Modeling Enterprise Risk Management Ecosystems Using Text Analytics

Over a period of 26 years (1997–2023), the majority of ERM academic documents have been produced in the fields of business management and accounting, closely followed by economics and finances (Figure 3). Most ERM publications in SCOPUS are journals 467/725) and articles (440/725), while the second rank comprises proceedings and conferences (Figure 4a and Figure 4b).

Figure 3.

Descriptive of ERM by Subject Area

(Source: Author’s own research)

Figure 4a.

ERM Document Types and Source Types

(Source: Author’s own research)

Figure 4b.

ERM Document Types and Source Types

(Source: Author’s own research)

The number of published studies on ERM has constantly increased since 1997, with an annual growth rate of 15.24%. Figure 5 indicates peaks of ERM publication in 2011, 2015, 2018, and 2019. Table 1 displays publication-related metrics. The number of contributing authors and total citations is 1813 and 9658, respectively.

There are three influential journals with both TPs and TCs in ERM: Risk Management and Insurance Review, Management Decision, and The Journal of Corporate Accounting and Finance. Among these, Management Decision (Emerald Group Publishing Ltd.) has a highest H-Index; however, its scope is not directly related to risk management. The subject areas in this journal are Business, Management and Accounting (miscellaneous) (Q1) and Management Science and Operations Research (Q1). The journal scope that relates to risk management is Risk Management and Insurance Review. There are seven pieces of ERM publications in this journal, with 102 citations between 1997 and 2023.

Most ERM publications are produced by more than a single author (figure 7), whereby the majority involve two authors. In addition, the most productive author in ERM is “David Olson”, Professor of Business Analytics, University of Nebraska, with 13 articles. His specialist associates with ERM in the supply chain. The most influential article was written by Hoyt and Liebenberg (2011) with 402 citations for the paper named “The Value of Enterprise Risk Management”. This paper evaluates the value of ERM and its implications. Both of them are in the insurance industry. Next, the paper named “Enterprise risk management: An empirical analysis of factors associated with the extent of implementation” written by Beasley, et al. (2005) conveyed the study of ERM determinants with 382 citations. The authors in this article are in the accounting field, while the first author, Prof Beasley, is a Professor of Enterprise Risk Management and the Director of the Enterprise Risk Management Initiative at the Poole College of Management. One interesting article with 343 citations conducted by Gordon, et al. (2009) concluded that the successful implementation of ERM varies across different firms under the contingency theory.

Figure 5.

Numbers of Publication in ERM during 1997-2023

(Source: Author’s own research)

Figure 6.

Total Publications and Total Citations

(Source: Author’s own research)

This research created a social network of word clustering (Figure 8) from 725 documents and 1428 author keywords. First, 1428 author keywords were cleaned and underwent preliminary clustering using two algorithms: key collision and nearest neighbor, using word key functions such as figureprint, n-gram figureprint, and Cologne phonetic. Possible words such as “ERM,” “Enterprise Risk Management,” and “Enterprise Risk System” should be clustered as same word. Afterward, a social network algorithm selects 37 author keywords that occurred at least 5 times (as given in Table 3) from the 725 documents. These 37 keywords are clustered into 6 clusters based on their co-occurrence.

Figure 7.

Single Author and Multiple Authors

(Source: Author’s own research)

Figure 8.

Network of Word Clustering

(Source: Author’s own research)

Apart from the keyword “Enterprise Risk Management” used in the search term, the most prominent keywords from the social network analysis map were Corporate Governance (27), Firm Value (20), Performance (20), Risk Assessment (18), and COSO (13). This study selects author keywords instead of all key words, as they more directly relate to the paper’s scope. The study of ERM since 1997 has focused on governance and firm value using the COSO standard.

Furthermore, top keyword pairs by degree of co-occurrence (Table 4) were analyzed based on their co-occurrences, which are ranked based on their strength or weight of association. Co-occurrence of words represents a high correlation indicating the strength of the interactions among them. The most strongly associated keywords were Corporate Governance and Enterprise Risk Management. Other significant pairs of author keywords were “Enterprise Risk Management” with “firm value, performance and Malaysia”.

The paper combines the analysis outcomes of VOSviewer and the Bibliometrix R package (Biblioshiny) to show the prominent themes. Biblioshiny creates a thematic map (Figure 9) under a two-dimensional strategic diagram: density and centrality, to end up with four themes. The first one, called the motor theme (Quadrant 1, Q1), represents important themes with high centrality and density. The author keywords, such as “corporate governance” and “COSO”, fall into this theme. Basic themes (Quadrant 2, Q2) are those with strong centrality but low development. Next, emerging or declining themes (Quadrant 3, Q3) represent low density and centrality. After combining with word clustering over the years in Figure 10, “sustainability” and “risk governance” are the emerging theme of studying ERM. Finally, Quadrant 4 (Q4) displays highly developed and isolated themes, called the niche theme, such as banking and insurance of ERM.

Figure 9.

Thematic Analysis (Source: Author’s own research)

Figure 10.

