M.Phil. / The premise of this research study was to study the phenomenon of Enterprise Risk Management (ERM) in order to understand the processes and practices of risk management within First National Bank (FNB). Risk management became a favourite topic for discussion in the aftermath of the Global Financial Crisis (GFC). Some analysts, chief financial officers and observers have noted that risk management is to blame for the economic recession and myriad of bank failures that ensue. However, the intention of this research study was not to analyse the GFC or to devote itself entirely to defend risk management and risk managers.

I företag och organisationer är det vanligt att riskanalyser genomförs som ett led i arbetet med att hantera de risker och hot som verksamheten kan möta. En viktig del i en riskanalys är det första steget som går ut på att identifiera risker och hot, så kallad riskidentifiering. En brasiliansk studie pekar på att kunskapen kring riskidentiferingstekniker i brasilianska företag generellt sett är låg. Eftersom det förefaller finnas ingen eller mycket lite forskning i ämnet applicerat på svenska företag valde jag att undersöka hur stor kunskap som svenska tillverkningsföretag med huvudkontor i Göteborgsregionen har kring riskidentiferingstekniker. Tanken är dels att resultatet av undersökningen dels ska kunna utvecklas och användas som underlag i andra vetenskapliga studier, men också att det ska kunna vara möjligt att användas till en mer praktisk tillämpning. Undersökningen genomfördes med en kvantitativ enkätundersökning där jag så långt som möjligt försökte utforma frågor och svarsalternativ utifrån de regler och standarder som finns inom metodiklitteraturen. Frågorna rörde huruvida företaget tidigare hade gjort en riskanalys tidigare, hur stor kunskap de hade kring ett antal nämnda tekniker för riskidentifiering och om de hade använt några av dessa tidigare. Populationen avgränsades till att bara omfatta företag som låg innanför vissa kriterier. Enkäten skickades sedan till populationens samtliga 134 företag, varav 34 (25%) fullföljde och skickade in sina svar. Det är för få företag för att resultatet ska kunna generaliseras, men utifrån de förutsättningar och begränsningar som har funnits anser författaren att undersökningen har en god validitet och reliabilitet. Resultatet av undersökningen visar till att börja med att det 41% av företagen har genomfört en riskanalys tidigare. Brist på tid och kunskap är två faktorer som är bidragande till att vissa företag inte har valt att genomföra en riskanalys. Undersökningen visar också att majoriteten av företagen har tillräckligt stor kunskap för att använda 3-6 olika tekniker på ett bra sätt eller fullt ut. Det är tydligt att företagens kunskaper kring respektive teknik tenderar att öka benägenheten att använda densamma. Brainstorming, checklistor och SWOT-analys är alla populära tekniker att använda vid riskidentifiering. Samma tekniker är de som rankas högt när företagen listar vilka tekniker de kan använda bäst. Det finns ett antal olika vägar för den som vill forska vidare inom ämnet. En av dem är att göra en till studie som genomförs i syfte dels att bekräfta den undersökning som jag har gjort, men som också är större och inkluderar fler företag över en större area. Det skulle också vara möjligt att titta på riskidentifieringsteknikerna mer noggrant för att titta på vilken av dem som är bäst i vilken situation, fördelar och nackdelar, etcetera. / Risk assessments are a common way for organizations to address the risks and threats that the business may face. A vital part in a risk assessment is the first step which is to identify risks and threats, so-called risk identification. A Brazilian study indicates that knowledge about risk identification methods in Brazilian companies is generally low. Since there appears to be no or very little research on the subject applied to Swedish companies, I decided to investigate how much knowledge Swedish manufacturing companies headquartered in the Gothenburg region has regarding risk identification methods. The idea is that the outcome of the study could be used as a base in other scientific studies, but also that it should be possible to use a more practical application. The study was conducted with a quantitative survey in which I, as far as possible, tried to formulate questions and response options based on the standards that exist within the methodology literature. The questions covered whether the company in question had done a risk assessment before, how much knowledge they had about a number of mentioned methods for risk identification and if they had used any of these before. The population was restricted to only include companies that were within certain criteria’s. The questionnaire was then sent to the population of all 134 companies, of which 34 (25%) completed and submitted their answers. There were too few answers for the results to be generalized, but based on the conditions and limitations that have been presented the author believes that the study has good validity and reliability. The results of the survey show that 41% of the companies have undertaken a risk assessment in the past. However, lack of time and knowledge are two contributing factors to that some companies have chosen not to undertake a risk assessment. The results also shows that the majority of the companies have sufficient knowledge to use 3-6 different methods in either a sufficient way or to a full extent. It is clear that the usage of each method is aligned with the level of knowledge for that method – a method where the companies have a high average knowledge is likely to be more frequently used. Three examples are the use of brainstorming, checklists and SWOT-analysis which are all popular methods to use in the risk identification. The same methods are also those that rank high when companies list the methods they can use best. There are a number of different avenues for those wishing to do further research in this subject. One of them is to do the same kind of study, but to include more companies over a larger area. It would also be possible to look at the risk identification methods more closely to investigate which of them is best in which situation, with their respective advantages and disadvantages.

