Performance

ERM:
- Risk Monitoring

Figure 3: ERM-BSC process cycle. Source: Adapted from Kaplan & Norton (Kaplan & Norton, 1996),
Nagumo (2005), and Segal (2005)

7. Integrating ERM and BSC

Kaplan & Norton first introduced the BSC in 1992. Interestingly it was the same year that COSO also
introduced its internal control framework. However it took some years for the practitioners to
discover how strategies and ERM should be linked. COSO’s ERM framework introduced in 2004 was
an initiation of this linkage. However, still after almost eight years since the introduction of ERM
framework by COSO, only a few studies have considered how ERM and BSC can be linked. Table 1
provides an overview of these studies:

Table 1: Studies on the possible linkages between BSC and ERM, Source: Authors’ Compilation
Title Author(s) Type Focus
Aligning ERM with Strategy Nagumo (2005) Case Study How Bank of Tokyo-
Through the BSC: The Bank Mitsubishi undertook the
of Tokyo-Mitsubishi integration of BSC and
Approach ERM

Linking risk management Woods (2007) Case Study The extent of overlap
to strategic controls: a between ERM and BSC
case study of Tesco PLC

An introduction to the Calandro Jr & Lane Conceptual Paper Designing a risk

Enterprise Risk Scorecard (2006) scorecard based on
Kaplan and Norton’s BSC

Working hand-in-hand: Beasley, Chen, Conceptual paper Leveraging BSC into ERM
ERM and BSC Nunez, & Wright to strengthen scope of
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1711 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

Title Author(s) Type Focus

(2006) management’s focus on
broader sets of risks

The focus of a BSC is on continuous improvement and it links an organization’s vision and strategy to
certain performance measures (Beasley, et al., 2006). Therefore it is obvious that the BSC takes a
holistic enterprise wide approach for measuring organization’s performance. Hence it provides an
excellent infrastructure for an enterprise-wide risk management system. BSC assess an organization’s
progress towards achieving strategic goals. On the other hand, ERM is a tool for organization leaders
to detect the positive and negative events that may affect achievement of their goals. Thus a
combination of the BSC and ERM will increase the probability of achieving goals and objectives.

8. Integrated ERM-BSC Effect on Organizational Performance

After almost two decades since the inception of BSC by Kaplan and Norton (1992), many companies
all around the world have adopted it as a PMS tool. On the other hand ERM is a relatively new
concept and still not many companies have adopted this framework. In fact adoption of ERM is still a
voluntary concept among the firms. The empirical evidences are the studies of Liebenberg and Hoyt
(2003) who have identified only 26 firms in the US that have adopted ERM during 1997 to 2001, and
even the most recent study of Pagach and Warr (2011) detected only 138 firms in the US, which have
adopted ERM framework during 1999 to 2005. Another example is the survey results of the
Economist Intelligence unit, which discovered that only 41 percent of companies in Europe, North
America, and Asia have adopted some form of ERM. As scholars have tried to find the reason behind
low adoption rates of ERM, they cite some common barriers and challenges such as the resistance of
board of directors or senior executives. Another challenge to successful implementation of ERM is
the improper understanding of top-down approach that should be taken for this purpose (Tax
Management Inc., 2011).

However, as Beasley et al. (2006) has suggested, BSC can serve as an infrastructure for ERM
adoption. Therefore challenges such as board of directors’ resistance and requirement of a top-down
approach will be solved and organizations would find it easier to implement an effective ERM
framework. Meanwhile, there are already some organizations which have integrated their ERM
framework with BSC. Examples include Bank of Tokyo-Mitsubishi and Tesco PLC (Nagumo, 2005;
Woods, 2007). Also, Mobil, Chrysler, and the US Army have associated their scorecards with risk
management (Olson & Wu, 2010, p. 185). It is expected that integrating the two management tools
would enhance organizational performance to higher levels than practicing two frameworks in
parallel without any linkage. Hence, the following hypothesis is suggested:

H3: The combined effect of ERM and PMS would lead to enhanced organizational performance.
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1712 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

Based on all the arguments above, a conceptual framework is suggested as shown in figure 4.

