落實風險管理為公司治理與透明化過程之重要指標－2008年金融風暴之發生再度引起國內外對風險管理之重視，此也顯示風險管理並無真正落實；為達成此目標，企業風險管理之推動為關鍵因素，此部分除依賴監理機關制定規範要求保險業實行外，獨立第三者之信用評等機制亦扮演重要訊息提供之角色，藉由其對企業風險管理發展出之評鑑標準，及其對眾多受評公司進行評等的過程及瞭解，可提供保險業建置與落實企業風險管理之方向及做法。 保險業主要信用評等機構對企業風險管理的評鑑標準不同，本研究找出最佳信用評等機構之評鑑項目－風險管理文化、風險控管程序、新興風險管理、風險及經濟資本模型、策略性風險管理，及相關之評鑑標準；另藉由信用評等機構對保險業企業風險管理之調查分析，瞭解國內保險業者目前所面臨之關鍵問題：(1)大部分仍停留在傳統風險管理階段；(2)風險胃納、風險容忍度及風險限額定義及關聯不明瞭；(3)經濟資本及風險調整後報酬量化能力不足。 歸納本研究結果，(1)藉信評機制對企業風險管理之評鑑項目及標準，可為國內保險業建置企業風險管理之參考依據；(2)從信評機構對企業風險管理之評等，可瞭解國內保險業之執行成果及問題，具有值得參考之價值。本文亦提出風險管理文化、風險及經濟資本模型相關之建議，以落實企業風險管理。 / To truly implement risk management is the important indicator of corporate governance and transparency progresses－the finanacial crisis in 2008 has resulted in the focus of risk management again, of which the implications have presented it hadn’t been done well. The Enterprise Risk Management (ERM) is the key factor to achieve the objective of truly implemented. In addition to the supervisors imposing those regulations so as to request execuation by insurance industy, the independent third party－rating agencies have provided valuable information. By way of the ERM indicators developed by rating agencies, together with the experiences and understandings getting from rating procedures, they can give the ERM directions and practises to insurance industry. The major rating agencies for insurance industry have different views to ERM critirias. The thesis has found out the best items and their relative indicators developed by rating agency－Risk Management Culture, Risk Control Processes, Emerging Risk Management, Risk & Economic Capital Models, and Strategic Risk Management. Moreover, the thesis has explored the key issues faced by domestic insurance industry through the ERM surveys conducted by rating agencies: (1)the majority of insurers have still positioned at the stage of traditional risk management; (2)the understanding to definitions and relatives of risk appetite, risk tolerance and risk limit are inambigious; (3)the quantibility of economic capitals and risk-adjusted returns aren’t appropriate. The thesis has concluded: (1)the ERM items and critirias developed by rating agencies can be the references to establish their own ERM by domestic insurance industy; (2)they are valuable references to know the situations of implementation and issues faced by domestic insurance industry through the ERM rating items and critirias. In the end, the thesis has submited the suggestions within risk management culture and risk & economic capital models in oder to truly implement ERM.

La presente tesi di dottorato affronta il tema della gestione dei rischi che ha assunto sempre maggiore importanza nella vita dell'impresa. E'importante per tutti gli stakeholder, dai dipendenti agli azionisti, comprendere quale sia il trade - off tra rischio e rendimento potenziale poiché la mancata identificazione dei rischi e la loro non corretta gestione può compromettere la capacità dell'impresa di raggiungere i propri obiettivi. Dopo aver introdotto il concetto di rischio, la tesi si sofferma sul modello dell'Enterprise Risk Management (ERM) e sui benefici associati al suo utilizzo. In particolare l'attenzione viene posta sull'importanza, all'atto di un'operazione di natura straordinaria, quale un'acquisizione o la quotazione su mercati regolamentati, della valutazione dei rischi e delle risposte che l'organizzazione pone in essere. Viene illustrato il processo di due diligence e, in particolare, la due diligence assicurativa e di risk management viene indicata quale valido strumento per comprendere quali siano i rischi a cui un'impresa è esposta e come essa li gestisca. In conclusione, vengono descritte alcune soluzioni (i.e. assicurazione delle representation & warranty, assicurazione della responsabilità da prospetto informativo, assicurazioni ambientali) utilizzabili dall'impresa, durante una transazione, per mitigare il proprio profilo di rischio trasferendo particolari rischi a mercati assicurativi specializzati. / This thesis outlines the importance that risk management is getting in the life of organizations. Stakeholders, ranging from employees to investors, must understand how to quantify the tradeoffs of risk against the potential return, because the failure to identify and manage the essential nature of risk can have consequences on the possibility for an organization to achieve its objectives. After introducing the concept of risk, it is analyzed the Enterprise Risk Management (ERM) approach and the benefits for companies that decide to adopt it. In particular there is a focus on its importance in some circumstances in the life of an organization and it is shown how evaluation of risk profile and responses can be critical in mergers and acquisitions, public offer of securities and other corporate finance decisions. Due diligence process and, in particular, risk management and insurance due diligence is described as an effective instrument to understand to what risks a company is exposed to and how it manages them. In conclusion, some transaction solutions (i.e. representations & warranties insurance, public offering of securities insurance, environmental solutions) - that can be used to mitigate the company risk profile, transferring some risks to specialized insurance markets - are illustrated.