D.Phil. / The purpose of the study is to construct and evaluate a measuring instrument that could determine the business impact of enterprise risk management (ERM) processes on State-Owned Enterprises (SOEs) in South Africa. In respect of ERM, various authors point out that there is little empirical research on the topic and almost no research regarding the evaluation of its effectiveness and value contribution to organisations. In addition, the current measurement tools for assessing the management of risk maturity are based on subjective assessments or comprised of checklists of activities that assess ERM components based on individual opinions. It was against this setting that the literature review focuses on the components and the broader organisational improvement strategies within which ERM is practised. This entails outlining corporate governance and discussing its processes and practices. In particular, the discussion focuses on historical and current practices, corporate scandals and the lessons learned from them, internationally accepted codes, local corporate governance codes, and corporate governance codes applicable to SOEs. The discussion concerning the management of risk concentrates on its fundamental principles, the link with corporate governance, and the broader discipline and practice of ERM. The significance of ERM is further elaborated on by focusing on its approach, the key local and international ERM standards and associated principles, ERM evaluation practices, and current shortcomings identified in the management of risks. In order to meet the empirical objectives of the study, a pragmatic research paradigm, using a mixed methods approach, was chosen. This selection was considered appropriate as the pragmatic paradigm applies all research approaches in understanding a problem. To this extent, a mixed methods research approach was adopted, comprised of the qualitative approaches to sampling, interviews, observations, the review of organisational documents, the Delphi method, construction of the questionnaire items, and development of the instrument. The point of interface between the research approaches occurred at the level of sampling and the analysis of the results collated from the validation of the instrument by applying descriptive and inferential statistical methods.

Magister Commercii (Information Management) - MCom(IM) / This thesis examines what a Business Continuity Plan (BCP) should comprise off, as well as the difference between a BCP and a Disaster Recovery Plan (DRP) and the key elements of an effective BCP as well as the different types of disasters. It also investigates why companies that have BCP in place and conducts testing of their plan on a regular basis, either quarterly or bi-annually, still experience prolonged downtime during a disaster resulting in Service Level Agreements (SLA) not being met or major financial loses. It also inspects acceptable processes within a BCP to determine whether there are ways of improving these processes to prevent companies from experiencing prolonged downtime. The objective of this research is to determine and understand: • Why organisations within the Western Cape experience prolonged downtimes during a disaster event • The potential deficiencies in a BCP and how they can be amended.

Faktory, jako například rostoucí globalizace, technologický vývoj, Internet a zvyšující se nároky vlastníků na vedení organizací v oblasti řízení rizik, vedly organizace ke změně jejich přístupu k řízení rizik. Nový přístup se označuje jako ?Enterprise Risk Management? (ERM). Podstatou ERM je efektivně řídit všechna rizika, kterým organizace čelí, a to na všech úrovních organizace jednotným a integrovaným způsobem. Práce charakterizuje ERM včetně důvodů vzniku, vývoje, definice obecného ERM procesu, současné situace a trendů. Podrobně jsou popsány vybrané čtyři nejvýznamnější standardy a rámcové publikace v oblasti ERM včetně jejich srovnání.

Definition of enterprise risk management (ERM), key point of implementation, application techniques in key areas. Use some concrete application techniques in real organization - Huhtamaki Česká republika, a.s.

The purpose of this single case study was to explore enterprise risk management strategies that nonprofit business leaders used to maintain and improve organizational sustainability. The study population included 3 executive leaders from a rehabilitation and social services nonprofit agency located in the northeastern United States. The Committee of Sponsoring Organizations integrated enterprise risk management framework was the conceptual lens used in this study. Data were collected through semistructured interviews with the 3 executive leaders of the client organization and review of internal, external, and publicly available documents. Data and information from documents and interviews were manually coded. Findings were validated through data triangulation and member checking to help ensure accuracy, consistency, and credibility. Several overarching themes emerged from data analysis related to managing risk for sustainability: a commitment to culture and the mission, vision and values; operational efficiencies to build a financially strong organization; engagement of executive staff and board members; and addressing staffing needs for ongoing operations to meet client needs. Findings from this study might contribute to positive social change by providing nonprofit leaders with enterprise risk management strategies and processes to maintain and improve organizational performance, thereby helping to ensure leaders’ ability to serve and improve their communities.

