The Embedment of Risk Management in Enterprise Management System

The issue of risk in business activities is the core of analysis in strategic management conditioning the implementation of strategic goals. One of the goals of strategic management is to be able to understand the peculiarities of risk, which makes it possible to diagnose the type and scope of threats to the enterprise, assess their expected impact on the enterprise, and ensure business continuity (Urbanowska-Sojkin, 2012; Schroeder, 2014). The risks occurring in the environment of enterprises are also pivotal for the selection of a development concept, which is one of the leading phases of strategic management. In this case, an adequate assessment of risks and the development of ways to mitigate them determines the maintenance of the current competitive position or its strengthening, and thus also conditions the effectiveness of strategic management. A strategic approach to risk in enterprise should therefore be based on inferences drawn from the recognition of business practices in creating growth in the face of increasing threats, mainly economic and technological ones (Goodfellow and Raynor, 2004). These types of increased threats and the need to take them into account in strategic management processes have contributed to the development of new long-term management methods and tools based on risk. In recent decades, there has been intensive development of a strategic approach to risk management, both in the private sector and at the level of managing the development of society, economies, and countries (Claessens et al., 2002). This approach was, in a way, forced by the ubiquitous economic uncertainty, which should be managed in such a way as to become a measurable risk, the occurrence of which can be prepared and sometimes even prevented by implementing appropriate preventive actions against the identified risks. The next stage of the observed development of the strategic approach to risk was the development of a new conceptual trend. Given the interplay between risk management and strategic management, and in the wake of the global financial crisis, the concept of strategic risk management (SRM) has been developed. The new post-crisis approach to strategic management aims to improve the process of identifying, assessing, and managing risk factors that could cause huge losses or even lead to bankruptcy. However, the main objective of this concept is to perfect the ability to recognize the early signals of crises and to mitigate the scale of their negative effects. The achievement of the stated SRM goals should ultimately make it possible for enterprises to implement strategic security solutions, reduce susceptibility to crises, and prepare to change the business model in response to a potential crisis (Calandro, 2015).

Another consequence of the strategic approach to risk management, and thus a manifestation of the intensive development of this relatively new field of management, is the development and use of appropriate preventive or remedial tools, enabling long-term planning of dealing with key risk factors. However, these tools are sector-specific. Others will be appropriate, for example, for activities in the construction sector, others in the financial sector, and still others in the IT sector, etc. The next issues related to the role of risk management in strategic management are strategic risks, that is, those that a given entity (company or country) considers to be key from the point of view of the conducted activity. The main management efforts should therefore focus on strategic risks, both in normal operating conditions and in crisis situations. Strategic risks during the crisis are of particular importance because maintaining business continuity depends on the appropriate approach to managing them (Jedynak and Bąk, 2021).

In their day-to-day operations, enterprises have to face primarily microscale risks and threats related to legal regulations, the specifics of their core business, the competences of employees, and the efficiency of control systems and mechanisms. Operational risk management (ORM) is a distinct management concept that integrates operational management with risk management. The concept is crucial in shaping corporate performance (Naude and Chiweshe, 2017). The main objective of a proactive approach to operational risk should be to improve the adequacy of business decisions, improve efficiency, ensure constant financial results, and maintain the established market position. Despite the availability of a wide range of insurance services, which constitute known operational risk protection tools (Manning and Gurney, 2005), these goals can only be achieved through the integration of enterprise strategy and operational processes. ORM should be a management imperative, first because of the impact of small operational problems on the expansion of risk into other business domains in the form of a chain reaction (Kleindorfer and Saad, 2005), and second because of the need to strengthen awareness of operational threats in order to shape resistance to these threats and balance the needs of stakeholders, for example, customers, suppliers, employees, shareholders, and regulators (Kumar et al., 2014).

