An evaluation of enterprise risk management (ERM) from a corporate governance perspective in non-financial listed companies

Abstract

Purpose: Recent corporate governance scandals and disasters have shed a light on the importance of embracing improved risk management practices and better governance. This is especially owing to the harmful consequences caused by these collapses. In view of this, the scope of the study is to evaluate whether non-financial listed companies' corporate governance structures are sophisticated enough to facilitate effective enterprise risk management (ERM). In addition, this research also presents a gap analysis, showing with clarity the divergence between international best practice and the local current practice. Design: In order to achieve the aforementioned objectives, interviews were conducted with representatives of Maltese non-financial listed companies, who were in the majority board members. The outcomes of the said interviews were subsequently analysed and compared. Findings: The study shows that risk management is indeed receiving enhanced recognition and being allocated increased time. However, despite this appreciation, local non-financial listed companies are struggling to implement and to embed ERM practices within their corporate governance structures. Nonetheless, although the majority of the respondents do not have formal ERM systems, the study ascertained that an enterprise-wide approach in managing risk has long been adopted locally, which resulted in participants responding confidently on their ability to mitigate risk. It can therefore be concluded that local companies should augment the formality of their current risk management practices to reap enhanced benefits. Value: The results to this research can aid local companies obtain an improved perspective towards risk. This is especially demonstrated through the gap analysis and through the recommendations provided to reduce this gap. Furthermore, this valuable illustration will enable local companies to consider implementing these recommendations, thereby improving on their existing risk management practices.