本研究之目的在於探討國內公司推動企業風險管理（enterprise risk management, ERM）的情形，以及其對內部稽核職能產生的影響。本研究利用問卷分別調查：（1）國內企業目前推動風險管理機制的情形，（2）影響國內企業推動風險管理機制的重要因素，（3）內部稽核人員在企業風險管理過程扮演何種角色，以及（4）內部稽核人員在企業風險管理過程實際扮演之角色與其認知之差異。 本研究結果顯示，國內企業正處於推行ERM之起步階段，專責風險主管之設置仍較不足，惟內部稽核職能已逐漸轉變為以風險為導向，有助於其服務機構推動ERM。至於影響國內推行ERM之重要因素則分別為：中高階主管的支持、獨立董事之比例、CEO與CFO要求內部稽核職能參與風險管理之程度，以及企業與是否設置風險長。此外，規模較大以及由四大事務所查核簽證之公司，其ERM之推動程度較高。而我國內部稽核人員在ERM過程所扮演的角色，與國際內部稽核協會（IIA）所發布之立場聲明書之建議並不一致，其主要差異在於內部稽核在ERM過程不應扮演的角色，以及其在防護措施之下可以扮演的角色。導致此種差異的可能原因可能是國內正值ERM推動的起步階段，內部稽核職能被要求扮演著較重的角色。不過，內部稽核人員的定位應該要更清楚的劃分，才足以維持內部稽核職能的獨立性與客觀性。 / The purpose of this study is to investigate the current status of enterprise risk management (ERM) in Taiwan public-listed firms and its impact on the internal audit function. We use a research questionnaire to explore the following issues: (1) the current status of ERM in the sample Taiwan public firms, (2) the key factors affecting the implementation of ERM, (3) the role that an internal audit function plays in the ERM process, and (4) the potential gaps between internal auditors’ perceptions of their roles in the ERM process and what they are actually playing in such a process. Our results show that the public companies in Taiwan are, in general, still at the early stage of ERM implementation. They are still lack of managing positions in charge of corporate risk management. Internal audit engagements, however, are becoming more risk-oriented. This development is helpful in promoting ERM. Among the key factors affecting ERM are: (1) the support from management, (2) the ratio of independent directors in the board, (3) the degree of participation by internal auditors in the ERM process that CEO and CFO demand, and (4) the presence of a chief risk officer in the enterprise. Moreover, larger firms and those audited by the top four CPA firms are more advanced in implementing ERM. Our results also indicate that, during the ERM process, the roles played by internal auditors in Taiwan are not consistent with those specified in the ERM position paper issued by the Institute of Internal Auditors (IIA). The main differences are in the areas of “roles the internal auditor should not play” and “the roles played under protective measures”. This may be due to the fact that ERM in Taiwan is still at its early stage and internal auditors are, therefore, asked to take more responsibilities in a firm’s ERM process. In order to maintain their independence and objectivity, however, internal auditors should follow the IIA’s professional standards and code of ethics and avoid taking the responsibilities of management.