Word Clustering Across Years

(Source: Author’s own research)

Figure 11.

Three Lines of Defense

(Source: Schuett, 2023)

According to the author keyword “network analysis”, we found a significant co-occurrence among ERM, internal control (IC), and internal audit (IA). This results in the integration among ERM, IC, and IA, which consolidates into “Three Lines of Defense (3LOD).” The first line emphasizes the role of the front manager who is directly responsible for designing appropriate IC to protect against business loss (Bantleon, et al., 2021) If internal control works well, operational risk can be mitigated. While the first line is at the forefront of designing effective internal control, the second line focuses on providing compliance and oversight in the form of frameworks and policies. The second line refers to ERM and the compliance team. To ensure the effective internal control and risk framework, an independent internal audit team plays the a third-line role. 3LOD emphasizes the distinct role within an an organization relating to effectively managing risk. Our bibliometric results indicate that effective ERM should involve interaction with internal control and internal audit.

Most of the articles relating to 3LOD evaluated its quality from the perspective of financial institutions (Luburić, 2017; Tawfik, et al., 2023), whereas modern studies of 3LOD vary across industries. One contribution from Arab, et al. (2021) who studied 3LOD for wildfire risk management in electric power grids showed the ecosystem of ERM in relation to internal control and internal audit.

While 3LOD establishes different roles in firms risk management, powerful 3LOD is associated with the robust of corporate governance (CG) system (Beasley, et al., 2005d; Sithipolvanichgul, 2021b). Top keyword pairs by degree of co-occurrence indicate the most correlation between ERM and CG.

CG is defined in several ways. Some studies define CG as a principle or system of rule, while others mean it as the processes used to direct and control an organization. The ecosystems of ERM significantly correlate with CG towards the presence of the Risk Management Committee and the independence of Chief Risk Officer (CRO) (Aebi, et al., 2012; Alwi, et al., 2019; Anugerah, et al., 2023). Their studies framed their concepts using contingency and agency theory to investigate the factors such as the proportion of board independent directors, board size, board character, and CEO duality. Most of the articles found a significant association between effective ERM and CG through these factors.

However, the effectiveness of 3LOD rests on CG. Even 3LOD aims to provide a clear role in risk management, the different governance functions of each line are compulsory (Bantleon, et al., 2021). Although CG, ERM, and 3LOD are correlated, their the effectiveness depends on the organizational contingency.

There are several risk management frameworks, such as COSO, ISO 31000, the NIST Risk Management Framework (focusing on cybersecurity), and so forth. Our longitudinal study displays the clustering between COSO and ERM; consequently, the dominant standard in ERM is “COSO”. COSO launched the first framework relating to “internal control” in 2003 and closely produced COSO ERM in 2004. In 2017, COSO ERM itself improved the framework by integrating ERM with strategy and performance (Committee of Sponsoring of the Treadway Commission, 2017).

Firms established the ERM framework to follow the implementation step-by-step. Normally, the ERM framework comprises identification, assessment, mitigating, and monitoring risk, but COSO emphasizes governance, culture, and values of ERM. Hayne and Free (2014, p. 327) conducted an interview with ERM professionals and gathered information about why COSO is dominant over other ERM frameworks. Their findings showed that the COSO framework defines the language of governance and senior management responsibility. This results in the distinctive ERM framework from COSO, yet, it also contains pitfalls. COSO focuses on identifying internal risk, while external forces are neglected (Fuentes, et al., n.d.).

Even though firms embed the same ERM framework, effective ERM implementation varies depending on the firm culture. Organizational culture is defined as the underlying values, beliefs, and assumptions in firms as well as their patterns of behavior (Syrová and Špička, 2023). There was evidence that proves the positive correlation between clan culture and organization performance (Yazici, 2011); however, clan culture did not ensure effective ERM.

Most articles define firm culture as the determinant; however, there is a lack of empirical evidence to explain which particular types of firm culture are suitable for ERM implementation. A detailed study on ERM and firm culture from Kimbrough and Componation (2009) refined the Organizational Culture Assessment (OCA) and mapped the correlation with ERM. The result concluded that ERM is positively associated with organic culture rather than mechanistic culture. Organic culture is directly related to lateral communication and employee commitment, while mechanistic culture refers to structure and policy. This study contains the limitation that while the empirical model established the relationship between ERM and organic culture, it would not conclude that effective ERM implementation is caused by the organic structure.

As mentioned in the introduction, ERM is distinct from TRM as it focuses on value creation. The bibliometric model displays the co-occurrence among ERM, firm value, organizational performance, and financial performance. Several studies demonstrated the relationship between ERM and firm performance but used different variables. Some of them used financial performance disclosed in financial statements while others considered non-financial measures.

Cluster 6 in Table 3 represents the correlation between ERM, sustainability, and corporate social responsibility that were confirmed in the works of Nyantakyi (et al., 2023) and Saardchom (2013). The thematic analysis from Figure 9 displayed sustainability and corporate social responsibility as emerging themes. This indicates that, to identify risk, firms should consolidate external factors such as environment and social risks as firm risk profile.