This paper investigates the processes that comprise enterprise-wide risk management (ERM) programs implemented by organizations. ERM is a holistic approach of risk management that looks at organization-level risks on a portfolio basis, unlike traditional risk management that looks at silos of individual risks within an organization. The practitioner and academic literatures provide many insights into different frameworks that could be used to implement ERM, but there is little written about the processes and activities that represent actual organizations’ ERM approaches. By looking at the way an organization accomplishes its mission through its management style and communication methods, the role corporate culture plays in an ERM implementation are examined.
Employing interviews and surveys of ERM champions in 14 organizations, this study provides rich insights into ERM implementation. The interviews revealed that organizations were most likely to undertake an ERM implementation to meet strategic needs often motivated by encouragement for the process from the board of directors (BOD) and audit committee, with few objections raised. The ERM process typically began with a list of risks developed with senior management input, and ERM often resulted in organizational changes with new responsibilities being the most common change. Few of the organizations had a formal definition of risk appetite, with many describing the appetite definition as included in strategic objectives or procedures.
When it came to identifying and assessing top risks, an iterative process was used which crossed multiple layers of the organization and cross-functional groups. The key players in the ERM process were Internal Audit (IA), general counsel, audit committee, CFO, and BOD, with IA most commonly identified having ownership over the day-today ERM leadership. Most organizations had management level ERM committees, but few had departments dedicated to ERM. The interviewees identified positive impacts of ERM more often than negative effects of ERM. While most of the organizations had an organic culture and had relatively advanced ERM implementations, there were some differences in interview responses between the organic and “less organic” groups. This study has implications for corporate governance in the areas of successful ERM methods and overall risk management of an organization.
","abstract_html":"<p>This paper investigates the processes that comprise enterprise-wide risk management (ERM) programs implemented by organizations. ERM is a holistic approach of risk management that looks at organization-level risks on a portfolio basis, unlike traditional risk management that looks at silos of individual risks within an organization. The practitioner and academic literatures provide many insights into different frameworks that could be used to implement ERM, but there is little written about the processes and activities that represent actual organizations’ ERM approaches. By looking at the way an organization accomplishes its mission through its management style and communication methods, the role corporate culture plays in an ERM implementation are examined.</p> <p>Employing interviews and surveys of ERM champions in 14 organizations, this study provides rich insights into ERM implementation. The interviews revealed that organizations were most likely to undertake an ERM implementation to meet strategic needs often motivated by encouragement for the process from the board of directors (BOD) and audit committee, with few objections raised. The ERM process typically began with a list of risks developed with senior management input, and ERM often resulted in organizational changes with new responsibilities being the most common change. Few of the organizations had a formal definition of risk appetite, with many describing the appetite definition as included in strategic objectives or procedures.</p> <p>When it came to identifying and assessing top risks, an iterative process was used which crossed multiple layers of the organization and cross-functional groups. The key players in the ERM process were Internal Audit (IA), general counsel, audit committee, CFO, and BOD, with IA most commonly identified having ownership over the day-today ERM leadership. Most organizations had management level ERM committees, but few had departments dedicated to ERM. The interviewees identified positive impacts of ERM more often than negative effects of ERM. While most of the organizations had an organic culture and had relatively advanced ERM implementations, there were some differences in interview responses between the organic and “less organic” groups. This study has implications for corporate governance in the areas of successful ERM methods and overall risk management of an organization.</p>","abstract_has_math":false,"creators":["Viscelli, Therese R."],"institution":null,"degree_name":"Doctor of Business Administration (DBA)","degree_level":"Dissertation","degree_discipline":"Accountancy","degree_department":null,"school":null,"contributors":["Dr. Dana R. Hermanson","Dr. Mark S. Beasley","Dr. Jeffrey Cohen"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2013,"date_issued":"2013-07-01T07:00:00Z","date_published":"2013-07-01T07:00:00Z","updated_at":"2026-07-24T02:42:53Z","subjects":["Risk","ERM","culture","internal audit","governance","audit committee","board of directors","COSO","risk silo","Business Administration, Management, and Operations"],"languages":[],"rights":[],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://digitalcommons.kennesaw.edu/etd/582","outbound_label":"Repository record","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Dr. Dana R. Hermanson","Dr. Mark S. Beasley","Dr. Jeffrey Cohen"]},{"key":"dc:creator","label":"Author","values":["Viscelli, Therese R."]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.available","label":"Dc Date Available","values":["2013-10-14T07:00:00Z"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Accountancy"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Doctor of Business Administration (DBA)"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Risk","ERM","culture","internal audit","governance","audit committee","board of directors","COSO","risk silo","Business Administration, Management, and Operations"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://digitalcommons.kennesaw.edu/etd/582"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["This paper investigates the processes that comprise enterprise-wide risk management (ERM) programs implemented by organizations. ERM is a holistic approach of risk management that looks at organization-level risks on a portfolio basis, unlike traditional risk management that looks at silos of individual risks within an organization. The practitioner and academic literatures provide many insights into different frameworks that could be used to implement ERM, but there is little written about the processes and activities that represent actual organizations’ ERM approaches. By looking at the way an organization accomplishes its mission through its management style and communication methods, the role corporate culture plays in an ERM implementation are examined.