H1

ERM
H3 Organizational
Performance

PMS

H2
Figure 4: Conceptual Framework

9. Conclusion

The aim of this paper was first to introduce one alternative way of how ERM and PMS frameworks
could be integrated. For this purpose it has been shown that in principle both ERM and BSC (as the
most utilized PMS) are simply two types of strategic management control systems and they have
various similarities. Moreover, strategy and risk management are two sides of the same coin; they
should be considered simultaneously. Debate over the advantages and disadvantages of different
ways of integrating ERM and BSC are beyond the scope of this paper but remain as an interesting
area for future research. Meanwhile an empirical approach should be taken to test the effectiveness
of the proposed framework of this research which indicates that leveraging the current BSC of an
organization with ERM framework would enhance organizational performance.

References

Acharyya, M. (2007). Proposing a conceptual framework to measure the performance of Enterprise

Risk Management from an empirical study of four major European insurers. Paper presented at the
34th Seminar of the European Group of Risk and Insurance Economists, Cologne.

Amaratunga, D., & Baldry, D. (2002). Moving from performance measurement to performance
management. Facilities, 20(5/6), 217-223.

Ballou, B., Brewer, P. C., & Heitger, D. L. (2006). Integrating the Balanced Scorecard and Enterprise
Risk Management. Internal Auditing-Boston-Warren Gorham And Lamont Incorporated, 21(3), 34.

Banker, R. D., Potter, G., & Srinivasan, D. (2000). An empirical investigation of an incentive plan that
includes nonfinancial performance measures. Accounting Review, 65-92.
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1713 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

Beamon, B. M. (1996). Performance measures in supply chain management.

Beasley, M., Chen, A., Nunez, K., & Wright, L. (2006). Working Hand in Hand: Balanced Scorecards
and Enterprise Risk Management-Taking a total look at all the potential risks to a company, or
enterprise risk management, is becoming the minimum standard. Strategic Finance, 87(9), 49-55.

Calandro Jr, J., & Lane, S. (2006). An introduction to the enterprise risk scorecard. Measuring
Business Excellence, 10(3), 31-40.

Chapman, C. (2003). Bringing ERM into focus. Internal Auditor, 60(3), 30-36.

Chen, W. (2011). The indicators of performance evaluation for nursing home by balanced scorecard.

Chenhall, R. H., & Langfield-Smith, K. (2003). Performance measurement and reward systems, trust,
and strategic change. Journal of Management Accounting Research, 15, 117.

COSO. (2004). Enterprise Risk Management- Integrated Framework.

Daud, W. N. W. D., Yazid, A. S., & Hussin, H. M. R. (2010). The Effect Of Chief Risk Officer (CRO) On
Enterprise Risk Management (ERM) Practices: Evidence From Malaysia. International Business &
Economics Research Journal (IBER), 9(11).

De Geuser, F., Mooraj, S., & Oyon, D. (2009). Does the balanced scorecard add value? Empirical
evidence on its effect on performance. European Accounting Review, 18(1), 93-122.

Fabozzi, F. J., & Peterson, P. P. (2003). Financial management and analysis (Vol. 100): John Wiley &
Sons Inc.

Ferreira, G. (2006). AS/NZS 4360: 2004 Australian Standard for Risk Management: Jan.

Fong-Woon Lai, F. A. S. (2010). ERM Framework and the Empirical Determinants of its
Implementation.

Gordon, L. A., Loeb, M. P., & Tseng, C. Y. (2009). Enterprise risk management and firm performance:
A contingency perspective. Journal of Accounting and Public Policy, 28(4), 301-327.

Hoque, Z., & James, W. (2000). Linking balanced scorecard measures to size and market factors:
impact on organizational performance. Journal of Management Accounting Research, 12, 1-18.

Hoyt, R. E., & Liebenberg, A. P. (2010). The value of enterprise risk management. Journal of Risk and
Insurance.

Ittner, C. D., & Larcker, D. (1998). Innovations in performance measurement: trends and research
implications.

