(In)Consistency Between Private and Public Disclosure on Enterprise Risk Management and Its Determinants

Abstract

Worldwide governance organizations and regulators have recently called for more enhanced disclosures about how organizations manage risks. Enterprise Risk Management (ERM) is recognized as a value-contributing best practice even when legal standards do not require it (Whitman in Risk Manag Insur Rev 18(2):161–197, 2015), but public disclosure on such a process is not generally mandatory. In Italy emphasis on risk disclosure started in 2008 but it was the 2011 revision of the Corporate Governance (CG) code for listed companies to ask for the board commitment in disclosing, within the CG report, about the main internal control and risk management system’s characteristics (Borsa Italiana in Codice di Autodisciplina, 2011). Given the proprietary nature of risk information in addition to the Italian capital market characteristics (small capitalization and presence of a dominant shareholder) and the lack of any mandate for what specific aspects board should disclose, the study aims at investigating a potential variation between private and public disclosure on ERM. Relying on the ERM concepts provided by the COSO framework (2004) the author submitted a survey seeking information about ERM practices within Italian listed companies. Such a private information is compared to public CG reports released by the same companies. The comparison shows companies tend to privately reveal a more effective ERM process than the one they publicly disclose. An examination of CG and firm’s risk variables potentially determining higher variation—i.e. information inconsistency—supports proprietary costs theory rather than agency theory expectations. Thus showing the limits of voluntary disclosure dealing with risk management systems. The study might have international policy implications.

Appendix: Survey

The survey questions about an ERM process were developed using the seven fundamental concepts defining ERM from the COSO framework as a basis. Twelve questions in the survey map to the seven fundamental concepts from COSO to operationalize them. Thus, scores based on the 12 factors were created based on the survey responses and scores based on the same 12 factors were created based on the reading of the CG reports. Specifically, as summarized in Table 3, the first concept—defining ERM as a process on-going and flowing through the entity—is composed by one factor identifying the extent of ERM implementation (Paape and Speklé 2012). The second concept relates to the participation extent of people at every level of the organization. Therefore, the two factors by which it is composed respectively ask for training activities (Beasley et al. 2015) and business plan resources allocated to the ERM process (NCSU & Protiviti report 2016). Both these factors indeed aim at widening the ERM scope among people within the organization.

The third fundamental concept is about the application in the strategy setting and thereby the factor investigates the relation of ERM with strategic planning (Frigo and Anderson 2011; Beasley et al. 2015; COSO framework draft 2016). The fourth concept is composed by three factors investigating the identification and prioritization of risks, the methodology used for risk prioritization, and the extent of integration⁹ in risk prioritization to verify the application of the process across the enterprise (Arena et al. 2011; Paape and Speklé 2012). In particular, Arena et al. (2011) in their study based on the Italian setting find that generally an entity’s risk evaluation method comprises a combination of qualitative and quantitative techniques. Also other studies find a combination of the two methodologies (Woods 2009; Jordan et al. 2013; Mikes 2009). Thus, for this factor based on a three-point scale and related to the methodology used for risk prioritization, it is attributed a 1 only in the case both the methodologies are applied by the company, 0 otherwise.

Then, the ERM process according to the fifth concept needs to be designed to identify potential events that, if they occur, will affect the entity and to manage risk within its risk appetite. A crucial element to identify potential events is a frequent communication in terms of risk reporting (Paape and Speklé 2012). Thus, the current study aims to investigate the frequency of risk reporting and its temporal orientation (back vs. forward-looking). Considering the proactive aim of ERM, the coding choice is to attribute a 1 if respondents answer forward-looking, 0 otherwise.

