# Critical Success Factors for Dynamic Enterprise Risk Management in Responsive Organisations: A Factor Analysis Approach

Brenda Didi-Quvane, Hanlie Smuts, Machdel Matthee

► To cite this version:

Brenda Didi-Quvane, Hanlie Smuts, Machdel Matthee. Critical Success Factors for Dynamic Enterprise Risk Management in Responsive Organisations: A Factor Analysis Approach. 18th Conference on e-Business, e-Services and e-Society (I3E), Sep 2019, Trondheim, Norway. pp.704-717, 10.1007/978-3-030-29374-1_57. hal-02510096

HAL Id: hal-02510096

https://inria.hal.science/hal-02510096

Submitted on 17 Mar 2020

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Critical success factors for dynamic enterprise risk
management in responsive organisations: a factor
analysis approach

Brenda Didi-Quvane, Hanlie Smuts, Machdel Matthee

University of Pretoria

Brenda.Didi-Quvane@mmiholdings.co.za; hanlie.smuts@up.ac.za;

machdel.matthee@up.ac.za

**Abstract.** Globalisation and technology advancements have disrupted the organisational landscape and with the proliferation of new technology; risk management is fundamental to transforming the business especially considering the dynamic nature of the digital society organisations now exist in. However, the challenge faced by the enterprise risk management (ERM) function operating in such a dynamic and transformative environment, is the capability to continuously innovate, evolve and transform its risk management processes to meet the needs of the organisation. Questionnaire survey research examined the relative importance of 18 critical success factors for dynamic ERM. Factor analysis revealed that the appropriate grouping of the 18 critical success factors (CSFs) are ERM charter, ERM processes, and ERM business alignment. These findings should empower organisations to identify risk management processes influencing agility in the risk management practise applied.

# 1 Introduction

Globalisation and technology advancements have disrupted the organisational landscape. In a time of extraordinary economy and market disturbances, as well as changing market conditions, organisations are faced with the challenge of being competitive and having to meet customer requirements [1]. Organisational flexibility is defined in terms of an organisation's response to change, as well as the ability to judge environmental change and respond readily [2]. Therefore, organisations are required to be fast moving, rapidly creating new products through the use of different exponential technologies and methods, while possessing the capabilities to respond to aggressive competitors, quickly navigate volatile markets and successfully penetrate new markets [3]. The ability of an organisation to be responsive to changing conditions requires that it addresses ambiguity which may be generated through innovative initiatives and market change [4]. The reliance of risk management practices to aid in these decision making processes and addressing ambiguity, are therefore vital, taking into account uncertainty and its effect on achieving the organisation's objectives [5].

Although attempts have been made to solve this more dynamic risk management capability problem by suggesting the integration of the risk management processes with the agile development processes, the proposed integration model lacked guidelines on how to actually conduct risk management in a dynamic and responsive
environment [6]. Therefore, in order to guide such responsive organisations towards
more dynamic risk management, this research study considers the following research
question: *what is the relative importance of critical success factors that will enable
dynamic ERM in responsive organisations?* We will reflect on this research question
by considering ERM in general, the nature of responsive organisations and the role of
CSFs towards more dynamic risk management.

The remainder of the paper is structured as follows: in section 2 we provide the background to the study presenting an overview of risk management, as well as risk management principles, processes and models. The approach to this study is discussed in section 3 where after we provide an overview of quantitative findings in section 4. In section 5 we present the CSFs for dynamic risk management in responsive organisations and conclude in section 6.

## 2 Background

In a progressively digital world, organisations are faced with challenges to sustain
or establish a competitive advantage in the market and stay ahead of competitors
[7],[8]. Responsive organisations are designed, structured and operate differently
from the traditional organisations. Dynamic, exponential and disruptive thinking have
been introduced in these organisational environments with goals of experiencing
exponential growth [9]. How an organisation is structured and operates informs the
organisations ERM practices. Therefore, to perform effective risk management,
constant alignment should exist between the organisation and enterprise risk function
[3, 10], with ERM integrated into the organisations decision making processes. As a
decision making tool, ERM should be aligned to the organisation with specific focus
on the organisation's processes, in order to assist in the active and effective
management of risk across the business [11]. ERM defines a "process that combines
the organisation's entire risk management activities in one integrated, holistic
framework to achieve a comprehensive corporate perspective" [12: 4, 13].