In order to balance the needs of all stakeholders, a detailed and cyclical identification of risk factors is necessary. The key to effective operational management is the appropriate approach to the risks considered operational, that is, those related to the day-to-day operations of the company. An appropriate approach to operational risks is so important because neglecting protection against everyday threats to the company can sometimes turn into a serious long-term crisis or generate many problems in various functional areas of the company. The operational risk is the risk of loss resulting from incorrect internal processes, human or system errors, and external events. Depending on the sector in which the company operates, these may be, for example, breakdowns, frauds, billing errors, product defects, sales problems, etc. (Coleman, 2010).

Enterprises are required to conform to market requirements and the progressive volatility of the environment. To this end, they undertake complex, multi-faceted projects that require the use of specialized project management methods (Frame, 2001; Trocki, 2012). Risk identification, assessment, and analysis processes should occur at all stages of project management, mainly in areas such as quality management, time management, cost management, procurement management, communication management, and integrity management. The overriding goal of project risk management is to keep risks within acceptable limits within the context of the established limits of profitability, rationality, and costs (Cooper et al., 2005). Ward and Chapman (2003) further indicated that project risk management should focus on managing chances in proportion to the focus on the risk of project failures. This is because overestimating risks can result in a decrease in the effectiveness of project work, which can then negatively affect the end result. Furthermore, the approach to risk management should not be limited to the achievement of objectives of a single project, but it should holistically monitor the integration of particular projects’ risks with strategic objectives on an ongoing basis (Dai and Wells, 2004; Sanchez et al., 2009).

From the above, it follows that project management and risk management are related in several ways. Concretely, the relationship between these two functional areas can be understood in two ways: first, as dealing with many threats occurring in various phases of project management (where the responsibility for counteracting these threats is most often shared between many people involved in the implementation of the project), and second, as project failure, that is, the risk of inability to implement the intended project (where responsibility lies with the people managing/supervising the project). The risk associated with the success or failure of the entire project, and more specifically the management of this risk, should be strictly dependent on the situational context. This means that threats that will hinder the implementation of the project depend on the industry, the degree of preparation for its implementation, environmental conditions, etc. And these circumstances determine the actions that will be taken as part of project risk management.

Risk in corporate financial management can be considered a crucial aspect of developing and implementation financial plans that determines the ability to follow trends in global or national financial policy formation (Li, 2003). Besides being recognized as a leading risk area concerning the possibility of the occurrence of financial losses, financial risk is also regarded as a factor that, if properly managed, can reduce the overall level of risk and, through this, reduce the costs of incurring it, which can have the effect of increasing the value of the enterprise (Fairchild, 2002). For this reason, among others, risk is firmly embedded in financial management methodologies. However, risk assessment techniques and tools, for example, financial ratios (liquidity, debt, profitability ratios), only allow for identification of risk exposure at the time of measurement. Therefore, it is necessary to implement early warning methods for financial problems that go beyond the statistical or mathematical calibration of financial risk models. Furthermore, financial risk management should take into account both macroeconomic risk (globalization challenges, economic uncertainty, financial crises) (Hammoudeh and McAleer, 2015) and microeconomic risk (equity risk, interest rate risk, credit risk, liquidity risk, commodity price risk, market risk, counterparty risk, operational risk) (Garcia and Javier, 2017). Financial risk management processes should also allow defining their own transparency requirements for financial instruments, developing models for generating and processing information about threats to and opportunities for profitability, and taking into account the causes and consequences of systemic risk (Mertzanis, 2014).

Investing activities undertaken by companies and, above all, their success understood as profit generation are made possible by hedging against their negative consequences (Merková and Drábek, 2015). Investment decisions are inextricably linked to risks that cannot be eliminated. They include various investment risk factors (risk of turnover, risk of demand for shares and other securities, the macroeconomic situation in the country and around the world) and the risk of non-compliance with requirements of stock exchanges and guidelines of stock exchange supervisory authorities (Bąk, 2018). What has to be done is to accurately assess the risks and develop ways of dealing with the consequences of their materialization. Components of integrated risk management, such as early warning and rapid response systems, for example, prove helpful in this. Investment controlling is a supporting tool for enterprises in investment risk management. It makes it possible to coordinate all stages of the investment process, adjust the budget appropriately, control the execution of investment projects on an ongoing basis, measure efficiency, and monitor the achievement of investment objectives. Other ways of reducing investment risks are, for example, diversification of the investment portfolio (Jakšić and Leković, 2015), optimal allocation of investments in the capital management system (Li and Wu, 2009), and hedging, which allows protecting assets from losses due to unforeseen events and providing greater flexibility of investment activities (Czyżowska, 2016).