The sixth concept relates to the ERM process’ ability to provide reasonable assurance to an entity’s management and board of directors. Beasley et al. (2005) is the first study identifying Chief Risk Officer role (or a person having the same role but with a different title) as a good proxy for ERM effectiveness. The presence of such a person in charge for the process can provide the requested reasonable assurance of the ERM process (Baxter et al. 2013; Ellul and Yerramilli 2013). Another related factor providing assurance to the process is the frequency of risk managers’ meetings. Finally, the seventh concept geared to the achievement of objectives in one or more separate but overlapping categories is operationalized in a question asking for the level of comprehensiveness (i.e. range of risks) considered (Arena et al. 2011). Risks can be classified according many overlapping categories linked to the companies’ goals, such as strategic, operative, compliance and reporting (COSO 2004; AICPA & NCSU 2016). Wider and more holistic level of risks comprehensiveness considered can contribute to overcame a silo-based approach and to the companies’ objectives achievement.

For a detail about the survey/report factors and corresponding five-point scale answers see the following.

• Concept 1. A process, ongoing and flowing through an entity

Item 1. How much has Enterprise Risk Management (ERM) process been implemented?

• 1. Risk management is mainly incident-driven; no plans exist to implement ERM.

• 2. We actively control risk in specific areas (e.g. health & safety, financial risk); we are considering to implement a complete ERM.

• 3. We identify, assess and control risk in specific areas; we are planning to implement a complete ERM.

• 4. We identify, assess and control strategic, financial, operational and compliance risks; we are in the process of implementing a complete ERM.

• 5. We identify, assess and control strategic, financial, operational and compliance risks; ERM is an integral part of the (strategic) planning & control cycle.

• Concept 2. Effected by people at every level of an organization

Item 2. Are training activities about risk carried out?

• 1. Not at all

• 2. Minimally

• 3. Somewhat

• 4. Mostly

• 5. Extensively

Item 3. Are business plan resources allocated to ERM initiatives?

• 1. Not at all

• 2. Minimally

• 3. Somewhat

• 4. Mostly

• 5. Extensively

• Concept 3. Applied in strategy setting

Item 4. To make stronger the responsibilities is there a relation between capital allocation, budget decisions and identified risks? Namely, risk management process is related to strategic planning?

• 1. Not at all

• 2. Minimally

• 3. Somewhat

• 4. Mostly

• 5. Extensively

• Concept 4. Applied across the enterprise, at every level and unit, and includes taking an entity-level portfolio view of risk

Item 5. Do you identify and prioritize risks?

• 1. No at all

• 2. Minimally

• 3. Somewhat

• 4. Mostly

• 5. Extensively

Item 6. Which kind of methodology do you use to prioritize risks:

• 1. Qualitative: phenomenon description;

• 2. Quantitative: phenomenon description in monetary terms;

• 3. Both

Item 7. What is the extent of integration in risk prioritization?

• 1. Not at all widespread

• 2. Uncommon

• 3. Spread just at top levels: board and top management

• 4. Spread in the majority of the organization: board, top and middle managers

• 5. Enterprise widespread: board, top and middle managers and operative levels

• Concept 5. Designed to identify potential events that, if they occur, will affect the entity and to manage risk within its risk appetite

Item 8. What is the frequency of general risk reporting?

• 1. Every 3 years or never

• 2. Once a year

• 3. Every 9 months

• 4. Twice a year (every 6 months)

• 5. Every 3 months or less

Item 9. Temporal orientation of risk reporting:

• 1. Past-looking (overcame risks)

• 2. Forward-looking (expected risks)

• Concept 6. Able to provide reasonable assurance to an entity’s management and board of directors

Item 10. Who is accountable for ERM process?

• 1. CEO

• 2. Internal Auditor

• 3. Board

• 4. Chief Risk Officer

• 5. Others (specify)

Item 11. ERM managers meeting: what is their frequency?

• 1. Every 3 years or never

• 2. Once a year

• 3. Every 9 months

• 4. Every 6 months

• 5. Every 3 months or less

• Concept 7. Geared to achievement of objectives in one or more separate but overlapping categories

Item 12. What is the level of comprehensiveness—range of risks considered (strategic, operative, compliance and reporting risks…)?

• 1. Not at all

• 2. Minimally

• 3. Somewhat

• 4. Mostly

• 5. Extensively