Introduction Banks Operate In Business Environments

Banks operate in business environments that entail a level of inherent

risk from the products and services that they offer to customers (Abdullatif

& Kawuq, 2015). Inherent risk, also known as absolute risk, derives from

the environment without mitigating internal control effects (Van de Venter

et al., 2016). Inherent risk in the loan portfolios was the cause of five U.S.

banks failing in 2016 and another 10 banks in 2017 (Federal Deposit

Insurance Corporation, 2018). Managing risks associated with loan

portfolios is a top priority for bank managers and leaders (Bushman et al.,

2018). Unlike large banks, some small and medium-sized banks do not have

the resources and expertise to manage risk at an acceptable level (Frazer,

2015).

Background of the Problem

The U.S. banking industry is the most liquid and largest market

globally (Laeven et al., 2016). This industry supports the world’s largest

economy with the greatest diversity in banking institutions and private credit

concentration (Lundqvist & Vilhelmson, 2018). The banking sector has

awakened to risk management, especially since the 2007-2008 financial

crisis (Amarh, 2015; Jian & Zhi, 2018). The function of risk management in

banking is complicated; bank managers continue to look for the best risk

assessment tools and practices to mitigate the high level of inherent risk in

their loan portfolios (Thakor, 2018). By implementing a more robust risk

management strategy, bank managers may decrease residual risk and

increase profit and market share (Stulz,

2015).

Problem Statement

Managing risks associated with bank loan portfolios is a continuing

issue for some bank managers (Lim et al., 2017). The number of failed banks

in the United States between 2008 and 2017 was 528, with a corresponding

loss of assets totaling 750 million dollars (Federal Deposit Insurance

Corporation, 2019). The general business problem was that a high level of

inherent risk exists that negatively affects the outcome of loan portfolios of

banks in the United States. The specific business problem was that some

bank managers lack strategies to mitigate the level of inherent risk in their

retail loan portfolios.

Purpose Statement

The purpose of this qualitative multiple case study was to explore

strategies bank managers use to mitigate the level of inherent risk in their

retail loan portfolios. The targeted population included eight bank managers

from four different banks located in San Antonio, Texas, who had

implemented successful strategies in managing the risk of their retail loan

portfolios. The implication for positive social change is that improved

strategies in managing risks might benefit residents through increased access

to credit, which could empower the residents to improve and better their

communities.

Nature of the Study

McCusker and Gunaydin (2015) identified three broad methods of

inquiry available to researchers: qualitative, quantitative, and mixed

methods. Researchers use the qualitative method to understand a

phenomenon through open-ended inquiry, usually relying heavily on text

and image data gathered from study participants (Berger, 2015). A

qualitative approach enables the researcher to probe into responses and

observations to obtain detailed information about experiences, behavior, and

beliefs (Kruth, 2015). Qualitative researchers collect data primarily through

semistructured interviews to gain an understanding and meaning of a

phenomenon (Yin, 2017). I chose the qualitative method. With the

quantitative method, researchers use data to test hypotheses involving two or

more quantitative variables (Ma, 2015). I did not test hypotheses and

examine differences or the relationship among variables in this study. Mixed

method researchers combine quantitative and qualitative methods in the

same study to obtain a greater understanding of a phenomenon (Johnson,

2015). I did not use the mixed method as the quantitative aspect is not a part

of my study.

The qualitative research design I selected was a multiple case study.

Yin (2017) described a case study design as a study within the real-life

contemporary context of a setting for providing an in-depth understanding of

a case bounded by time and place. Mojtaba and Nonino (2017) suggested

that a multiple case study provides researchers a robust exploration of a

phenomenon. Another research design option was ethnography, which is a

systematic study of culture for the researcher to observe from the point of

view of the subject under review (Kruth, 2015). However, the ethnographic

design was not appropriate as I did not plan to study culture in this study.

Alternatively, a researcher uses a phenomenological design to explore the

meanings of participants’ lived experiences (Yin, 2017). A

phenomenological design was not appropriate for this study as I did not

intend to explore the meaning of participants’ lived experiences. Although

each of the alternative designs had a unique research purpose, none of them

were an optimal choice for my study. A case study design was optimal to

address my research question as my focus is to explore an in-depth situation

of a phenomenon bounded by time and place.

Research Question

What strategies do some bank managers use to mitigate the level of

inherent risk in their retail loan portfolios?