Several existing ERM frameworks are used by organisations. The Committee of
Sponsoring Organisations of the Treadway Commission (COSO) [14] and the
ISO31000 [11], are well known risk frameworks. COSO addresses the need for
organisations to improve their approach to managing risk to meet the demands of an
evolving business environment. With the adoption of COSO, organisations should be
able to understand risk impacting the outcome of the business strategy and objectives.
ISO3100 is currently best practice for risk management frameworks and incorporates
best practice from COSO [13]. It provides a generic guideline for risk management,
not intending to impose uniformity of risk management practices. ISO 31000 includes
a detailed list of the suggested principles for risk management, and has an open
system model to fit multiple needs and context. Both COSO and ISO consider the
important influences that culture and biases carry in decision-making and risk
management practices, but no guideline is given on how responsive organisations
operating in dynamic and changing environments, can implement more dynamic risk
management practices [12, 13].

Furthermore, adequate risk management capabilities are needed when operating in
an environment of uncertainty [9, 15]. This is opposed to the current systematic and
linear risk management approach applied [16], that is in line with the organisational
structure of the traditional organisation which is linear in nature [17, 18]. Responsive attributes will guide organisations towards implementing essential components for managing risk.

In the next sections we present a high level synopsis of ERM and responsive organisations, as well as an overview of CSFs in the context of ERM.

## Enterprise Risk Management

Organisations of all forms, types and sizes face a range of risks that can affect the achievement of the organisation's objectives. These organisational objectives can relate to a range of organisational activities, such as operations and processes reflected in terms of strategic, operational, financial and reputational outcomes and impacts [19]. An enterprise wide approach to risk management draws together these impacts to provide a structured approach to consider the potential impact of all types of risks on all processes, activities, stakeholders, products and services [20]. Stakeholders, both external and internal to the organisation, are now much more concerned with risk [20], understanding that adequate risk management capabilities are needed when operating in an environment of uncertainty [15].

Before an organisation select the most effective strategy or decision, it needs to understand the risks being taken when seeking to achieve objectives and it needs to assess the organisations exposure, risk profile, financial position and acceptable risk and reward trade-off [13]. Therefore, for the ERM to be effective, it must be directly connected to company strategy, and designed to recognise events that could have an impact on organisational performance as defined by its strategic objectives [19]. A successful ERM initiative can affect the likelihood and consequences of risks materializing, as well as deliver benefits related to better informed strategic decisions, successful delivery of change and increased operational efficiency [4, 19]. Other benefits include reduced cost of capital, more accurate financial reporting, competitive advantage, improved perception of the organisation and better marketplace presence and enhance informed decision making ability [19, 21].

As organisations attempt to gain maximum benefit from ERM in the current dynamic organisational environments, we consider the nature of responsive organisations in the next section.

## The Nature of Responsive Organisations

The development of new technology influences the design of organisations and their ways of work [22]. For organisations to thrive in an environment of continuous and often unanticipated change, they are required to quickly adapt by reshaping the culture of the organisation, reforming business practices to cater for more collaborative and robust management, provide for the increased use of iterative practices and consider rigorous change management [1, 23, 24]. The shift in organisational design principles from old to new distinguishes speed, flexibility, integration and innovation as key success factors [22]. Therefore, organisational attributes that provide for flexibility is needed in an environment that is continuously changing [3, 25].
To consider the nature of responsive organisations, we reviewed various definitions of responsiveness from the literature in order to identify the essential attributes embedded within those definitions as shown in Table 1. For each responsive organisation attribute, we provide a brief description, as well as the references for the particular attribute. The purpose of Table 1 is to guide the CSF identification towards responsiveness.

<table><caption>Table 1. Attributes of responsive organisations</caption><thead><tr><td>Responsive Organisation Attribute and References</td><td>Description</td></tr></thead><tbody><tr><td>Slimmer, flatter and adaptable organisational structure [26, 27]</td><td>Employing organisational structures that are lean and foster flexibility; an organisation with fewer layers of management (flat), is able to respond more flexibly to business challenges.</td></tr><tr><td>Robust learning, knowledge and adaptation processes [26, 27]</td><td>Ability to integrate working and learning, focus on life-long learning and learn and work effectively both as individuals and in teams.</td></tr><tr><td>Disposal of non-core activities [26]</td><td>Outsourcing, separation from core business or selling off of non-core activities.</td></tr><tr><td>Delegation and decentralisation [26]</td><td>Assignment of decision making to the customer interface, with few management layers between customers and decision points, utilising more lateral communication.</td></tr><tr><td>Fast moving and non-linear eco-system [28, 29]</td><td>Risk management in a dynamic and rapidly growing organisation must be differently defined and executed.</td></tr><tr><td>Measurement of output [2, 26]</td><td>Assessment and remuneration based on output rather than position in the organisation, as well as measurement of organisational agility.</td></tr><tr><td>Responsive to various stakeholders [25, 30-32]</td><td>Customising engagement to the individual customer, suppliers and community.</td></tr><tr><td>Access to skill [26, 30]</td><td>Skills capacity planning and acquisition of skills to enable response to diverse customer needs.</td></tr><tr><td>Cohesion and high degree of readiness [33, 34]</td><td>React purposefully and within an appropriate timescale, to significant events, opportunities or threats (especially from the external environment) to bring about or maintain competitive advantage; handle disturbances in an organic fashion.</td></tr><tr><td>Diversity of employees [26]</td><td>Extent to which resources contrast in their competence and attitudes, market value, and their work, life style and learning preferences.</td></tr><tr><td>Culture of trust [3, 34]</td><td>Create a collaborative environment where failure is not feared.</td></tr></tbody></table>

