Organizational Factors in Enterprise Risk Management Effectiveness: A Conceptual Framework

During the last financial crisis there were many companies suffered losses despite their engagement in enterprise risk management (ERM). Most of the literatures on ERM effectiveness give little attention to the elements of human and organizational factors. Therefore, it is important to give a close attention to current ERM practices and measure the effectiveness of ERM frameworks in the context of Malaysia especially by considering one of the elements namely organizational factors. The main objective of this study is to develop a conceptual model that shows relationship between organizational factors and ERM effectiveness. An extensive literature search was employed for this study. This study contributes to enhance the body of knowledge in ERM specially in understanding significant organizational factors that influence ERM effectiveness from Malaysian perspective.


Introduction
Most of the previous studies on effectiveness were focused on the conceptual and theoretical perspectives and limited studies were focused on the empirical perspectives (Lecy, Schmitz, & Swedlund, 2012). Scarce studies on effectiveness were repeated in the area of ERM studies (Liebenberg & Hoyt, 2003). As a result, studies on ERM effectiveness remains underexplored and limited (Salinah, Che Ruhana, & Suria, 2014). Even though most of the previous studies in ERM found that ERM enhance firm's value (Liebenberg & Hoyt, 2003;Darwish, 2015) and improve organizational performance (Ballantyne, 2013;Fan, 2014;Gordon, Loeb, & Tseng, 2009;Tseng, 2007), unfortunately the issues regarding the effectiveness of ERM are still not extensively discussed and explored among researchers (Togok, 2016).
To the best of authors knowledge only a few research has been done on ERM effectiveness (Al-Amri & Davydov, 2016;McBride, 2012;Mensah, 2015;Nair, Rustambekov, McShane, & Fainshmidt, 2014;Salifou, 2015;Togok, 2016). On the other hand, most of the previous studies in measuring the organizational performance classified the factors that influence organizational performance into two main categories namely human factors and organizational factors (Abdullah, Uli, Ismail, & Ahmad, 2007;Habtoor, 2015;Rahman & Bullock, 2005). However, previous studies on ERM effectiveness do not focus on overall human and organizational factors that might impact ERM effectiveness. The researchers only measure a few internal factors within the company to determine level of ERM effectiveness without considering external factors (Zafar, Clark, Ko, & Au, 2011).
While most of the previous literatures focus on characteristics of companies that adopt ERM (Kleffner, Lee, & McGannon, 2003;Liebenberg & Hoyt, 2003) , determinants of ERM adoption (Onder & Ergin, 2012;Paape & Spekle, 2012), and the impacts of ERM on company's performance (Nickmanesh, Zohoori, Musram, & Akbari, 2013;Roslan & Dahan, 2013). Unfortunately, there are little researches that focus on the ERM effectiveness especially from Malaysian perspective (Togok, 2016) and result from previous researches on ERM effectiveness shows that there is inconclusive result on the ability of ERM in managing risk within the organization which requires future studies to support the literatures (McBride, 2012). Therefore, the purpose of this paper is to determine the organizational factors that might impact ERM effectiveness especially from Malaysian perspective.

THE RELATIONSHIP BETWEEN ORGANIZATIONAL FACTORS AND ERM EFFECTIVENESS Top Management Support and ERM Effectiveness:
Top management support is the most popular variable that have been discuss extensively in ERM studies either in the study of ERM adoption or ERM effectiveness. Top management is one of the contingent factors for an effective risk management (Mikes & Kaplan, 2014).
There is a direct relationship between top management support on ERM effectiveness (Togok, 2016), risk management effectiveness (Banasadegh, Riahi, & Davari, 2014;Cooper, Faseruk, & Khan, 2013;Maina, Mbabazize, & Kibachia, 2016;Ngundo, 2014), security risk management (Zafar et al., 2011), and risk management success (Agoi, 2013). There are a few researchers that classified top management support as critical success factors for risk management; (Zafar et al., 2011) discuss the function of executive management support as critical success factor for security risk management effectiveness, (Agoi, 2013) discuss the role of leadership and commitment as critical success factor for risk management, and (Banasadegh et al., 2014) found the function of support and commitment of management as critical success factor for risk management in oil and gas sector in Iran.
An empirical research conducted by (Ngundo, 2014) found that top management support has significant and direct effect on risk management effectiveness in public housing construction project in Kenya. The result was supported by other researchers such as (Sax & Torp, 2015) which found that participative leadership style has significant and direct effect on risk management performance and also supported by (Maina et al., 2016) which found that top management support has significant and direct effect on risk management effectiveness in public housing construction project in Rwanda. In addition, the researchers identified the low level of top management support in risk management process will led to the insufficient allocation of resources and also lack of involvement and ineffective decision making by top management influence risk management effectiveness. In contrast, the relationship between commitment and support from top management and risk management effectiveness among Thai financial institutions has not significant and no direct effect exist, however, the result shows that commitment and support from top management is important to risk management effectiveness (Ranong & Phuenngam, 2009).
Most of the researchers tested the direct effects of top management support on dependent variables (Ngundo, 2014;Ranong & Phuenngam, 2009), however, top management support also have been tested with multiple effect either the direct effect or indirect effect on measured variable (Togok, 2016). A study done by (Togok, 2016) found that tone from the top has significant and direct effect on ERM effectiveness and also found that tone from the top has indirect effect with ERM effectiveness which by organizational culture. In addition, (Ngundo, 2014) also found that was indirect relationship between top management support and risk management effectiveness which is mediate by organizational structure and procedure and systems. As a result, this study proposes to test the direct effect of top management support on ERM effectiveness.

