Compliance programs have grown since the early 1990s and evolved more formally into corporate institutional or enterprise-wide programs with the passage of the Sarbanes-Oxley Act of 2002. Formal institutional compliance programs are emerging in colleges and universities to assist in the management of the myriad of regulations and requirements placed on them by accrediting bodies, creditors, boards, donors, grantors, and federal and state regulators. An effective compliance program provides the structure for the institution and its employees to conduct operations ethically, with integrity, and in compliance with legal and regulatory requirements. The goals of this study were to identify organizational structures that assist large, public universities in effectively managing institutional compliance, the elements that shape these structures, and the benefits and limitations of those structures.

Os riscos fazem parte do cotidiano das empresas. Eles variam conforme sua natureza, a chance de ocorrer e o impacto que pode ocasionar às organizações. Por diversas razões, as empresas de pequeno e médio portes estão mais suscetíveis à imprevisibilidade e aos efeitos negativos dos riscos. Desse modo, é essencial que criem processos capazes de gerenciar os riscos de modo contínuo e sistêmico. Entretanto, o que se pode constatar é que ainda são raros os casos de empresas desses portes que possuam esses mecanismos de gestão. Essas empresas são fundamentais para o sistema econômico nacional, tanto pela geração de empregos quanto pelo crescimento do PIB e desenvolvimento do país. Na revisão bibliográfica desta pesquisa, o autor busca expor os principais conceitos existentes para o termo \"risco\" que, apesar de ser objeto de estudo há muito tempo, ainda possui definições bastante distintas; busca também apresentar aspectos importantes sobre o Gerenciamento de Riscos Corporativos e detalhar os dois principais modelos usados no mundo: COSO e ISO 31000, além de apresentar um modelo de identificação de riscos que abrange toda cadeia de valor das empresas. Como objetivos, identificar e avaliar quais são os principais riscos envolvidos na gestão de uma pequena empresa nacional do setor de TI, além de propor uma estratégia de tratamento para eles. A metodologia escolhida foi a pesquisa ação, na qual o pesquisador possui uma postura direta e ativa sobre a pesquisa e sobre a problemática. A pesquisa foi realizada sob uma abordagem qualitativa de caráter exploratório. Após identificação, avaliação e proposição de uma estratégia para tratamento dos riscos, conclui-se que é possível a implementação de um processo de Gerenciamento de Riscos Corporativos em uma empresa de pequeno porte e esse processo pode criar condições favoráveis para sobrevivência e crescimento das organizações. Muitos riscos descritos na literatura, que afetam negativamente as pequenas e médias empresas em vários países do globo, foram identificados na empresa analisada, enfatizando a necessidade de gestão dos riscos de um modo sistêmico, abrangente e contínuo. São poucas as pesquisas sobre este tema, na literatura nacional e, portanto, são fundamentais os estudos que possam contribuir para melhor entendimento deste universo. / Risks are part of everyday business. They vary according to their nature, the chance to occur and the impact they can have on organizations. For various reasons, small and medium-sized enterprises are more susceptible to unpredictability and the negative effects of risks. In this way, it is essential that they create processes capable of managing risks in a continuous and systemic way. However, what can be seen is that there are still rare cases of companies of these sizes that have these management mechanisms. These companies are fundamental to the national economic system, both for the generation of jobs and for the GDP growth and development of the country. In the bibliographic review of this research, the author seeks to expose the main concepts existing for the term \"risk\" that, despite being object of study for a long time, still has quite different definitions; he also seeks to present important aspects of Enterprise Risk Management and to detail the two main models used in the world: COSO and ISO 31000, in addition to presenting a model of risk identification that covers the entire value chain of companies. The objectives are to identify and evaluate the main risks involved in the management of a small national IT company, and propose a treatment strategy for them. The methodology chosen was action research, in which the researcher has a direct and active attitude about the research and the problem. The research was carried out under a qualitative approach from an exploratory perspective. After identifying, evaluating and proposing a risk management strategy, it was possible to conclude that it is possible to implement an Enterprise Risk Management process in a small company, and this process can create favorable conditions for the survival and growth of the organization. Many risks described in the literature, which negatively affect small and medium enterprises in several countries of the globe, were identified in the analyzed company, emphasizing the need for risk management in a systemic, comprehensive and continuous way. There are few researches on this topic, in the national literature and, therefore, are fundamental studies that can contribute to a better understanding of this universe.