According to Table 1, responsive organisations represent flexible organisational structures with few levels of management that enable clear accountability and decision-making. Responsive organisations operate with a high degree of readiness to purposefully address any business- or external environment changes, grounded in a culture of trust. Employees are highly skilled with a strong focus on continuous learning and assessed on output. These findings are confirmed by the all-encompassing definition presented by Dove [27: 4]: "an effective integration of response ability and knowledge management in order to rapidly, efficiently and accurately adapt to any unexpected (or unpredictable) change in both proactive and reactive business / customer needs and opportunities without compromising with the cost or the quality of the product / process".

For responsive organisations, the challenge now faced by the ERM function is the question of linearity, where risk management processes are planned, and methodically and systematically applied [17]. Risk management agility within organisations is not easily attained due to organisation-wide functions and processes still functioning and
operating in a linear manner [17, 35]. Traditionally, risk management has always followed a more linear approach to the identification, assessing, managing and monitoring of risks, providing drawn-out projections of emerging risks and tracking currents risks within the control environment of a stretched period of time [25]. Therefore, adequate risk management capabilities are needed when operating in an environment of uncertainty and risk management should be the product of both responsiveness and capability [15].

In order to identify CSFs for dynamic ERM in responsive organisations, we consider ERM CSF categories in the next section.

## Risk Management Critical Success Factors

CSFs refer to a limited number of characteristics, conditions, or variables that have a direct and significant impact on the effectiveness, efficiency, and viability of an organisation [21]. Activities associated with CSFs must be performed at the highest possible level of excellence to achieve the intended overall objectives [36]. The main principle of ERM is that it delivers value to the organisation [13]. In order for an organisation to understand the characteristics of ERM and what it is to deliver on, ERM practices operate on a set of principles [2]. Such principles define the essential features of ERM, describing what ERM should be in practice, while including information on what ERM should deliver on [13]. Furthermore, such principles point to a systematic process that involves activities of communicating and consulting, establishing the context and assessing, treating, monitoring, reviewing, recording and reporting of risk [11, 20].

<table><caption>Table 2. Critical success factors for Enterprise Risk Management in Responsive Organisations</caption><thead><tr><td>Critical success factor</td><td>References</td></tr></thead><tbody><tr><td>Adequate internal reporting of framework effectiveness</td><td>[18, 21, 37]</td></tr><tr><td>Appropriate and timeous communication of framework modification</td><td>[11, 18, 20, 38]</td></tr><tr><td>Clear risk management framework development and implementation accountability</td><td>[18, 38, 39]</td></tr><tr><td>Consider internal and external organisational context</td><td>[15, 20, 40]</td></tr><tr><td>Continuous suitability-checking of risk management framework</td><td>[18, 39]</td></tr><tr><td>Creates value for the organisation</td><td>[13, 20, 38, 41]</td></tr><tr><td>Effectiveness agility and resilience dependent</td><td>[12, 18, 40]</td></tr><tr><td>Embedded in organisational decision making</td><td>[21, 37, 41]</td></tr><tr><td>Facilitation of continual improvement and enhancement of the organisation</td><td>[38, 41]</td></tr><tr><td>Foster skills diversity and expertise</td><td>[18, 39, 40]</td></tr><tr><td>Integral part of organisational processes.</td><td>[21, 37-39]</td></tr><tr><td>Integration of risk management within overall risk management system</td><td>[39, 42]</td></tr><tr><td>Iterative and responsive to change</td><td>[18, 39, 40]</td></tr><tr><td>Joint practitioner and business contingency planning</td><td>[21, 38]</td></tr><tr><td>Regular review of risk management policy and framework in response to changes</td><td>[2, 37, 39]</td></tr><tr><td>Risk indicators tracking directly aligned to business performance indicators</td><td>[18, 38, 42]</td></tr><tr><td>Risk management practice should accommodate changing organisation</td><td>[38, 40, 43]</td></tr><tr><td>Systematic, planned and structured approach</td><td>[20, 21]</td></tr></tbody></table>