Kaplan, R. S., & Norton, D. P. (1992). The balanced scorecard--measures that drive performance.
Harvard Business Review, 70(1).

Kaplan, R. S., & Norton, D. P. (1996). Using the balanced scorecard as a strategic management
system. Harvard Business Review, 74(1), 75-85.

Kaplan, R. S., & Norton, D. P. (2001). Transforming the balanced scorecard from performance
measurement to strategic management: Part 1. Accounting Horizons, 15(1), 87-104.
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1714 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

Liebenberg, A. P., & Hoyt, R. E. (2003). The determinants of enterprise risk management: evidence
from the appoitnment of chief risk officers. Risn Management and Insurance Review, 6(1), 37-52. doi:
10.1111/1098-1616.00019/,DanaInfo=[Link]

McWhorter, L. B., Matherly, M., & Frizzell, D. M. (2006). The connection between performance
measurement and risk management. Strategic Finance-Montvale-, 87(8), 50.

Miccolis, J., & Shah, S. (2000). Enterprise Risk Management- An Analytic Approach: Tillinghast –
Towers Perrin.

Moeller, R. R. (2007). COSO enterprise risk management: understanding the new integrated ERM
framework: John Wiley & Sons.

Nagumo, T. (2005). Aligning enterprise risk management with strategy through the BSC: the Bank of
Tokyo-Mitsubishi approach. Balanced Scorecard Report(September-October), 3-6.

Neely, A., Gregory, M., & Platts, K. (2005). Performance measurement system design: a literature
review and research agenda. International Journal of Operations & Production Management, 25(12),
1228-1263.

Niven, P. R. (2006). Balanced scorecard step-by-step: maximizing performance and maintaining

results: Wiley.

Olson, D. L., & Wu, D. (2010). Enterprise Risk Management Models: Springer.

Oracle. (2009). Risk Management: Protect and Maximize Stakeholder Value.

Otley, D. (1999). Performance management: a framework for management control systems research.
Management accounting research, 10(4), 363-382.

Pagach, D., & Warr, R. (2011). The characteristics of firms that hire chief risk officers. Journal of Risk
and Insurance.

Pollanen, R., & Xi, K. (2011). The Use of Balanced Scorecard Measures in Executive Incentives and
Firm Performance.

Rochette, M. (2009). From risk management to ERM. Journal of Risk Management in Financial
Institutions, 2(4), 394-408.

Rogers, S., Lukens, S., Lin, S., & Jon, E. (2007). Balancing risk and performance with an integrated
finance organization: the global CFO study 2008. IBM Corporation in cooperation with The Wharton
School and Economist Intelligence Unit. October, 159-151.

Rouse, P., & Putterill, M. (2003). An integral framework for performance measurement.
Management Decision, 41(8), 791-805.

Scholey, C. (2006). Risk and the balanced scorecard. CMA Management, 32, 32-35.

Segal, S. (2005). Value-Based Enterprise Risk Management. The Actuary, June/July.

Segal, S. (2011). Corporate Value of Enterprise Risk Management: The Next Step in Business
Management: John Wiley & Sons.

Stokes, M. (2004). Taking full advantage of enterprise-wide risk management. The Treasurer.
 3rd INTERNATIONAL CONFERENCE ON BUSINESS AND
1715 ECONOMIC RESEARCH ( 3rd ICBER 2012 ) PROCEEDING
12 - 13 MARCH 2012. GOLDEN FLOWER HOTEL, BANDUNG, INDONESIA
ISBN: 978-967-5705-05-2. WEBSITE: [Link]

Tax Management Inc., a. B. C. (2011). Coordinating Risk Management and Performance

Measurement. In I. The Bureau of National Affairs (Ed.), Accounting Policy & Practice Series.

Woods, M. (2007). Linking risk management to strategic controls: a case study of Tesco plc.
International Journal of Risk Assessment and Management, 7(8), 1074-1088.

Woon, L. F., Azizan, N. A., & Samad, M. F. A. (2011). A Strategic Framework For Value Enhancing
Enterprise Risk Management. Journal of Global Business and Economics, 2(1), 23-48.