risk. Plus, Company B and C indicated that active application of policies, procedures, and controls helped to streamline their company’s business operations.
This shows that compliance is a form of risk management. Effective compliance
plan helped Company B and C to address the compliance issues related to health and
environmental protection. Meanwhile, Company C was required to meet the sustainability standards and certifications by international regulatory bodies to demonstrate sustainable performance and to ensure the products consumed by customers
are from sustainable sources. In fact, Company C, which had issued their first
sustainability report, used the standards in the Global Retirement Index (GRI)
framework for its sustainability reporting.
In order to address the new challenges of the changing risks, the interviewee from
Company C advocated that the leadership role should ideally be underpinned by a
strong risk culture promoted across the enterprise. The company is more concerned
in promoting a good risk culture; however, unethical behaviour from senior management had dropped down the share value. The company further revealed that the
appointment of board of directors among individuals that have political interest in
the organisation led to exploitation of power and responsibility. This implies that the
presence of politician in the board of directors appeared to have negative effects on
the risk culture because the company’s ownership and controls are transferred to
individuals with multiple interests. Supposedly, the boards are responsible for
cultivating positive risk culture and portraying high integrity and ethical behaviour
among the employees in order for the entire workforce to realise the benefits of the
risk management programme. In the same vein, Company B, which partially
implemented ERM across its business segments and had the ERM activities under
the supervision of the internal audit department also experienced difficulties to
promote a strong risk culture across the organisation due to the lack of understanding
on risks among its employees. In contrast, the interviewee from Company A
believed that risk culture is fundamental in any changes in risk management practices. Thus, the company had allocated its resources to initiate training programmes
such as continuous risk management workshops and literacy risk programmes to
enhance the understanding of their employees at all levels. Apparently, risk culture is
a continuous process which is the responsibility of the senior management leadership, and, thereby, the understanding of risks across all departments is crucial in
order to achieve the best results. In sum, the findings showed that a weak risk culture
in the two case companies Company B and C impeded the success of SRM
implementation.
The study also found that nearly all companies studied were experiencing difficulties to quantify emerging risks due to the lack of risk management methodologies
and tools. Most of the companies found difficulties to measure emerging risks
because they only depend on the risk map and strategic planning to identify the
emerging risks using the SMART criteria: specific, measurable, achievable, realistic,
and time bound action plan. Specifically, the strategic planning was integrated into
the risk management process to measure the strategic impacts of the internal and
external risks. Due to the lack of specific methodology to anticipate emerging risks,
the case of Lahad Datu standoff in 2013 was overlooked by the risk management
202
N. A. A. Aziz and N. A. Manab
This shows that compliance is a form of risk management. Effective compliance
plan helped Company B and C to address the compliance issues related to health and
environmental protection. Meanwhile, Company C was required to meet the sustainability standards and certifications by international regulatory bodies to demonstrate sustainable performance and to ensure the products consumed by customers
are from sustainable sources. In fact, Company C, which had issued their first
sustainability report, used the standards in the Global Retirement Index (GRI)
framework for its sustainability reporting.
In order to address the new challenges of the changing risks, the interviewee from
Company C advocated that the leadership role should ideally be underpinned by a
strong risk culture promoted across the enterprise. The company is more concerned
in promoting a good risk culture; however, unethical behaviour from senior management had dropped down the share value. The company further revealed that the
appointment of board of directors among individuals that have political interest in
the organisation led to exploitation of power and responsibility. This implies that the
presence of politician in the board of directors appeared to have negative effects on
the risk culture because the company’s ownership and controls are transferred to
individuals with multiple interests. Supposedly, the boards are responsible for
cultivating positive risk culture and portraying high integrity and ethical behaviour
among the employees in order for the entire workforce to realise the benefits of the
risk management programme. In the same vein, Company B, which partially
implemented ERM across its business segments and had the ERM activities under
the supervision of the internal audit department also experienced difficulties to
promote a strong risk culture across the organisation due to the lack of understanding
on risks among its employees. In contrast, the interviewee from Company A
believed that risk culture is fundamental in any changes in risk management practices. Thus, the company had allocated its resources to initiate training programmes
such as continuous risk management workshops and literacy risk programmes to
enhance the understanding of their employees at all levels. Apparently, risk culture is
a continuous process which is the responsibility of the senior management leadership, and, thereby, the understanding of risks across all departments is crucial in
order to achieve the best results. In sum, the findings showed that a weak risk culture
in the two case companies Company B and C impeded the success of SRM
implementation.
The study also found that nearly all companies studied were experiencing difficulties to quantify emerging risks due to the lack of risk management methodologies
and tools. Most of the companies found difficulties to measure emerging risks
because they only depend on the risk map and strategic planning to identify the
emerging risks using the SMART criteria: specific, measurable, achievable, realistic,
and time bound action plan. Specifically, the strategic planning was integrated into
the risk management process to measure the strategic impacts of the internal and
external risks. Due to the lack of specific methodology to anticipate emerging risks,
the case of Lahad Datu standoff in 2013 was overlooked by the risk management
202
N. A. A. Aziz and N. A. Manab