By considering the factors identified in the sections above and the literature, we extracted 18 relevant CSFs depicted in Table 2. Key decisions in an organisation are informed by a range of possible outcomes, and these outcomes are rarely binary. The CSFs depicted in Table 2 point to a well-developed capability to identify, measure,
manage and monitor risks across the organisation e.g. adequate internal reporting, risk indicator tracking, timeous communication to and involvement of all stakeholders, as well as a structured approach. Furthermore, the dynamic nature and the ability to adapt to changing risks and varying business cycles, are reflected in CSFs such as effectiveness agility, responsive to change and accommodation of a changing organisation. Explicit consideration of risk and risk management are supported by value creation, the identification of new risks using internal and external information and ultimately moving from prevention of risks to exploit risk. In addition, these CSFs should also accommodate emerging risks and other non-quantifiable risks as a result of extreme internal or external organisational events [21].

## 3 Research Approach

Our overall objective of this paper was to provide CSFs for dynamic ERM in responsive organisations. These CSFs empower organisations to identify risk management processes influencing agility in the risk management practise applied. Eighteen CSFs as identified from the literature are given in Table 2. However, it is necessary to investigate these factors with respect to relative importance and underlying groupings: Are these CSFs equally important? Can these CSFs be reduced to fewer essential factors?

In order to answer these questions, we chose quantitative research, namely factor analysis, to determine the underlying patterns amongst these CSFs. We utilised survey research as a research strategy with the selection of a large sample of participants from a pre-determined population of interest [44]. By choosing survey as a research strategy, it allowed us to obtain the same kind of data from a large group of people, in a standardised manner [45]. We utilised an on-line questionnaire for data collection as a questionnaire enabled the collection of a large data set over a short period of time [46]. The attributes of responsive organisations (Table 1) and the CSFs defined (Table 2) were included in the design of the on-line questionnaire. After the online questionnaire was pilot tested to ensure that all items were clear and meaningful, respondents had to provide data on their role and years of experience. They also had to rate the 18 CSF statements using a 5-point Likert rating scale.

Specific criteria and rationale were used in identifying the research participants for the online questionnaire i.e. risk practitioners working in a risk function, professionals working in a business function that engages with the risk fraternity, and professionals with a business strategy understanding. Convenience sampling was used where research participants are of the target population that meet certain practical criteria, such as easy accessibility, geographical proximity, availability at a given time, or the willingness to participate [47]. A web link to the questionnaire, was emailed to the identified target audience, which comprised of 319 research participants representing various organisational structures and business sectors. The total number of respondents (refer profile in Table 3) for the questionnaire was 183, yielding a response rate of 57%.
<table><caption>Table 3. Profile of questionnaire respondents</caption><thead><tr><th>Respondent profile</th><th>% of respondent profile</th><th>Respondent role</th><th>% of respondent role</th><th>Respondent Tenure</th><th>% of respondent tenure</th></tr></thead><tbody><tr><td>Risk practitioner</td><td>35.6%</td><td>Executive</td><td>7.9%</td><td>&lt; 5 years</td><td>10.1%</td></tr><tr><td rowspan="2">Professional (engaging with risk)</td><td rowspan="2">45.8%</td><td>Senior Manager</td><td>23.6%</td><td>5 - 10 years</td><td>16.3%</td></tr><tr><td>Middle Manager</td><td>29.1%</td><td>11 - 20 years</td><td>51.1%</td></tr><tr><td rowspan="2">Professional (strategic role, engaging with risk)</td><td rowspan="2">18.6%</td><td>Junior Manager</td><td>5.6%</td><td>21 - 30 years</td><td>16.9%</td></tr><tr><td>General staff</td><td>27.5%</td><td>31 - 40 years</td><td>5.1%</td></tr><tr><td></td><td></td><td>Specialist</td><td>6.2%</td><td>40 years above</td><td>0.6%</td></tr></tbody></table>

Based on the specific criteria used to identify potential research participants, 35.6% of respondents are risk practitioners as shown in Table 1, 45.8% is professionals in business functions engaging with the risk function and 18.6% are professionals in business functions that in addition, engage specifically with business strategy in their roles. In terms of research participants' roles, 31.5% are in senior and executive management, 34.7% are in management, 27.5% indicated that they are general staff members and 6.2% indicated specialists. With reference to tenure, between 11-30 years account for 67.4% of the research participants highlighting extensive industry experience. 5.1% of research participants have a tenure of between 31-40 years and 0.6% has a tenure of more than 40 years.

In the next section, we discuss the quantitative analysis of the data collected in order to derive CSF groupings for dynamic risk management in responsive organisations.