<p>Intern kontroll handlar om att ha verksamhetens riskområden under kontroll. Brister i intern kontroll kan leda till ett ineffektivt arbete och riskera att utsätta verksamheten och därmed dess aktieägare för risk. När Svensk Kod för Bolagsstyrning (Koden) infördes i juli 2005 var syftet delvis att ge börsnoterade bolag ett ramverk för hur de ska arbeta med och redovisa sitt arbete med dessa frågor som ett led i att åstadkomma god bolagsstyrning.</p><p>Uppsatsen undersöker huruvida Koden har förändrat svenska börsnoterade bolags arbete med intern kontroll samt den betydelse förändringen, ur ett investeringsperspektiv, har för aktieägarna.</p><p>Agentteorin utgör en grundläggande del av uppsatsens teoretiska ram genom att beskriva relationerna mellan och drivkrafterna bakom de studerade aktörerna, aktieägarna och styrelsen. En täckande schematisk modell av agentteorin saknas i befintlig akademisk litteratur. Uppsatsens författare har därför utformat en sådan modell, som presenteras och utgör stommen i uppsatsens analysmodell.</p><p>Nio stycken intervjuer med revisorer och ansvariga för intern kontroll på svenska börsnoterade bolag genomfördes. Vidare utfördes en enkätundersökning bland investerare på svenska fondbolag som ett led i den empiriska datainsamlingen.</p><p>Studien visar att införandet av Koden har lett till en förändring i hur svenska börsnoterade bolag idag arbetar med intern kontroll. Förändringen har varit störst i de små och medelstora bolagen, som inte arbetat med dessa frågor tidigare i samma utsträckning som de stora bolagen. Investerarna, och tillika aktieägarna, är inte medvetna om den förändring som skett avseende bolagens arbete med intern kontroll. Investerarna anser dock att intern kontroll är viktigt vid ett investeringsbeslut, men samtidigt inte en av de tre avgörande faktorerna.</p><p>Bolagen har i och med sitt ökade arbete med intern kontroll mer börjat identifiera de långsiktiga överlevnadsriskerna. Utfallet av denna förändring i styrelsens arbete har möjligen ännu inte kommit aktieägarna till godo något som kan förklara varför de inte ser intern kontroll som ett avgörande investeringskriterium.</p>

Intern kontroll handlar om att ha verksamhetens riskområden under kontroll. Brister i intern kontroll kan leda till ett ineffektivt arbete och riskera att utsätta verksamheten och därmed dess aktieägare för risk. När Svensk Kod för Bolagsstyrning (Koden) infördes i juli 2005 var syftet delvis att ge börsnoterade bolag ett ramverk för hur de ska arbeta med och redovisa sitt arbete med dessa frågor som ett led i att åstadkomma god bolagsstyrning. Uppsatsen undersöker huruvida Koden har förändrat svenska börsnoterade bolags arbete med intern kontroll samt den betydelse förändringen, ur ett investeringsperspektiv, har för aktieägarna. Agentteorin utgör en grundläggande del av uppsatsens teoretiska ram genom att beskriva relationerna mellan och drivkrafterna bakom de studerade aktörerna, aktieägarna och styrelsen. En täckande schematisk modell av agentteorin saknas i befintlig akademisk litteratur. Uppsatsens författare har därför utformat en sådan modell, som presenteras och utgör stommen i uppsatsens analysmodell. Nio stycken intervjuer med revisorer och ansvariga för intern kontroll på svenska börsnoterade bolag genomfördes. Vidare utfördes en enkätundersökning bland investerare på svenska fondbolag som ett led i den empiriska datainsamlingen. Studien visar att införandet av Koden har lett till en förändring i hur svenska börsnoterade bolag idag arbetar med intern kontroll. Förändringen har varit störst i de små och medelstora bolagen, som inte arbetat med dessa frågor tidigare i samma utsträckning som de stora bolagen. Investerarna, och tillika aktieägarna, är inte medvetna om den förändring som skett avseende bolagens arbete med intern kontroll. Investerarna anser dock att intern kontroll är viktigt vid ett investeringsbeslut, men samtidigt inte en av de tre avgörande faktorerna. Bolagen har i och med sitt ökade arbete med intern kontroll mer börjat identifiera de långsiktiga överlevnadsriskerna. Utfallet av denna förändring i styrelsens arbete har möjligen ännu inte kommit aktieägarna till godo något som kan förklara varför de inte ser intern kontroll som ett avgörande investeringskriterium.