Interview Questions

1. What strategies have you used to mitigate the level of inherent risk

in your retail loan portfolios?

2. How does your organization assess the level of inherent risk in the

retail loan portfolios?

3. What were the key barriers your organization encountered when

implementing your strategies for mitigating the level of inherent

risk in your retail loan portfolios?

4. How did your organization address the key barriers to

implementing your successful strategies for mitigating the level of

inherent risk in your retail loan portfolios?

5. How has your organization assessed the effectiveness of your

strategies for mitigating the level of inherent risk in the retail loan

portfolios?

6. How does your organization develop risk assessment in the retail

loan portfolio?

7. What additional information can you share regarding strategies to

mitigate the level of inherent risk in the retail loan portfolios?

Conceptual Framework

The conceptual framework for this study was the enterprise risk

management (ERM) framework. In 1994, the Committee of Sponsoring

Organizations of the

Treadway Commission (COSO) developed a model for evaluating internal

controls (COSO, 2017). Business leaders use the ERM framework to

develop effective internal controls (Pierce & Goldstein, 2018). In 2003, the

ERM Committee of the Casualty Actuarial Society (CAS) first introduced

the framework by outlining rationale, evolution, and risk analysis from the

casualty actuarial perspective (Nocco & Stulz, 2006). Bank managers use the

ERM-COSO model for guidance when developing internal controls for the

achievement of organizational objectives. According to Altheebeh and

Sulaiman (2016), the ERM-COSO framework encompasses (a) control

environment, (b) risk assessment, (c) control activities, (d) information and

communication, and (e) monitoring. The foundation of internal controls

within an organization includes leadership, shared values, and a culture that

emphasizes accountability (Graham & Kaye, 2015). The ERM framework

was appropriate for this study as this framework includes a holistic

functional component that is applicable to address inherent risk components.

Operational Definitions

Credit risk: The possibility of borrowers defaulting on the promised

payments or the chance that assets will lose value below the recorded value

(Cohen et al., 2014).

Committee of Sponsoring Organization of the Treadway Commission

(COSO) framework: COSO provides guidance for designing, implementing,

and conducting internal control and assessing its effectiveness (Wu et al.,

2015).

Financial risk tolerance: The maximum uncertainty acceptable when

making decisions that involve financial issues (Hemrajani & Sharma, 2018).

Liquidity risk: From the perspective of a financial institution’s

leadership, liquidity risk occurs when an insufficient buffer of cash exists to

cover the gaps in cash receipts and disbursements (Toews, 2015).

Loan default: A situation where a debtor fails to meet his or her legal

obligations according to the debt contract (Cowling et al., 2018).

Risk appetite: The level of risk an organization is willing to accept

(Wu et al.,

2015).

Risk assessment (Risk analysis): The process of identifying and

analyzing potential risks, including financial, operational, strategic, and

reputational, that could negatively impact key business initiatives (Lam,

2016).

Assumptions, Limitations, and Delimitations

Assumptions

Assumptions in research refer to basic perceptions that are seemingly

true but difficult to substantiate (Nkwake & Morrow, 2016). This study

consisted of three fundamental assumptions. The first was that the qualitative

method was an appropriate method to explore the factors related to this

study. The second assumption was that the respondents would be

trustworthy and would provide honest responses. The third assumption was

that bank managers in this study were appropriate for exploring themes

involving inherent risk in retail loan portfolios.

Limitations

Limitations refer to study weaknesses beyond a researcher’s control

(Yin, 2017). The first limitation was scheduling interviews at a time that is

convenient for participants yet maintaining timely data collection. The

second limitation was the study findings might not be generalizable to other

banks outside of the specific geographic location of the study. The third

limitation was bank managers might misrepresent or present biased

responses in order to influence the study findings.

Delimitations

Delimitations are specific choices and boundaries of the study made

by the researcher (Fan, 2016). One delimitation to this case study was the

size of the sample population. I focused on the banking sector because bank

managers face increase inherent risk in the retail loan portfolios. Another

delimitation was the location. The participants for the study were selected

from one geographical area: San Antonio, Texas. Thus the result may not

reflect the banking industry worldwide. The exclusion of managers of

medium and large banks in the rest of the country could diminish the validity

and reliability of the findings

Significance of the Study

Contribution to Business Practice

Findings from the study might be of value to business leaders by

gaining new insights regarding managing inherent risks in retail loan

portfolios. Effective management of inherent risks is a valuable long-term

growth strategy (Ferro de Guimarães et al.,

2017). The findings of this study might improve business practice by

equipping bank managers with relevant strategies to mitigate inherent risk in

managing retail loan portfolios.

