Learning to organise risk management in organisations: what future for enterprise risk management?

Abstract

Enterprise risk management (ERM) was originally developed to manage financial risks and was later transferred to other businesses, sectors and, crucially, government. ERM aims at a maximum of comprehensiveness suggesting the integration of all risks to an organisation’s objective in a portfolio to inform organisational strategy. However, the concept suffers from unknown interdependencies between risks, implementation strategies that lack empirical validation and ambivalences and uncertainties arising from their management. It is only weakly rooted in organisational theory. Drawing on knowledge generation, theory key aspects for the empirical study of risk management in organisations are identified. These address the commensuration of risks, the comprehensiveness of the risk portfolio and the communication of explicit and tacit knowledge enabling organisational learning processes in different institutional contexts.