Risk management systems in enterprises should be coherent with their established quality goals. Following the ISO 9001 standard, companies must integrate quality management systems into their business processes, taking into account risk and uncertainty. A risk-based approach to management is therefore the primary intention of modern quality management. Quality management systems are ultimately intended to contribute to the prevention or reduction of undesirable events occurring in the production process. The main risk factors determining what measures enterprises apply in their quality management (Jedynak et al., 2001) are the following: the risk of using an inadequate quality control system, the risk of reducing product quality, the risk of reducing production volumes due to negative changes in the quality of the final product, the risk of disruptions in the production process, and the risk of generating additional quality costs. Effective risk analysis processes in a quality management system should constitute a source of information on actions necessary to develop the enterprise without undesirable disruptions, while maintaining production continuity, meeting customer requirements and improving competitiveness. Risk management is treated as a determinant of the quality of management of the entire enterprise, so in addition to the area of production operations, an analysis of risks in a quality management system should also refer to non-production undertakings, the implementation of administrative and personnel changes, and the improvement of the formation of relations with the environment (Lisiecka, 2012). A complex approach to risk is the basis for the improvement of the quality management system (Kozakiewicz and Sawicki, 2017) and facilitates a pro-quality approach to enterprise management (Williams et al., 2006), which is the core goal of the concept of total quality management.

Errors in the design of an enterprise’s HR policy, its implementation, or its application can cause a number of risk factors, often with irreversible or destructive consequences. For this reason, analyzing the significance of risk in human resource management has become an important research issue (Becker and Smidt, 2016). What can be observed in the literature on risk management is the appearance of a new trend in theoretical and business research, namely human resource risk management (cf. Oborilová et al., 2015; Huang et al., 2017; Mitrofanova et al., 2017). The causes for the appearance of risk in human resource management can be seen in, for example, insufficient qualifications of employees and management teams, inadequate decisions made during the recruitment process, a poorly functioning system of employee training and development, shortcomings of the remuneration and incentive system, non-compliance with ethical principles, and failure of employees to comply with legal regulations, as well as other rules and procedures functioning in the enterprise (Bochniarz and Gugała, 2005; Lipka, 2002).

Enterprises oriented toward innovation face the challenge of mitigating technological, economic, and market risks, especially due to the heterogeneous structure of national innovation systems, as well as economic and market instability. The risks to innovation activities of enterprises should be analyzed, taking into account the goals derived from the main strategy (da Silva Etges and Cortimiglia, 2019), and their evaluation should be a central point in decision-making processes in enterprises that undertake such innovative activities (Deptuła and Knosala, 2015). The rapid development of the innovation market resulting from technological advances creates increasing uncertainty about the internal and external drivers of the evolution of innovative business (Nagano et al., 2014). This uncertainty, therefore, justifies treating risk management as a key stage in innovation management (Hauser et al., 2006; Wong and Chin, 2007). The implementation of innovation in company should always be treated as a driver of growth, however, with a co-existing proactive approach to risks and threats (O’Connor et al., 2008). Using such a combination, it is possible to reconcile uncertainty and risk with a differential business environment, which, in turn, makes it possible to generate expected profits from innovation activities. In doing so, it is worth taking into account the key features of innovation risk, namely intangibility and globalization (Giugliani, 2012). In innovation risk management, more than in other areas of management, it is the time horizon of undertaken activities that is important, as the time between the initiation of an innovative venture and its actual implementation may pose the risk of depriving the activity of its innovative features. This fact should significantly determine the shape and dynamics of the risk monitoring and response process (da Silva Etges et al., 2017).