## 4 Data Analysis and Findings

The relative importance of the CSFs (Table 4) identified from the literature was explored by means of a Likert rating scale (1 = strongly disagree, 5= strongly agree) questions in a questionnaire instrument. Statistical analysis undertaken with SPSS v25 included descriptive analysis, reliability tests using Cronbach's alpha, one-way analysis of variance and factor analysis. The Cronbach's alpha reliability for the factors is 0.914 suggesting that the 18 CSFs has excellent internal reliability [40, 48]. This implies that the factors are closely correlated with each other.

Factor analysis is used to identify a relatively small number of factor groupings that can be used to represent relationships among sets of many interrelated variables [39, 49]. This technique was applied to the questionnaire data to explore the groupings that might exist among the CSFs enabling dynamic ERM. Varimax rotation method was used to produce factor loading that minimizes the number of variables with high loadings, either positive or negative, for each factor [50]. For the CSFs extracted from the literature, the factor analysis shows that 18 CSFs can be grouped into 3 principal factors depicted in Table 4 and interpreted as follows:

* Factor grouping 1 represents *enterprise risk management charter*.

* Factor grouping 2 represents *enterprise risk management processes*.

* Factor grouping 3 represents *enterprise risk management business alignment*.
<table><caption>Table 4. Rotated factor matrix (loading) of critical success factors for ERM</caption><thead><tr><th rowspan="2">Factor components</th><th colspan="3">Component</th></tr><tr><th>Factor 1</th><th>Factor 2</th><th>Factor 3</th></tr></thead><tbody><tr><td>Appropriate and timeous communication of framework modification</td><td>.871</td><td></td><td></td></tr><tr><td>Clear risk management framework development and implementation accountability</td><td>.860</td><td></td><td></td></tr><tr><td>Adequate internal reporting of framework effectiveness</td><td>.775</td><td></td><td></td></tr><tr><td>Continuous suitability-checking of risk management framework</td><td>.750</td><td></td><td></td></tr><tr><td>Consider internal and external organisational context</td><td>.745</td><td></td><td></td></tr><tr><td>Regular review of risk management policy and framework in response to changes</td><td>.722</td><td></td><td></td></tr><tr><td>Integration of risk management within overall risk management system.</td><td>.705</td><td></td><td></td></tr><tr><td>Integral part of organisational processes.</td><td></td><td>.817</td><td></td></tr><tr><td>Embedded in organisational decision making.</td><td></td><td>.800</td><td></td></tr><tr><td>Facilitation of continual improvement and enhancement of the organisation</td><td></td><td>.775</td><td></td></tr><tr><td>Creates value for the organisation</td><td></td><td>.775</td><td></td></tr><tr><td>Foster skills diversity and expertise</td><td></td><td>.724</td><td></td></tr><tr><td>Systematic, planned and structured approach</td><td></td><td>.543</td><td></td></tr><tr><td>Joint practitioner and business contingency planning</td><td></td><td>.508</td><td></td></tr><tr><td>Effectiveness agility and resilience dependent</td><td></td><td></td><td>.936</td></tr><tr><td>Risk management practice should accommodate changing organisation</td><td></td><td></td><td>.918</td></tr><tr><td>Iterative and responsive to change</td><td></td><td></td><td>.907</td></tr><tr><td>Risk indicators tracking directly aligned to business performance indicators</td><td></td><td></td><td>.834</td></tr></tbody><tfoot><tr><td colspan="4">Note: Extraction Method: Principal Component Analysis.<br>Rotation Method: Varimax with Kaiser Normalization.<br>Rotation converged in 5 iterations.</td></tr></tfoot></table>

After the Varimax rotation, factor grouping 1 (ERM charter) accounts for 27.14% of the total variances between CSFs, while factor grouping 2 (ERM processes) accounts for 23.93% of variances between CSFs. Factor grouping 3 (ERM business alignment) accounts for 19.16% of the total variances between CSFs. In the next section we present individual statistics and discuss each factor grouping in detail.