An in-depth analysis of organizational risk management in health care, and in particular the concepts of Enterprise Risk Management (ERM), has identified a five part model that can be used by Canadian health care leaders as an evidence supported approach to successful organizational risk management. The Model for Organizational Risk Management has been developed as a basis for linking the components of an ERM framework into a Canadian health organization in order to overcome the barriers that commonly disrupt strategic risk management. The Model addresses how an ERM framework can fit within an existing health organization by building off of and enhancing existing processes and resources in order to ensure familiarity, acceptance, and sustainability of the risk management program. By approaching the Model in a stepwise fashion (based on individual organizational context) health care leaders are provided with a roadmap from which to advance their own organizational risk management program.

An in-depth analysis of organizational risk management in health care, and in particular the concepts of Enterprise Risk Management (ERM), has identified a five part model that can be used by Canadian health care leaders as an evidence supported approach to successful organizational risk management. The Model for Organizational Risk Management has been developed as a basis for linking the components of an ERM framework into a Canadian health organization in order to overcome the barriers that commonly disrupt strategic risk management. The Model addresses how an ERM framework can fit within an existing health organization by building off of and enhancing existing processes and resources in order to ensure familiarity, acceptance, and sustainability of the risk management program. By approaching the Model in a stepwise fashion (based on individual organizational context) health care leaders are provided with a roadmap from which to advance their own organizational risk management program.

Os riscos fazem parte do cotidiano das empresas. Eles variam conforme sua natureza, a chance de ocorrer e o impacto que pode ocasionar às organizações. Por diversas razões, as empresas de pequeno e médio portes estão mais suscetíveis à imprevisibilidade e aos efeitos negativos dos riscos. Desse modo, é essencial que criem processos capazes de gerenciar os riscos de modo contínuo e sistêmico. Entretanto, o que se pode constatar é que ainda são raros os casos de empresas desses portes que possuam esses mecanismos de gestão. Essas empresas são fundamentais para o sistema econômico nacional, tanto pela geração de empregos quanto pelo crescimento do PIB e desenvolvimento do país. Na revisão bibliográfica desta pesquisa, o autor busca expor os principais conceitos existentes para o termo \"risco\" que, apesar de ser objeto de estudo há muito tempo, ainda possui definições bastante distintas; busca também apresentar aspectos importantes sobre o Gerenciamento de Riscos Corporativos e detalhar os dois principais modelos usados no mundo: COSO e ISO 31000, além de apresentar um modelo de identificação de riscos que abrange toda cadeia de valor das empresas. Como objetivos, identificar e avaliar quais são os principais riscos envolvidos na gestão de uma pequena empresa nacional do setor de TI, além de propor uma estratégia de tratamento para eles. A metodologia escolhida foi a pesquisa ação, na qual o pesquisador possui uma postura direta e ativa sobre a pesquisa e sobre a problemática. A pesquisa foi realizada sob uma abordagem qualitativa de caráter exploratório. Após identificação, avaliação e proposição de uma estratégia para tratamento dos riscos, conclui-se que é possível a implementação de um processo de Gerenciamento de Riscos Corporativos em uma empresa de pequeno porte e esse processo pode criar condições favoráveis para sobrevivência e crescimento das organizações. Muitos riscos descritos na literatura, que afetam negativamente as pequenas e médias empresas em vários países do globo, foram identificados na empresa analisada, enfatizando a necessidade de gestão dos riscos de um modo sistêmico, abrangente e contínuo. São poucas as pesquisas sobre este tema, na literatura nacional e, portanto, são fundamentais os estudos que possam contribuir para melhor entendimento deste universo. / Risks are part of everyday business. They vary according to their nature, the chance to occur and the impact they can have on organizations. For various reasons, small and medium-sized enterprises are more susceptible to unpredictability and the negative effects of risks. In this way, it is essential that they create processes capable of managing risks in a continuous and systemic way. However, what can be seen is that there are still rare cases of companies of these sizes that have these management mechanisms. These companies are fundamental to the national economic system, both for the generation of jobs and for the GDP growth and development of the country. In the bibliographic review of this research, the author seeks to expose the main concepts existing for the term \"risk\" that, despite being object of study for a long time, still has quite different definitions; he also seeks to present important aspects of Enterprise Risk Management and to detail the two main models used in the world: COSO and ISO 31000, in addition to presenting a model of risk identification that covers the entire value chain of companies. The objectives are to identify and evaluate the main risks involved in the management of a small national IT company, and propose a treatment strategy for them. The methodology chosen was action research, in which the researcher has a direct and active attitude about the research and the problem. The research was carried out under a qualitative approach from an exploratory perspective. After identifying, evaluating and proposing a risk management strategy, it was possible to conclude that it is possible to implement an Enterprise Risk Management process in a small company, and this process can create favorable conditions for the survival and growth of the organization. Many risks described in the literature, which negatively affect small and medium enterprises in several countries of the globe, were identified in the analyzed company, emphasizing the need for risk management in a systemic, comprehensive and continuous way. There are few researches on this topic, in the national literature and, therefore, are fundamental studies that can contribute to a better understanding of this universe.