Implications for Social Change

Banks customers could benefit from the results of this study by

accessing loans with a lower probability of default. A lower default rate in

individual bank loans will increase the credit scores and further increase the

propensity to access more credit to boost the day-to-day standard of living of

individuals in the community. The results of this study could have

significant effects on local community residents by increasing access to

credit to build local businesses and better their communities.

A Review of the Professional and Academic Literature

A literature review is critical in a research process as researchers can

identify, evaluate, and synthesize existing literature that relates to the

research topic (Shaikh & Karjaluoto, 2015). The literature review provides

an overview of existing knowledge on the phenomenon of a study (Boell &

Cecez-Kecmanovic, 2015). Researchers conduct literature reviews to

generate new ideas related to the phenomenon of the study (Ishak & Osman,

2016). The purpose of this qualitative multiple case study was to explore

strategies bank managers use to mitigate the level of inherent risk in their

retail loan portfolios. The central research question for the study was what

strategies do some bank managers use to mitigate the level of inherent risk in

their retail loan portfolios? To answer the research questions and find the

potential solutions to the problem, I explored the literature relating to the

established framework and the topic.

In this literature review, I identified professional and academic

literature on banks’ success and related topics other researchers have

explored. A comprehensive exploration of the research question may be

useful in providing additional information for bank managers to mitigate the

level of risk in the retail loan portfolio. The literature review content in this

study was a comprehensive, critical analysis and synthesis of the literature

related to the conceptual framework of ERM. The findings of this study may

provide bank managers with information on how to develop and implement

strategies that reduce the level of inherent risk in retail loan portfolios.

Some of the databases and library materials I used to search the

literature of this study included ProQuest Central, Accounting, Tax &

Banking Collection, Dissertations & Theses at Walden University,

ABI/INFORM Collection, Emerald Management Journals, and Walden

University Library databases like EBSCOhost and ProQuest. Other sources

of literature for this study included Business Source Complete, Academic

Search Complete, ScienceDirect, Thoreau Multi-Database Search, and

SAGE Journal.

Torraco (2016) suggested that researchers should begin the search for

literature by listing keywords. The keywords I utilized to narrow online

search included banking, retail loan portfolio, risk, inherent risk, enterprise

risk management, internal control, risk management, risk assessment, risk

appetite, residual risk, risk culture, silo (traditional), and risk management.

Using these keywords, I found 279 relevant sources to use in this study,

primarily consisting of peer-reviewed articles published since 2017 (see

ERM Framework

Risk is the possibility of loss or exposure to loss, a hazard, an

uncertainty, or an opportunity (Rae et al., 2017). Bessis (2015) argued that

risk is ultimately a multilayered concept indicating that there is a great deal

at stake for entities. Sadgrove (2016) measured risk on two scales:

possibility and likelihood. Possibility refers to the intensity or magnitude of

loss or damage, whereas likelihood is the frequency of loss, damage, or a

missed opportunity. Thus, a risk might be an opportunity or a threat. The

management of risk and reward is challenging, as evidenced by the 2008-

2009 economic crisis and its related uncertainty (Graham & Kaye, 2015).

Risk management has been widely debated as institutions and entities

adopt strategic risk management. In recent times, there have been significant

changes in how risk is managed on an entity level. Previously, risk

management was in silos, where different entity units handled risk

independently (Bogodistov & Wohlgemuth, 2017).

Bessis (2015) argued that risks are interconnected and must be managed

accordingly.

Consequently, Lam (2016) argued that most failures associated with poor

risk management could often be attributed to a convergence of multiple

factors. There is not one correct approach for managing risk, but there

appears to be some consensus about the need for the institutionalization of

enterprise-wide risk management (Kamalahmadi &

Parast, 2016). Hence, risk management is emerging as a priority for most

organizations (Hopkin, 2017). The underlying premise of ERM is that every

entity exists to provide value for the stakeholder (Stulz, 2015).

ERM is a process affected by the organization’s board of directors,

management, and other personnel (Wu et al., 2015). The ERM process

applies in strategy settings across the entire organization (Wu et al., 2015).