Submitted by SERGIO JORGE RAMOS DE OLIVEIRA (sergiojro@gmail.com) on 2017-06-12T14:40:43Z No. of bitstreams: 1 DISSERTAÇÃO_MEX2015_Sergio J R Oliveira_VFinal_20170519.pdf: 1025930 bytes, checksum: 79b4461458b955d6179b074a9adef8af (MD5) / Approved for entry into archive by Janete de Oliveira Feitosa (janete.feitosa@fgv.br) on 2017-06-12T14:58:29Z (GMT) No. of bitstreams: 1 DISSERTAÇÃO_MEX2015_Sergio J R Oliveira_VFinal_20170519.pdf: 1025930 bytes, checksum: 79b4461458b955d6179b074a9adef8af (MD5) / Made available in DSpace on 2017-06-22T17:13:47Z (GMT). No. of bitstreams: 1 DISSERTAÇÃO_MEX2015_Sergio J R Oliveira_VFinal_20170519.pdf: 1025930 bytes, checksum: 79b4461458b955d6179b074a9adef8af (MD5) Previous issue date: 2016-12-30 / Esta pesquisa trata da gestão de riscos corporativos em organizações públicas e os desafios inerentes à sua implementação. Sabe-se que existem normas, ferramentas e métodos que auxiliam as empresas na implementação e utilização de ferramentas de gestão em geral, e, neste caso em particular, da gestão de riscos. Verifica-se, também, a existência de uma lacuna no que tange a impossibilidade de estabelecimento de um modelo padrão para gerir riscos, pois uma metodologia única não seria capaz de abarcar as especificidades de cada empresa. Sendo assim, cada organização precisa desenvolver sua própria forma de gerir seus riscos, segundo o seu perfil. Neste sentido, o objetivo desta pesquisa foi identificar de que forma as especificidades das organizações públicas influenciam a implementação da gestão de riscos em seu âmbito. Com base na literatura sobre gestão de riscos e administração pública, buscou-se o arcabouço teórico dos aspectos considerados fundamentais para a estruturação de uma área e trabalho de riscos e para entender as diferenças entre a administração pública e a privada que impactam na implementação da gestão de riscos naquelas organizações, identificando as limitações e barreiras para tanto, de forma a subsidiar a elaboração de um roteiro de entrevistas semiestruturado. A partir disso, foi efetuada uma pesquisa de campo constituída por quatorze entrevistas com servidores da SUSEP, com larga experiência na administração pública e em implementação de ferramentas de gestão e com conhecimento sobre gestão de riscos. Como resultado da análise, a falta de engajamento e motivação dos servidores, causada por problemas relacionados com a descontinuidade na gestão, da falta de mecanismos de recompensa e reconhecimento, da sua própria estabilidade, pelas pessoas não perceberem os ganhos que podem obter com a gestão de riscos, tais especificidades da administração pública surgem como potenciais fatores inibidores para a implementação da gestão de riscos nas organizações públicas, ao passo que os principais desafios para o seu uso seriam garantir o engajamento e compromisso dos envolvidos com o processo e ter sensibilidade com a cultura organizacional lidando com fatores políticos e a rotatividade. Portanto, conclui-se que as citadas especificidades podem comprometer a implementação efetiva da Gestão de Riscos nas organizações públicas. / This is a research about enterprise risk management in public organizations and the challenges inherent in its implementation. There are rules, tools and methods that assist companies in implementation and the use of management tools in general, and in this particular case, risk management. It turns out that there is a gap regarding the impossibility of establishing a standard model to manage risk, because a single methodology would not be able to deal with the specificities of each company. Consequently, each organization needs to develop its own way of managing their risks, according to its profile. Accordingly, the main objective of this study was to identify how the specific characteristics of public organizations influences the implementation of risk management in its scope. Based on literature of risk management and public administration was sought the theoretical framework of the key issues considered for structuring a risk area and to understand the diferences between the public and private administrations and the impact of that difference both in implementation of risk management for these organizations, identifying the limitations and barriers in order to support the development of a set of semi-structured interviews. From this point, a field survey was done by interviewing fourteen SUSEP’s employees with highly experienced in public administration and implementation of management tools and knowledge about risk management. As a result of this analysis, lack of server engagement and motivation caused by problems related to the discontinuity in management, lack of recognition and reward mechanisms, of their own stability, the people do not realized the gains that they can get through risk management, such specificities of public administration appear as potential inhibitors for the implementation of risk management in public organizations whereas the main challenges for its use would be to ensure the engagement and commitment from all the people envolved with the process and to have sensibility with the organization culture dealing with political factors and turnovers. Therefore, it was concluded that the specifics mentioned above may jeopardize the effective implementation of risk management in public organizations.