## 5 Factor analysis of Critical Success Factors for Enterprise Risk Management in Responsive Organisations

Factor grouping 1, *ERM charter*, consists of 7 CSFs all reflecting high factor loading [49]. The factors with the strongest association (0.871 and 0.860 respectively), are *appropriate and timeous communication of framework modification* and *clear risk management framework development and implementation accountability*. It is key that any changes to an ERM charter are communicated timeously to ensure that no accountability gaps, for charter development as well as charter implementation, are created through the modifications. The next 3 CSFs with a strong association (0.775, 0.750 and 0.745 respectively) call for a fit-for-purpose and appropriate ERM charter. *Adequate internal reporting of framework effectiveness*
ensures that the ERM charter remains relevant for the organisation through measuring
its effectiveness, as well as continuously checking the suitability of the risk
management framework. This process of continuous optimization is achieved by
consciously considering the internal and external organisational context. This
comprehensive monitoring and alignment of the ERM charter, relates to the next CSF
with fairly strong association (0.722) as any changes in the internal or external
environment, reporting, measurement or accountability, will trigger a regular review
of the risk management policy and framework in response to changes. This CSF also
points to the fact that an organisation must ensure that their ERM remain relevant and
aligned in times of any change impacting the organisation. The last CSF in factor 1,
also with the lowest association of 0.705, is integration of risk management within
overall risk management system. ERM involves establishing actions to respond to risk
and implement adequate internal controls with which to limit the possibility of
occurrence or consequences of risk, if it is materialized. In order to ensure efficiency in
achieving objectives, the process must be coherent and convergent, integrated to
objectives, activities and operations carried out within the organisation. The entire
ERM system must be managed. ERM charter update is required whenever the
organisation changes its strategic objectives, or when the risk policy changes.

Factor grouping 2, *ERM processes*, consists of 7 CSFs with *integral part of organisational processes* and *embedded in organisational decision making* depicting the highest association (0.817 and 0.800 respectively). A dynamic approach to ERM calls for preventing losses, as well as regarding risks as a source of competitive advantage. This approach requires that all organisational functions (human resources, sales, finance, procurement, information technology, legal, strategic development etc.) participate in the organisational risk management process. *Facilitation of continual improvement and enhancement of organisation* and *creates value for the organisation* both have a significant association of 0.775. The role of ERM is to enable organisations to determine what level of risk it is prepared to accept to achieve its strategic objectives, add value to activities and to achieve planned goals. This is achieved through a structured process to ensure that the outcome is coherent and that risk response measures are integrated. ERM can therefore guide the organisation to improve work according to the benefits of good risk management. Work improvement requires employees to obtain the necessary skills in order to monitor and control based on principles of efficiency and effectiveness. The next CSF in factor 2, *foster skills diversity and expertise* with an association of 0.724, points to the fact that employees, regardless of their hierarchical level in the organisation, should be aware of the importance of ERM to achieve planned results. The lowest association of 0.543 and 0.508 respectively are associated with the CSFs systematic, *planned and structured approach* and *joint practitioner and business contingency planning*. From the description of the other CSFs in factor 2, the structured approach and ERM knowledgeable employees are re-enforced and implied.

Factor grouping 3, *ERM business alignment*, consists of 4 CSFs – all with high loading. *Effectiveness agility and resilience dependent* with an association of 0.936 points to the key requirement that a dynamic approach to ERM should be based on an enhanced level of organisational agility. Furthermore, organisational resilience builds upon, and extends beyond, existing strategies for the management of unforeseen risk; it is based on a more organic capacity in the organisation. This CSF is a key mind set
in terms of ERM principles. The following two CSFs with high loading (0.918 and 0.907 respectively) are risk management practice should accommodate changing organisation and iterative and responsive to change. Risk assessment is an essential component of the organisation, as the employees change, regulations change, suppliers change, etc. the objectives must be reviewed or new ones established. This change mind set on the organisational risk profile, informs the emergence of new risks and modification of existing risks. The last CSF in factor 3, risk indicators tracking directly aligned to business performance indicators, has a high association (0.834) and points to the philosophy that risk management is integrated and aligned to business strategy. A more proactive focus is required to ensure that key performance indicators (and the resulting outcomes) are achieved, by proactively identifying risks associated with those key performance indicators and managing those risks.

The three factor groupings with their CSFs will have a direct impact on the effectiveness and efficiency of ERM. ERM is a powerful tool that enables the organisation to have a view of the risks affecting the achievement of strategic and operational objectives. At the same time, ERM provides the process of identification, analysis and assessment of risks taking into account the events of and change in the organisation, which can take negative shape and are associated with risks or positive shape and are associated with opportunities.

## 6 Conclusion

In order to address the lack of guidelines on how to conduct risk management in a dynamic and responsive environment, this research identifies three factor groupings of 18 CSFs for effective ERM in responsive organisations. The three dimensions describe factors to consider in establishing and monitoring risk management policies and frameworks (ERM charter), defining risk management processes (ERM processes) and aligning risk management processes with business (ERM organisational alignment). These groupings give a holistic view of critical factors to take into account when responding to risk while transforming risk management practices to meet the dynamic needs of the organisation.

Although our starting point with identifying CSFs was related to responsive environments, one could argue that the CSF groupings identified are equally applicable to risk management in linear, traditional organisations. The existing risk management frameworks are not meant for dynamic, responsive organisations. Further research is therefore needed on how existing frameworks can be extended to be appropriate in continuously changing environments.