ERM is designed to identify potential circumstances that may affect the

organization and manage risk within its risk appetite to provide reasonable

assurance regarding the achievement of objectives (Wu et al., 2015).

Baharuddin and Yusof (2018) stated ERM was born out of the realization

that banks are operating in a dynamic environment that is characterized by

constant, complex, and rapid changes; thus, it requires a more

comprehensive and integrated approach to risk management. ERM has

emerged as a best practice technique for many banks to mitigate risk and

enhance control vigorously since the 2009 financial crisis (Dorsey, 2015).

Based on information gathered from literature, other authors define ERM as

a rigorous and coordinated approach to assessing and responding to all risks

that affect the achievement of an organization’s strategic and financial

objectives (Lam, 2016). Dorsey (2015) described ERM as a discipline by

which enterprises monitor, analyze and control risk across the enterprise,

with the objective of identifying underlying correlation and optimize the

risk-taking behavior in a portfolio context.

ERM was born out of the rationalization that banks are operating in a

dynamic environment that is characterized by constant, complex, and rapid

changes and requires a more integrated approach to risk management (Grace

et al., 2015). According to Hoyt and Liebenberg (2015), ERM is a process

that takes a holistic view of risk management. Graham and Kaye (2015)

described ERM as a discipline by which enterprises monitor, analyze, and

control risks across the enterprise, with the goal of identifying underlying

correlation and further optimize the risk-taking attitude in a portfolio. Berry‐

Stölzle and Xu (2018) suggested ERM is a process that manages all risks in

an integrated, holistic manner by controlling and coordinating any offsetting

risk across the entity.

COSO's ERM integrated framework is an example of a comprehensive

framework that applies ERM in a strategic setting (Lam, 2016). Starting at

the top and supporting the organization’s mission is what differentiates

COSO from other risk frameworks (Berry‐Stölzle & Xu, 2018). According

to Prewett and Terry (2018), the ERM integrated framework describes the

connection between objectives (what the organization strives to achieve) and

the ERM components (what is needed to achieve objectives).

The ERM framework is one of the most widely recognized and

applied risk management publications and tools worldwide. The ERM

framework outlines how senior managers and executives can have greater

confidence in addressing many critical 21stcentury business challenges as

they navigate evolving markets, segments, rapid technological change, and

heightened regulatory and compliance focus (Lam, 2016). Minotra and

Burns (2016) suggested the ERM framework can turn preventative,

processbased risk monologue into a proactive, opportunistic-focused

conversation to uncover how risk management can create, preserve, and

realize quality and value.

Every business decision involves an element of risk (Wolke, 2017).

There are risks involved in making investments, hedging with derivatives, or

extending credit to retail customers or business entities (Gatzert & Martin,

2015). Over time, business decisions and risks collectively build up into

entities entire risk portfolio that constitutes the entities risk profile (Graham

& Kaye, 2015). With such a complex, interlocking system of entity-wide

risks, it is obvious that a silo-based risk management strategy is inferior to

the integrated framework of ERM (Prewett & Terry, 2018). ERM provides

integrated analyzes, integrated strategies, and integrated reporting regarding

an entity’s key risk, which addresses entities' interdependence and aggregate

exposures (Prewett & Terry, 2018). Regulators, rating agencies, business

executives, and academics have advocated an innovative approach to risk

management (Wolke, 2017). ERM proposes the integrated management of

all risks an organization faces, which inherently requires alignment of risk

management with corporate governance strategies (Bromiley et al.,

2015).

Historical Development of the ERM Framework

Since the 20th century, insurance is the primary way companies have

managed risk (Wu et al., 2015). In the 1970s and 1980s, entity managers

started to introduce quality assurance to ensure that products conformed to

their specifications (Wu et al., 2015). The ISO 9000 standards epitomize

adherence to compliance (Sadgrove, 2016). In 1995, the concept of risk

management evolved with the publication of the Australian risk management

standard AS/NZS 4360 (Sadgrove, 2016). According to Diwan et al. (2018),

ERM relates to and originates from the portfolio theory proposed by

Markowitz (1952). The goal of this theory is to minimize the overall impact

of risk through a holistic management approach (Diwan et al., 2018).