Made available in DSpace on 2010-04-20T20:15:40Z (GMT). No. of bitstreams: 1 61070100635.pdf: 2366060 bytes, checksum: d5bd0a70e1e42e1d98128605b6668c12 (MD5) Previous issue date: 2009-03-04T00:00:00Z / Vulnerabilidades afetam as organizações e outros sistemas desenvolvidos pela humanidade na medida em cresce a complexidade. A otimização das cadeias de suprimentos, a maior interdependência das empresas e a formação de redes globais de suprimentos tornaram as empresas mais expostas a diferentes tipos de incertezas e, conseqüentemente, a maiores riscos. Escândalos financeiros mostraram que as organizações muitas vezes desconhecem seus próprios riscos e que seus sistemas de controle tornaram-se ineficazes. Em resposta a esta realidade, várias empresas começaram a estruturar sistemas de gestão de riscos, denominados Enterprise Risk Management (ERM). Faltam, entretanto, exemplos na literatura sobre como as empresas têm implementado estes sistemas e quais resultados estes sistemas tem sido capazes de entregar. Neste sentido, o presente estudo buscou avaliar o processo de implantação de sistemas de gestão de risco de empresas consideradas de classe mundial, avaliando fatores que dificultaram e facilitaram sua implantação, assim como os resultados percebidos tanto no desempenho quanto em aspectos culturais. A análise dos casos permite constatar que mesmo sendo reconhecidas por terem sistemas de gestão avançados as empresas estudadas ainda estão em fase inicial de implantação e que os resultados alcançados com a gestão estruturada de risco ainda não são evidenciados por meio de indicadores de desempenho, levantando-se a hipótese de se tratar de uma iniciativa direcionada mais para a legitimação das organizações do que para melhoria dos seus resultados. Adicionalmente é proposto um modelo associando os benefícios da gestão de riscos com o nível de transformação organizacional

Enterprise risk management (ERM) has emerged as a distinct model for managing a sophisticated portfolio of corporate risks. The purpose of this study was to determine the impact of ERM on firm value for companies on the Johannesburg Securities Exchange. The sample comprised forty-five firms from different industries over the period 2000-2016. Most studies used five or ten-year periods, using data derived from only one industry. Tobin’s Q was used as a proxy for firm value. Multivariate regression analysis was employed to determine statistical relationships. The findings indicate a significant correlation between ERM and Tobin’s Q, indicating that ERM significantly contributes to firm value. These findings may be used to develop and shape ERM policy frameworks for firms and countries. The study provides new insights, from an African emerging market context on the value effects of ERM. Larger and international samples may improve future studies. / Business Management / M. Com. (Business Management)

The occurence of procurement fraud requires from the management of the enterprise, the risk manager of the enterprise as well as the internal auditor to effectively address procurement fraud risks within the enterprise risk management concept. The purpose of the study is to set a procurement fraud risk management process in place which will serve as a comprehensive framework for the enterprise risk manager as well as the internal auditor to limit the enterprise's exposure to procurement fraud risks as far as possible. The study firstly focus on the analysis of the steps within the procurement process which is the starting point for the identification of the fraud risks. Secondly the enterprise risk management model is applied in the format of a procurement risk matrix within the procurement function. The study is an indication that procurement fraud cannot be completely prevented but that the appearance thereof can be limited by means of the extensive procurement fraud risk management model. Recommendations for future studies include the application of the enterprise risk management model in other functional areas within the enterprise. / Die voorkoms van aankoopbedrog vereis van die onderneming se bestuur, ondernemingsrisikobestuurder en interne ouditeur om aankoopbedrogrisiko's effektief binne die konteks van die ondernemingsrisikobestuurskonsep aan te spreek. Die doel van die studie is om `n aankoopbedrogrisikobestuursproses daar te stel wat as `n omvattende raamwerk vir die ondernemingsrisikobestuurder en interne ouditeur kan dien om die onderneming se blootstelling aan aankoopbedrogrisiko's so ver as moontlik te beperk. Die studie fokus eerstens op die ontleding van die stappe in die aankoopproses wat as vertrekpunt vir die identifisering van bedrogrisiko's dien. Tweedens word die ondernemingsrisikobestuursmodel in die vorm van `n aankoopbedrogrisikomatriks in die aankoopfunksie toegepas. Die studie dui daarop dat alhoewel aankoopbedrog nie volkome verhoed kan word nie, die voorkoms daarvan wel beperk kan word deur die toepassing van `n omvattende aankoopbedrogrisikobestuursmodel. Aanbevelings vir verdere studies sluit die toepassing van die ondernemingsrisikobestuursmodel op ander funksionele terreine van die onderneming in. / Auditing / M. Com. (Auditing)