## References

1. Sarah, B.Y., et al., *Agility Ability*. PM Network, 2012, **26**(10): p. 54-61.

2. Overby, E., A. Bharadwaj, and V. Sambamurthy, *Enterprise agility and the enabling role of information technology*. European Journal of Information Systems, 2006. **15**(2006): p. 120–131.

3. Burba, D., *When agile meets auditor*. PM Network, 2015, **29**(1): p. 60-67.

4. Teece, D., M. Peteraf, and S. Leih, *Dynamic Capabilities and Organizational Agility: Risk, Uncertainty, and Strategy in the Innovation Economy*. California Management Review, 2016, **58**(4): p. 13-35.
5. Blanco, C., J. Hinrichs, and R. Mark. *Creating Risk Culture: a Framework* Risk Culture 2014 [cited 2019 March]; Available from: https://www.scribd.com/document/341453115/Creating-Risk-Culture-a-Framework.

6. Nyfjord, J. and M. Kajko-Mattsson. *Outlining a Model Integrating Risk Management and Agile Software Development*. in 34th Euromicro Conference Software Engineering and Advanced Applications. 2008. Parma, Italy: IEEE.

7. Ganju, K.K., P.A. Pavlou, and R.D. Banker, *Does information and communication technology lead to the wellbeing of nations? A country-level empirical investigation*. MIS Quarterly, 2016. **40**(2): p. 417-430.

8. Rocha, L., et al., *Cloud management tools for sustainable SMEs*. Procedia CIRP, 2016. **40**: p. 220-224.

9. Ismail, S., M.S. Malone, and Y. Van Geest, *Exponential Organisations: why new organisations are ten times better, faster, and cheaper than yours (and what to do about it)*. 2014, New York: Diversion Publishing Corporation, Diversion Books.

10. Knight, F.H. *Risk, uncertainty and profit*. University of Illinois at Urbana-Champaign's Academy for Entrepreneurial Leadership Historical Research Reference in Entrepreneurship 2012 [cited 2019 March].

11. ISO 31000 - Risk management. *ISO 31000:2018 Risk management - Guidelines*. 2018 [cited 2019 March]; Available from: https://www.iso.org/standard/65694.html.

12. Gatzert, N. and M. Martin, *Determinants and Value of Enterprise Risk Management: Empirical Evidence from the Literature* 2013, Department for Insurance Economics and Risk Management Friedrich-Alexander-University (FAU) of Erlangen-Nürnberg: Nuremberg, Germany.

13. Hopkin, P., *Fundamentals of risk management understanding, evaluating and implementing effective risk management*. 2018, London: Kogan Page.

14. Committee of Sponsoring Organizations of the Treadway Commission. *Strengthening Enterprise Risk Management for Strategic Advantage*. 2017 [cited 2019 March]; Available from: http://www.coso.org/.

15. Walczak, W. and D. Kuchta, *Risks Characteristic of Agile Project Management Methodologies and Responses to them*. Operations Research and Decisions, 2013. **23**(4): p. 75-95.

16. Nyfjord, J. and M. Kajko-Mattsson. *Commonalities in risk management and agile process models*. in *2nd International Conference on Software Engineering Advances*. 2007. IEEE.

17. Mabey, C., G. Salaman, and J. Storey, *Organizational Structuring and Restructuring*. Understanding Business Organisations. 2001, London: Routledge.

18. Ahmed, I. and N.A. Manab, *Influence of Enterprise Risk Management Success Factors on Firm Financial and Non-financial Performance: A Proposed Model*. International Journal of Economics and Financial Issues, 2016. **6**(3): p. 1-7.

19. Soltanizadeh, S., et al., *Business strategy, enterprise risk management and organizational performance*. Management Research Review, 2016. **39**(9): p. 1016-1033.

20. Nair, A., et al., *Enterprise Risk Management as a Dynamic Capability: A test of its effectiveness during a crisis*. Managerial and Decision Economics, 2013. **35**(8): p. 555-566.

21. Aziz, N.A.A., N.A. Manab, and S.N. Othman, *Critical Success Factors of Sustainability Risk Management (SRM) Practices in Malaysian Environmentally Sensitive Industries*. Social and Behavioral Sciences, 2016. **219**(2016): p. 4-11.

22. McMillan, E., *Considering organisation structure and design from a complexity paradigm perspective*, in *Tackling industrial complexity: the ideas that make a difference*, G. Frizzelle and H. Richards, Editors. 2002, University of Cambridge: Cambridge, UK. p. 123-136.

23. Ambrose, C. and D. Morello, *Designing the Agile Organization: Design Principles and Practices*, in *Strategic Analysis Report*. 2004, Gartner Research. p. 1-25.