The concept of ERM was developed in the mid-1990s (Wu et al.,

2015). Risk management begins with finance, focusing on the ways to avoid

bankruptcy in dynamic environments. The field of risk management grew

with the deregulation of financial institutions, as well as issues with some

public traded companies. There exist multiple risk management frameworks,

including that of the COSO 2004. COSO is the leading accounting standards

organization in the United States. In 2004, COSO published ERM integrated

framework. ERM is a systematic, integrated approach to managing all risks

facing an entity (Gatzert & Martin, 2015). The framework allows managers

to identify, evaluate, and manage significant corporate risk from a holistic

perspective (Renn, 2017). The ERM framework was undoubtedly

encouraged by traumatic events like the 9/11 and business scandals like

Enron and WorldCom. ERM is applied in a strategic setting and across the

enterprise, and it is designed to manage risk within the entity’s risk appetite

(Graham & Kaye, 2015).

The development of an ERM program enables companies to manage

risk in a holistic manner as opposed to the silo-based perspective in

traditional risk management frameworks (Gatzert & Martin, 2015). Every

business faces parallel challenges of growing earnings and managing risks.

A striving organization needs to identify and meet customer needs with

quality services and products, recruits and retain talents, and correctly make

smart and proactive business and investment decisions that will profit

generation in the future (Lam, 2016). Therefore, the pursuit of new profit-

generating opportunities means the business must take on a variety of risks

(Lam, 2016). For the purpose of this study, it is necessary to restate that

ERM is not a theory rather a framework.

ERM Application

All entities face uncertainty, and the challenge for management is to

determine how much uncertainty to accept as it strives to improve

stakeholder value (Wu et al., 2015). Banks face a wide variety of risks that

can have an enormous impact on the outcome of their operations (De

Simone et al., 2015). The risk management process and application are well

established, although presented in a number of different standards, ways,

guides, publications, and terminologies. ERM enables management to

effectively deal with uncertainty and associated risk and opportunity,

enhancing the capacity to build value (Renn, 2017). However, the risk

management framework cannot take place in isolation (Lam, 2016). The

framework needs to be supported by other frameworks within the

organization (Frazer, 2015). Several risk management standards exist

worldwide, including the Institute of Risk Management (IRM) Standard,

British Standard 311100. There is also the American COSO ERM

framework (Renn, 2017). The well-respected and established Australian

Standard AS 4360 was withdrawn and replaced by ISO 31000.

The ISO 31000 Standard includes many features that mirror the AS 4360

Standard.

Wolke (2017) described ERM as a new paradigm for dealing with

organizational risk that allows policy makers to focus on ways to improve

corporate governance and general risk management. Global initiatives on

internal control, corporate governance, and risk management have driven the

use of ERM (King, 2016). Consolidated risk management allows entities to

overcome limitations associated with traditional silo-based risk management

practices (Wolke, 2017). Although the extant literature suggests that ERM

deployment leads to value creation, the systematic studies failed to

specifically indicate the components that lead to value creation (Pierce &

Goldstein, 2018).

ERM provides a methodology for managing the entire range of risks

and is the measurement and qualification of risk, as well as establishing

individual risk ownership (Prewett & Terry, 2018). Managers use the ERM

framework to ensure that all risks facing the organization are identified,

analyzed, and quantified (Wolke, 2017). Farrell and Gallagher (2015)

defined ERM as a discipline by which entities monitor, analyze, and control

risks across the enterprise, with the goal of identifying underlying

correlations and thus optimizing the risk-taking behavior in a portfolio. In

literature, ERM is synonymous with integrated risk management, holistic

risk management, enterprise-wide risk management, corporate risk

management, and strategic risk management (Graham, 2015). Moreover, risk

awareness carries the effects of organizational environment and reporting

processes to risk management effectiveness (Bailey et al., 2017). For the

purpose of this study, I reviewed the COSO ERM framework that is an

example of a comprehensive framework that applies ERM in a strategic

setting.

The COSO ERM Framework

COSO is an independent private sector initiative devoted to assisting

organizations to develop effective internal control, deter fraud, mitigate risk

and improve the performance of organizations (Kimbell, 2017). COSO’s

internal control integrated framework was initially intended to identify the

root cause of the financial failures of the

1980’s’ and develop a control model that reflects those root causes

(McNally, 2015).

COSO is made up of five private sponsoring organizations, namely the

American

Institute of Certified Public Accountants (AICPA), the Institute of Internal

Auditors

(IIA), the American Accounting Association (AAA), the Institute of

Management

Accountants (IMA), and Financial Executives International (Kimbell, 2017).