Training Programs and ERM Effectiveness:
A research conducted by (Mwangi, 2012) on the level of effective risk management procedures in Kenya's Airport found that has a significant and direct effects of training and risk management effectiveness and the finding was supported by (Laisasikorn & Rompho, 2014) which found that was a significant and direct relationship between proper training programs on the financial performance of Thai listed companies. In addition, (Makarova, 2014) conducted study on the effectiveness of risk management implementation in Russian companies and found that was a significant relationship between training and risk management effectiveness. On the other hand, (Ranong & Phuenngam, 2009) found that the relationship between training and risk management effectiveness in Thailand financial institution was not significant, however the result conclude training is important in order to improve risk management effectiveness.
Most of the researchers tested the direct effects of training on dependent variables (Mwangi, 2012;Ranong & Phuenngam, 2009), however, training also have been tested with multiple effect either the direct effect or indirect effect on measured variable (Laisasikorn & Rompho, 2014). A study conducted by (Laisasikorn & Rompho, 2014) found that was indirect relationship between proper training programs on financial performance which is mediate by performance measurement systems. A few researchers have categorized training as critical success factor for risk management (Agoi, 2013;Banasadegh et al., 2014;Zafar et al., 2011). A study conducted by (Zafar et al., 2011) found that was a direct relationship between human resource development and security risk management effectiveness and also studies by (Agoi, 2013;Banasadegh et al., 2014) found that was a relationship between training and risk management.
In addition, studies on performance of organization found that was a significant direct relationship between people management on operational performance (Samson & Terziovski, 1999) and also found that was a significant direct relationship between training and financial performance of the organization among Turkish SMEs (Demirbag, Tatoglu, Tekinkus, & Zaim, 2006). Moreover, (Abdullah, Ahmad, & Ismail, 2008) found that was a significant and direct effect of training and education on performance of quality improvement among electrical and electronic firms in Malaysia. Therefore, this study proposes to test the direct effect of training programs on ERM effectiveness.

Reward and Recognition and ERM Effectiveness:
There is no research conduct in the area of ERM studies to test the impact of reward and recognition on ERM effectiveness. Alternatively, by applying the Turnbull approach, (Carey, 2011) suggest the importance of renumeration issues on risk management. The researcher stresses out the importance of renumeration policy in an organization such as bonuses payment to employees because the policy will influence the behaviour of the employees. Therefore, it is very important to give attention to reward and recognition policies in an organization because it will influence the performance of employees and then affect to the risk management performance.
A study done by (Yaraghi & Langhe, 2011) categorized reward and recognition system as critical success factors for risk management systems and found that was a significant relationship between reward and recognition systems and performance of risk management systems. The earlier finding by (Yaraghi & Langhe, 2011) then supported by (Gibson, 2012) which found that was a significant relationship between adequate compensation and incentives on risk management implementation among South African financial services organizations.
In addition, (Abdullah et al., 2007) found that was a significant and direct effect between reward and recognition on organizational performance of Malaysia's electrical and electronic sector and then supported by (Abdullah et al., 2008) which found that was a significant and direct relationship between reward and recognition and quality improvement among electrical and electronic firms in Malaysia. Therefore, this study proposes to test the direct effect of reward and recognition on ERM effectiveness.