Purpose The purpose of the research was firstly, to determine the competencies required of risk managers and secondly, to consider the implications of such competencies in determining possible modules for inclusion in the design of a specialised undergraduate qualification in Risk Management. Methodology A qualitative research approach was followed, involving focus group interview sessions as part of an Interactive Qualitative Analysis (IQA) research study. Focus Group 1 comprised of academics teaching risk management at public universities in South Africa, and Focus Group 2 comprised of risk management practitioners in South Africa. Findings The competencies identified are business management and risk management knowledge; attributes such as assertiveness and courage; values such as ethics and integrity; as well as people, business and technical skills. Research implications The unique contribution of the current research was the innovative use of IQA for data collection, the removal of subjectivity and the rigour in analysing and presenting the results. The results are a starting point or foundation for the design of a specialised undergraduate degree in risk management that will both meet the requirements of the risk management profession and will equip learners with the best possible combination of knowledge, skills, attributes, values and attitudes to effectively manage risk in organisations. The implications for further research are that a study of the design, benchmarking and validation of a curriculum framework for a specialised undergraduate degree in risk management could be conducted. The development of a curriculum framework or curriculum did not form part of the scope of this study. / Okokuqala inhloso yocwaningo, ukuthola amakhono adingekayo kubaphathi bezinhlekelele kanti okwesibili, ukubheka imiphumela yalokho kusebenza ekunqumeni amamojuli angafakwa ekwakhiweni kweziqu ezikhethekile ezingakaphothulwa ngabafundi ku-Risk Management. Kwalandelwa indlela yocwaningo efanelekile, ebandakanya izikhathi zokuxoxisana zamaqembu njengengxenye yocwaningo lwe-Interactive Qualitative Analysis (IQA). I-Focus Group yoku-1 inabafundi abafundisa ukulawulwa kwezinhlekelele emanyuvesi vi kahulumeni aseNingizimu Afrika, kanye neFocus Group yesi-2 inabasebenzi bokulawulwa kobungozi eNingizimu Afrika. Amakhono ahlonziwe ukuphathwa kwebhizinisi nolwazi lokulawulwa kobungozi; anezimpawu ezinjengokuzethemba kanye nokuba nesibindi; ubugugu obufana nokuziphatha nobuqotho; kanye nabantu, amakhono ebhizinisi nezobuchwepheshe. / Die doel van die studie was eerstens om die bekwaamhede waaroor risikobestuurders moet beskik te bepaal, en tweedens, wat die implikasies van sodanige bekwaamhede inhou vir die modules vir insluiting in die ontwerp van ‘n gespesialiseerde voorgraadse kwalifikasie in Risikobestuur. Die studie het ‘n kwalitatiewe navorsingsbenadering gevolg deur gebruik te maak van fokusgroepsessies as deel van ‘n Interaktiewe Kwalitatiewe Ontleding (IKO) navorsingstudie. Fokusgroep 1 het bestaan uit akademici wat risikobestuur by openbare universiteite in Suid-Afrika doseer, en Fokusgroep 2 het uit risikobestuurpraktisyns in Suid-Afrika bestaan. Die bekwaamhede wat identifiseer is, is kennis van ondernemingsbestuur en risikobestuur; eienskappe soos selfgeldendheid en moed; waardes soos etiek en integriteit; asook mense, sake en tegniese vaardighede. / Finance, Risk Management and Banking / M. Com. (Risk Management)