Bakgrund: Riskhantering har blivit en viktig aktivitet i offentliga såväl som privata organisationer. Svenska förvaltningsmyndigheter ställs inför allt högre krav att effektivisera sina verksamheter samtidigt som de har ett samhällsansvar för att skydda verksamheten från allvarliga störningar som kan ha en påverkan på landets funktionalitet och befolkningens välbefinnande. Vikten av att samordna riskhanteringsarbetet har därför fått en stor betydelse för att effektivt kunna hantera riskexponeringen. Myndighet X är en förvaltningsmyndighet som genomgår ett förändringsarbete för att samordna sitt riskhanteringsarbete från att tidigare ha hanterat risker som en frikopplad aktivitet. Det finns en avsaknad i tidigare forskning specifikt hur en svensk förvaltningsmyndighet kan gå tillväga för att samordna sitt riskhanteringsarbete.   Syfte: Syftet med studien är skapa en förståelse för hur en svensk förvaltningsmyndighet kan samordna sin riskhantering. För att klargöra detta ska studien kartlägga Myndighet X syn på risk och deras riskhanteringsarbete. Vidare ska studien identifiera och analysera vilka svårigheter Myndighet X upplever i samordningen av sin riskhantering och därefter ge förslag på hur dessa svårigheter kan hanteras.   Metodval: Denna studie är en kvalitativ fallstudie på Myndighet X. Det empiriska materialet har samlats in genom semi-strukturerade intervjuer med ett snöbollsurval för att komma i kontakt med respondenter som har den kompetens som krävs för att kunna bidra till att studiens syfte uppfylls.   Slutsats: Myndighet X gör risk- och möjlighetsanalyser enligt ISO-standarder i sina respektive processer där sedan de mest väsentliga riskerna filtreras upp till verksamhetsplaneringen där generaldirektören använder denna information för att göra den övergripande riskanalysen enligt förordningen om intern styrning och kontroll. Denna riskanalys används sedan som beslutsunderlag för styrningen mot strategiska mål. Studiens resultat illustreras i en modell som är en utveckling av Myndighet X nuvarande riskhanteringsarbete och inkluderar förslag hur svårigheter i samordningen av riskhanteringsarbetet kan hanteras.   Nyckelord: Risk, Enterprise Risk Management, Svensk förvaltningsmyndighet, Samhällsviktig verksamhet, Förordningen om intern styrning och kontroll. / Background: Risk Management has become an important activity in public as well as private organizations. Swedish management authorities are faced with ever-increasing demands to streamline their operations while at the same time having a social responsibility to protect the business from serious disruptions that can affect the country's functionality and well-being. The importance of integrating the risk management activities has a great importance in order to effectively manage and control the risk exposure. Myndighet X is a management authority that is undergoing a change process to integrate its risk management work from previously have managed risks as a decoupled activity. There is a lack of previous research specifically how a Swedish management authority can proceed to integrate its risk management work.   Purpose: The purpose of this study is to create an understanding of how a Swedish management authority can integrate its risk management activities. To clarify this, the study will map the Myndighet X's view of risk and their current risk management work. Furthermore, the study will identify and analyze which difficulties Myndighet X are experiencing in the integration of its risk management work and then give suggestions on how these difficulties can be managed.   Method: This study is a qualitative case study on Myndighet X. The empirical material has been collected through semi-structured interviews with a snowball selection to get in touch with respondents who have the skills required to be able to contribute to fulfil the purpose of the study.   Conclusion: Myndighet X makes risk- and opportunity analysis according to ISO standards in their different business processes, where the most significant risks are filtered up to the business planning, where the director general uses this information to make the overall risk analysis according to the regulation on internal governance and control. The results of the study are illustrated in a model that is a development of Myndighet X's current risk management work that includes proposals on how difficulties when integrating the risk management work can be managed. Keywords: Risk, Enterprise Risk Management, Swedish management authority, Society importance, Regulation on internal governance and control.

Purpose: The purpose of this research was to examine and provide knowledge of how integration between enterprise risk management (ERM) t and performance measurement systems (PMS) can support the companies towards improving strategic decision-making within small Swedish manufacturing tech companies. The proceeding purpose was also to research challenges occurring when integrating enterprise risk management and performance measurement systems and further study how the challenges can be mitigated. The research questions within the study were. Methodology: In order to conduct the research, a literature review has been made in order to establish a good theoretical foundation in order to answer the research questions through an abductive approach. A qualitative method, through an exploratory approach, has been applied in order to answer the research question and the purpose of the study. Multiple case studies with interview data towards hermeneutic interviews have been selected as a strategy. The empirical data have been collected through semi-structured interviews and were provided by five respondents who work with both ERM and PMS on a daily work basis. Further, the theory and empirical data have been analyzed through cross-case synthesis and interactive spiral. Finding: The findings in this research resulted in the integration of ERM and PMS, improving strategic decisions by supporting each other's infirmity. What can be said from the findings is that ' ERM can greatly measure risk when integrating the PMS and to further help determine relevant strategic decisions. The outstanding findings regarding the challenges when integrating ERM and PMS were a large amount of data to handle and a never-ending list of potential risks. In order to mitigate the challenges regarding the integration of ERM and PMS, it is important to take into consideration the communication between the two.

Enterprise Risk Management (ERM) is a program that manages all firm risks in an integrated framework to control and coordinate offsetting risks. In this study, I provide the first archival evidence on how ERM affects firms' day-to-day, routine operations. Using hand-collected ERM adoption data and inventory information, I examine whether firms with an ERM program experience an improvement in their inventory management. My findings suggest that ERM adoption is associated with greater inventory turnover ratios and lower inventory impairments. These results are robust to a range of models in addressing endogeneity concerns. Additionally, I find that ERM's effect on inventory management is stronger among firms with greater financial distress, with less investments in innovation, or with higher information asymmetries, and when firms' ERM program grows more mature. My study documents ERM's real economic benefits to firms' operations and highlights how ERM contributes to operating performance.