24. Yusuf, Y., M. Sarhadi, and A. Gunasekaran, *Agile manufacturing:: The drivers, concepts and attributes*. International Journal of Production Economics, 1999. **62**(1-2): p. 33-43.

25. Boahin, P., *The Changing Nature of Work and Employability Skills Development in Higher Education Institutions in Ghana*. European Journal of Educational and Development Psychology, 2018. **6**(3): p. 21-32.

26. Coulson-Thomas, C., *IT and New Forms of Organisation for Knowledge Workers: Opportunity and Implementation*. Employee Relations, 1991. **13**(4): p. 22-32.

27. Dove, R., *Response Ability: The Language, Structure and Culture of the Agile Enterprise*. 2001, Hoboken,NJ: Wiley.
28. Roggi, O. and J.A. Andersen, *Strategic Risk Management and Corporate Value Creation*, in *The Routledge Companion to Strategic Risk Management*, T.J. Andersen, Editor. 2016, Routledge. p. 421-437.

29. Boehm, B. and R. Turner, *Using risk to balance agile and plan-driven methods*. IEEE Computer Society, 2003. 36(6): p. 57-66.

30. Davis, F.W. and K.B. Manrodt, *Service Logistics: An Introduction*. International Journal of Physical Distribution & Logistics Management, 1991. 21(7): p. 4-13.

31. Kaur, A. and P.C. Sharma, *Social sustainability in supply chain decisions: Indian manufacturers*. Environment, Development and Sustainability, 2018. 20(4): p. 1707-1721.

32. McIntosh, R.I., et al., *Late customisation: issues of mass customisation in the food industry*. International Journal of Production Research, 2010. 48(6): p. 1557-1574.

33. Barclay, I., J. Poolton, and Z. Dann, *Improving Competitive Responsiveness Via The Virtual Environment*. IEEE, 1996: p. 52-62.

34. Dove, R., *Knowledge management, response ability, and the agile enterprise*. Journal of Knowledge Management, 1999. 3(1): p. 18-35.

35. Holbeche, L., *The Agile Organisation: How to build an innovative, sustainable and resilient business*. 2018: Kogan Page.

36. Critical success factor, *The Business Dictionary*. 2019.

37. Cormican, K., *Integrated Enterprise Risk Management: From Process to Best Practice*. Modern Economy, 2014. 5: p. 401-413.

38. Shad, M.K. and F. Lai, *A Conceptual Framework for Enterprise Risk Management performance measure through Economic Value Added*. Global Business and Management Research: An International Journal, 2015. 7(2): p. 1-11.

39. Zhao, X., B. Hwang, and S.P. Low, *Critical success factors for enterprise risk management in Chinese construction companies*. Construction Management and Economics, 2013. 31(12): p. 1199-1214.

40. Yaraghi, N. and R.G. Langhe, *Critical success factors for risk management systems*. Journal of Risk Research, 2011. 14(5): p. 551-581.

41. Choi, Y., et al., *Optimizing enterprise risk management: a literature review and critical analysis of the work of Wu and Olson*. Annals of Operations Research, 2016. 237(1-2): p. 281-300.

42. Wang, H., J. Barney, and J. Reuer, *Stimulating firm-specific investment through risk management*. Long Range Planning, 2003. 36: p. 49-59.

43. Peteraf, M.A. and C. Maritan, *Dynamic Capabilities and Organisational Processes*, in *Dynamic Capabilities: Understanding Strategic Change in Organization*, C. Helfat, et al., Editors. 2007, Blackwell Publishing: Oxford, UK. p. 30-45.

44. Kelley, K., et al., *Good practice in the conduct and reporting of survey research*. International Journal for Quality in Health Care, 2003. 15(3): p. 261-266.

45. Oates, B.J., *Researching Information Systems and Computing*. 2008, London: SAGE Publications.

46. De Villiers, M.R., *Models for interpretive information systems research, part 2: Design research, development research, design-science research, and design-based research - a meta-study and examples*. Research Methodologies, Innovations and Philosophies in Software Systems Engineering and Information Systems, 2012: p. 238-255.

47. Etikan, I., *Comparison of Convenience Sampling and Purposive Sampling*. American Journal of Theoretical and Applied Statistics, 2016. 5(5): p. 1-4.

48. Morling, B., *Research Methods in Psychology: Evaluating a world of Information*. 2015, Norton, Canada.

49. Williams, B., A. Onsman, and T. Brown, *Exploratory factor analysis: A five-step guide for novices*. Journal of Emergency Primary Health Care, 2010. 8(3): p. 1-13.

50. Akhtar-Danesh, N., *A Comparison between Major Factor Extraction and Factor Rotation Techniques in Q-Methodology*. Open Journal of Applied Sciences, 2017. 7: p. 147-156.