A gestão de riscos corporativos (ERM) tem assumido um importante papel no campo da administração de empresas, sendo apontada como fundamental no sentido de potencializar a probabilidade de realização dos objetivos estratégicos. Concomitantemente, a inovação tem se tornado um imperativo para o alcance de vantagens competitivas em um ambiente cada vez mais dinâmico e inter-relacionado. No entanto, ao mesmo tempo em que as empresas devem inovar para se manterem perenes, o resultado em inovação pode ser influenciado pelos diversos fatores de riscos presentes no ambiente de negócios. Neste sentido, o estudo tem como objetivo verificar qual a influência das práticas de gestão de riscos corporativos no desempenho em inovação, tendo como foco empresas brasileiras de grande porte. A pesquisa, de cunho descritivo, possui caráter quantitativo e foi desenvolvida a partir da aplicação da técnica de Modelagem de Equações Estruturais, baseada no método de mínimos quadrados parciais (PLS). Os resultados apontam para uma relação positiva e significativa entre as práticas de ERM e o desempenho em inovação das empresas, sendo o ambiente interno propício e o apetite a risco das organizações variáveis relevantes para esta relação. / The Enterprise Risk Management (ERM) has gained importance in the context of business administration, as a fundamental process in order to maximize the probability of achieving the strategic objectives. Concomitantly, innovation has become an imperative for achieving competitive advantage, in view of an increasingly dynamic and interrelated environment. However, while companies must innovate to survive, innovation can also be influenced by risks present in the business environment. Considering this frame, this study aims to understand the influence of enterprise risk management\'s practices on innovation performance, focusing on Brazilian large companies. The quantitative research, which presents descriptive nature, was developed using structural equation modeling technique, based on the method of partial least squares (PLS). The results point to a positive and significant relationship between ERM practices and innovative performance. In addition, the variables internal environment and risk appetite are relevant and statistically significant for this association.

Esta pesquisa trata da gestão de riscos corporativos em empresas do setor não financeiro. Sabe-se que existem normas, ferramentas e métodos que auxiliam as empresas na gestão de seus riscos, entretanto verifica-se que há uma lacuna no que tange a impossibilidade de estabelecimento de um modelo padrão para gerir riscos, pois, uma metodologia única não seria capaz de abarcar as especificidades de cada empresa. Sendo assim, cada organização precisa desenvolver sua própria forma de gerir seus riscos, segundo o seu perfil, porte, setor e recursos disponíveis. Nesse sentido, o objetivo deste estudo é analisar o processo de gestão de riscos corporativos em empresas do setor não financeiro, buscando identificar quais são os aspectos fundamentais considerados para estruturação de uma área de riscos; descrever os elementos da análise do ambiente (interno e externo) no qual a empresa está inserida; e verificar quais são os principais agentes processos, metodologias, normas e ferramentas adotadas para gerir os riscos nessas empresas. Para tanto, este estudo foi desenvolvido a partir de uma pesquisa qualitativa e descritiva, baseada em estudo de casos múltiplos, que permitiu um aprofundamento na realidade organizacional das unidades de análise escolhidas com a finalidade de compreender como elas estruturam seu processo de gestão de riscos corporativos. Os resultados decorrentes da análise realizada nos mostram que as empresas estudadas demonstram um alinhamento com os principais direcionamentos apontados pela literatura para gerir riscos, divergindo apenas com relação a pontos particulares decorrentes de especificidades suas realidades organizacionais / This is a research about enterprise risk management in non-financial sector companies. There are rules, tools and methods that assist companies in managing their risks, however it turns out that there is a gap regarding the impossibility of establishing a standard model to manage risk, because a single methodology would not be able to deal with the specificities of each company. Consequently, each organization needs to develop its own way of managing their risks, according to his profile, size, industry and available resources. Accordingly, the main objective of this study is to analyze the process of enterprise risk management in non-financial sector companies in order to identify what are the key issues considered for structuring a risk area; describe the analysis of the environmental (internal and external) in which the company operates; and see which are the main agents, processes, methodologies, standards and tools used to manage risks in these companies. In order to achieve that, this study was developed from a qualitative and descriptive research, based on multiple case study, permitting a deep analysis of the organizational reality of the companies chosen; in order to understand how they structure their enterprise risk management process. The results show that in the studied companies demonstrate alignment with the main directions indicated in the literature to manage risks, differing only about particular issues arising from their specific organizational realities.