Employing interviews and surveys of ERM champions in 14 organizations, this study provides rich insights into ERM implementation. The interviews revealed that organizations were most likely to undertake an ERM implementation to meet strategic needs often motivated by encouragement for the process from the board of directors (BOD) and audit committee, with few objections raised. The ERM process typically began with a list of risks developed with senior management input, and ERM often resulted in organizational changes with new responsibilities being the most common change. Few of the organizations had a formal definition of risk appetite, with many describing the appetite definition as included in strategic objectives or procedures.
When it came to identifying and assessing top risks, an iterative process was used which crossed multiple layers of the organization and cross-functional groups. The key players in the ERM process were Internal Audit (IA), general counsel, audit committee, CFO, and BOD, with IA most commonly identified having ownership over the day-today ERM leadership. Most organizations had management level ERM committees, but few had departments dedicated to ERM. The interviewees identified positive impacts of ERM more often than negative effects of ERM. While most of the organizations had an organic culture and had relatively advanced ERM implementations, there were some differences in interview responses between the organic and “less organic” groups. This study has implications for corporate governance in the areas of successful ERM methods and overall risk management of an organization.
"]},{"key":"dc:title","label":"Title","values":["The ERM Process: Evidence from Interviews of ERM Champions"]}]}],"canonical_facts":{"dc:contributor":["Dr. Dana R. Hermanson","Dr. Mark S. Beasley","Dr. Jeffrey Cohen"],"dc:creator":["Viscelli, Therese R."],"dc:date.available":["2013-10-14T07:00:00Z"],"dc:description.abstract":["This paper investigates the processes that comprise enterprise-wide risk management (ERM) programs implemented by organizations. ERM is a holistic approach of risk management that looks at organization-level risks on a portfolio basis, unlike traditional risk management that looks at silos of individual risks within an organization. The practitioner and academic literatures provide many insights into different frameworks that could be used to implement ERM, but there is little written about the processes and activities that represent actual organizations’ ERM approaches. By looking at the way an organization accomplishes its mission through its management style and communication methods, the role corporate culture plays in an ERM implementation are examined.
Employing interviews and surveys of ERM champions in 14 organizations, this study provides rich insights into ERM implementation. The interviews revealed that organizations were most likely to undertake an ERM implementation to meet strategic needs often motivated by encouragement for the process from the board of directors (BOD) and audit committee, with few objections raised. The ERM process typically began with a list of risks developed with senior management input, and ERM often resulted in organizational changes with new responsibilities being the most common change. Few of the organizations had a formal definition of risk appetite, with many describing the appetite definition as included in strategic objectives or procedures.
When it came to identifying and assessing top risks, an iterative process was used which crossed multiple layers of the organization and cross-functional groups. The key players in the ERM process were Internal Audit (IA), general counsel, audit committee, CFO, and BOD, with IA most commonly identified having ownership over the day-today ERM leadership. Most organizations had management level ERM committees, but few had departments dedicated to ERM. The interviewees identified positive impacts of ERM more often than negative effects of ERM. While most of the organizations had an organic culture and had relatively advanced ERM implementations, there were some differences in interview responses between the organic and “less organic” groups. This study has implications for corporate governance in the areas of successful ERM methods and overall risk management of an organization.
"],"dc:identifier":["https://digitalcommons.kennesaw.edu/etd/582"],"dc:subject":["Risk","ERM","culture","internal audit","governance","audit committee","board of directors","COSO","risk silo","Business Administration, Management, and Operations"],"dc:title":["The ERM Process: Evidence from Interviews of ERM Champions"],"thesis:degree_discipline":["Accountancy"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Doctor of Business Administration (DBA)"]},"updated_at":"2026-07-24T02:42:53Z"}