<p>Resilience is studied as a systemic property in several disciplines such as engineering, psychology, systems biology, and ecological sciences. Yet, the system view on resilience is not pervasive in management science. This dissertation is on Enterprise Resilience, which is an emerging topic within the fields of organization and management science. Corporate enterprises are viewed as type 1 complex adaptive systems (CAS) operating within an external business environment. Thus, perturbations occurring in the environment affect enterprises, whose resilience then depends on their adaptive response to them. Therefore, the focus is on system perturbances and on investigating drivers of the enterprises’ adaptive response. As a result, enterprise resilience is more granularly defined as an enterprise’s ability to continually remain valuable to stakeholders by simultaneously managing short-term shocks and long-term stressors. This re-definition brings forth an actionable pathway to enterprise resilience- the pursuit of improved management of the enterprise’s risk and growth management functions.</p><p>Two challenging issues plaguing the risk and growth functions are the lack of a comprehensive understanding of risks (especially of unknowns) and their inter-connections, and a weak link between risk management and the enterprise’s growth strategy intended to continually and increasingly generate value. This work addresses both issues via the development of an enterprise-agnostic comprehensive risk typology, and by building a conceptual link between risk and growth strategy through the business model construct and its use in the study of repeatable patterns of innovation. Therefore, this work develops one pathway toward enterprise resilience i.e., via improved risk management and systematic growth management. Furthermore, it advances knowledge by bridging the theoretical conceptualization of an enterprise as a CAS1 into actionable methods for practice in the form of risk management tools and systematic innovation frameworks that aid the enterprise’s adaptive response.</p><p>The interdisciplinary dissertation develops hypotheses and employs appropriate qualitative and quantitative methods to test them. Overall, a theory building process is undertaken using the constructionist school of thought and using methods based in inductive logic such as the scholarship of integration, thematic analysis, and case studies. Additionally, to achieve wide and comprehensive coverage, data-driven quantitative methods using advanced computing such as data mining, machine learning, and natural language processing are employed.</p>

More than one billion people, almost one in six of the world's population, are now using GSM mobile phones. The situation in South Africa is no different from that in the rest of the world. The rise of mobile telephone usage in South Africa has been driven by a combination of factors such as demand, sector reform, the licensing of new competition, and the emergence of major strategic investors, such as Vodacom and MTN. It was estimated that by March 2005 there should be approximately 20 million cellular customers in South Africa. The growth in the South African cellular market is proportionate to the potential risks in an environment where organisations are continuously seeking ways of improving efficiency, cutting costs, and staying abreast of technological advances. Elements of risk control such as Safety, Health, and Environmental Management can no longer be left out of the equation while organisations in the GSM industry are considering increasing their networks to meet the demands of growth. Although risk assessments are not specifically defined in the Occupational Health and Safety Act (85 of 1993); Section 8 does, however, stipulate under the general duties of the employer that the employer must establish, as far as is reasonably practicable, which hazards to the health or safety of persons are attached to any work which is performed. This situation has changed with the promulgation of the Construction Regulations, GNR.1010 on 18 July 2003; which state that every contractor performing construction work shall, before the commencement of any construction work and during construction work, cause a risk assessment to be performed by a competent person appointed in writing, and that the risk assessment shall form part of the health and safety plan to be applied on the site. This requirement under the Construction Regulations will have a major impact on organisations in the GSM industry. Integrated Health, Safety and Environmental risk assessments have now become a prerequisite before considering any further expansion of the GSM network in South Africa. The relationship between the operational risk sub-disciplines of health, safety, and environmental management, as part of the risk-management function, has been established, and an operational risk-assessment model for the Global Systems Mobile Telecommunications industry in South Africa that measures occupational health, safety, and environmental management risks on an integrated basis has been developed. The risk assessment model for the South African GSM industry is based on assessing the frequency of an activity in relation to the impact on the organisation's business processes, incident/accident potential, financial impact, legal status, and the nature of ecological impact. / Business Management / D. Com. (Business Management)