壽險業作為經營風險的特許行業，承擔著穩定社會、資金的聚集和供給，以及促進經濟成長等重要功能。近年來由於低利率、匯率變動及國內外經濟環境日益惡化，保險業的本業利潤逐年降低，壽險業的經營面臨重大的挑戰。 保險公司倒閉在國外並不是新鮮事，根據統計，1978～1994年，不到20年間，全球共有648家保險公司破產。導致保險公司破產的原因很多，其中美國在2000～2001年破產的公司大部份是準備金不足；日本保險公司的破產原因則多為投資損失。此外，一些無法意料的天災及人禍之理賠，例如美國911恐怖事件以及卡翠那風災，使得各國保險公司對於企業風險管理更加重視。標準普爾信用評等公司於2006年起，正式將企業風險管理（ERM）制度列入保險業的信用評等項目，更加速保險公司執行企業風險管理的速度。目前國內保險業風險管理制度之實施，則仍屬於起步階段。 保險業屬於高度競爭及高度監理之行業，因此，如何在保持領先的競爭地位及提供優質的客戶服務的同時，亦能恪遵法令、落實內部控制制度及企業風險管理制度，進而創造出屬於自身的藍海策略，以期追求穩定持續成長的獲利，實為壽險業者必須重視的議題。 本研究探討目前保險業所面臨的風險及挑戰，分析金管會對保險公司重大裁罰之種類，並描述及探討個案公司實施內部控制、沙賓法案及企業風險管理制度之狀況與歷程，以及其可能遇到的瓶頸與障礙。本研究結果對於國內保險業實施內部控制、沙賓法案及企業風險管理的過程，可提供助益。 / Life insurance industry conducts business that requires approval from its regulatory authority. The industry provides an array of functions, such as managing risks, maintaining social stability, pooling and supplying funds, etc. In recent years, life insurance industry has faced with serious challenges due to its decreasing operating profit margin caused by low interest rates, volatility of foreign exchange rates, and deteriorating economic environment around the globe. The bankruptcy among insurance companies is nothing new over the world. There were as many as 648 companies going bankrupt during 1978 to 1994. The causes of the aforementioned bankruptcy were many. For example, Japan companies became insolvent mostly due to investment losses; those in the U.S. were caused by insufficient reserves. Huge insurance claims for unpredictable natural or man-made disasters, such as 9/11 terrorist attack, hurricane Katrina, and the subprime mortgage crisis in the U.S., have attracted most companies’ attention worldwide to “enterprise risk management (ERM)”. Hence, Standard & Poor’s started in 2006 to apply the ERM analysis to its credit rating for the insurance industry, and this measure propels insurance companies into the implementation of ERM. Nonetheless, Taiwanese insurance companies are just at the inception of ERM. Insurance industry must comply with stringent regulations while confronting keen competition. An insurance company must take a lead in competition, provide quality services to its customers, abide by regulations, and implement internal controls and ERM in an integrated fashion. In doing so, an insurance company can develop its own blue ocean strategy and maintain sustainable growth and profit. This research probes into the risks and challenges faced by Taiwan insurance industry in dealing with various risks and challenges, including the serious sanctions by the Financial Supervisory Commission. We present a case study of local life insurance company with respect to its process of integrating internal control systems, compliance to Sarbanes-Oxley Act and implementation of ERM. A number of deficiencies, bottlenecks and obstacles were identified and analyzed, followed by related suggestions. Our results provide insights and helpful suggestions to the integration of internal controls, Sarbanes-Oxley compliance, and ERM for Taiwan insurance industry.