Application of ERM Software and ERM Effectiveness:
There were a few researchers that consider information system and technology as the critical success factors for risk management effectiveness (Agoi, 2013;Banasadegh et al., 2014;Ranong & Phuenngam, 2009;Togok, 2016). A study conducted by (Gibson, 2012) conclude that data availability, migration, consolidation and cleaning data model as the important factors that contribute to the risk management effectiveness among South African financial services organization. In addition, (Agoi, 2013) identified technology as the critical success factors for risk management implementation and the finding was supported by (Banasadegh et al., 2014) which was recommended that information technology was the critical success factors for risk management, unfortunately the result was not significant.
A study by (Ngundo, 2014) found that was a significant relationship between procedures and systems and risk management effectiveness among public housing project in Kenya. In addition, (Togok, 2016) found there was a direct relationship between enterprise system and ERM effectiveness and also indirect relationship where the relationship is mediate by tone from the top. However, a studies by (Jalal, AlBayati, & AlBuainain, 2011) found the information system does not significantly influence the ERM effectiveness and the finding was supported by (Ranong & Phuenngam, 2009) which found that the relationship between information technology and risk management effectiveness was not significant. Importantly, (Togok, 2016) used the application of ERM software as one of the measurement to measure the effect of enterprise systems on ERM effectiveness. Therefore, this study proposes to test the direct effect of application of ERM software on ERM effectiveness Organizational Structure and ERM Effectiveness: Most of the previous research on the impact of organizational structure was conduct on the risk management effectiveness (Carey, 2011;Ngundo, 2014;Ranong & Phuenngam, 2009), risk management success (Agoi, 2013) and financial performance (Laisasikorn & Rompho, 2014); with limited research carried out on ERM effectiveness (Togok, 2016). Study completed by (Togok, 2016) found that there was no significant relationship between structure of the organization and ERM effectiveness among Malaysian public listed companies. The finding also supported by other literature which found that the relationship between organizational structure and risk management effectiveness was not significant among financial institutions in Thailand (Ranong & Phuenngam, 2009).
There were researchers that listed organizational structure as the critical success factors for risk management in the organization (Agoi, 2013;Banasadegh et al., 2014;Carey, 2011;Yaraghi & Langhe, 2011). A study by (Carey, 2011) suggest the importance of organizational structure on risk management effectiveness in financial institutions and supported by (Yaraghi & Langhe, 2011) which found that organizational structure is the critical success factor for risk management system. The finding then supported by (Agoi, 2013) which found organizational structure as critical success factor for risk management procedure at Kenya airport and followed by (Banasadegh et al., 2014) which found organizational structure as critical success factor for risk management in oil and gas sector in Iran. This argument can be conclude that organizational structure is very important variables that influence risk management effectiveness and have been prove by the previous literature. Therefore, this study proposes to test the direct effect of organizational structure on ERM effectiveness.

Risk Management Policy and ERM Effectiveness:
There are limited researchers that focus on the existence of risk management policy and their impact on risk management effectiveness. According to (Gibson, 2012), the organization should have well-defined and documented operational risk management policies, processes and procedures as the critical success factor for risk management implementation. Unfortunately, (Paape & Spekle, 2012) found that was no relationship between application of COSO framework and ERM effectiveness. In the context of management, welldocumented policy is very important to be guidance for the member of the organization. A study conducted by (Rahman & Bullock, 2005) found that just-in-time principle was very important to the member of organization as a guideline to be follow in order to improve the organizational performance. In addition, the researchers also found that the proper policy and tools will strengthen the relationship between organizational strategy, team member commitment, personnel training and team member involvement with the organizational performance. Therefore, (Khan, Hussain, & Mehmood, 2016) supported the previous literature on the significant relationship between quality tool and organizational performance. Additionally, quality tools and techniques also mediate the relationship between leadership and continuous improvement. Therefore, this study proposes to test the direct effect of risk management policy on ERM effectiveness

Proposed Conceptual Framework
In line with the previous literature discussed, figure 1 shows the proposed conceptual framework for this paper. The dependent variable for this study is ERM effectiveness which is measured the level of ERM effectiveness among the companies that implement ERM. In addition, six organizational factors namely top management support, training programs, reward and recognition, application of ERM software, organizational structure, and risk management policy were group as independent variables. This paper proposed the conceptual framework to test the significant influence of organizational factors toward level of ERM effectiveness.

Conclusion
This study proposed a conceptual framework to investigate the relationship between organizational factors and ERM effectiveness. All the organizational factors namely top management support, training programs, reward and recognition, application of ERM software, organizational structure, and risk management policy expected to have significant and direct effects on ERM effectiveness. This study is very important to determine the organizational factors that might influence ERM effectiveness especially among companies in Malaysia.