COSO is applicable to all industries and all types of risk (Graham,

2015). Starting at the top and supporting an organization’s mission is what

differentiates the COSO ERM framework from other risk management

frameworks (McNally, 2015). The connection between business objectives

(what the organization strives to achieve) and the ERM components (what is

needed to achieve the objectives) is the core of the COSO ERM framework

(Lam, 2016). In 1992, COSO published an integrated framework for internal

controls, which constituted five components (Kimbell, 2017). In 2013,

COSO issued a comprehensive update to its original 1992 internal control

integrated framework

(Kimbell, 2017). The COSO framework is the de facto framework utilized

by more than 99% of entities required to comply with the Section 404(b)

internal controls over financial reporting (ICFR) requirement (SOX; Bailey

et al., 2017). Section 404(b) of the

Sarbanes Oxley Act of 2002 requires that the management of public

companies assess the effectiveness of internal control of issuers of financial

reporting (Bailey et al., 2017). Public company auditors must attest to, and

report on, management’s assessment of internal control (Kimbell, 2017;

Setiyawati, 2016).

COSO broadly defines ERM as the culture, capabilities, and practices

integrated with strategy setting and its execution that entities rely on to

manage risk in creating, preserving, and realizing value (Shad et al., 2018).

COSO components of internal control include control environment, risk

assessment, control activities, information and communication systems, and

monitoring (COSO, 2013; Mukhina, 2015). The control environment

component of internal controls within an organization is the tone at the top

with respect to the effectiveness of internal control (Murphy & Free, 2016).

The tone at the top establishes a major influence on ethical business

practices (Patelli & Pedrini,

2015). The control environment component consists of (a) the organizational

structure, (b) authority and responsibility assignment, (c) the integrity and

ethical values, (d) human resources policies and procedures, (e) the financial

reporting competencies, (f) management’s philosophy and operating style,

and (g) the board of directors’ oversight (COSO, 2013; Rubino et al., 2017).

Dimitrijevic (2015) stressed the importance of a control environment in

businesses to help mitigate the risk of employees committing fraud.

The COSO published internal control, and integrated framework was a

major influence on the evolution of the internal audit and risk management

(Bogodistov &

Wohlgemuth, 2017). During the strategic planning process, an organization’s

management sets strategic objectives, selects appropriate strategies, and

establishes supporting objectives that cascade throughout the organization

(Murphy & Free, 2016). The COSO framework includes four categories of

organizational objectives. The first category is strategic objectives, which are

those high-level goals that align with the mission of the organization

(Murphy & Free, 2016). Strategic objectives are defined as critical to the

success of corporate strategy (De Simone et al., 2015). For instance, it

achieved a 60% market share over a two-year timeframe. The second

category is operations that relate to the efficiency and effective use of the

organization’s resources, for instance, striving for a less than 5% default rate

on loans issued on an annual basis (Murphy & Free, 2016). Strategic and

operational categories may be subjected to externalities that may be beyond

the control of management. The third category is reporting, which relates to

the reliability of the organization's internal and external reporting (Murphy

& Free, 2016). Internal reporting is critical to ensure the key indicators are

measured and monitored to enable managers to take action when necessary

(De Simone et al., 2015). External reporting is important to make sure the

organization meets the needs of its stakeholders (Bogodistov &

Wohlgemuth, 2017). For instance, the continuous flow of cash to meet

strategic objectives. The fourth category is compliance objectives that

conform to all applicable laws and regulations (De Simone et al., 2015).

For instance, compliance with the Sarbanes Oxley Act for public traded

companies.

Organizations' achievement of reporting and compliance objectives

are generally within the organizations' control (De Simone et al., 2015). This

is not always the case with strategic and operational objectives (De Simone

et al., 2015). ERM framework assists in providing reasonable assurance that

management, and the board in its oversight role, are made aware in a

reasonable time frame of the extent to which the entity is moving towards

achieving its objectives (De Simone et al., 2015).

In September 2017, the COSO board released an update to the 2004

ERM Integrated Framework. The framework is widely used by management

to enhance an entity’s ability to manage uncertainty and consider the level of

risk to accept as management strives to increase value (Tomas et al., 2017).

The initiative enhanced the framework’s content and relevance in an

increasingly complex business environment for entities to attain better value

from ERM (Rubino et al., 2017). The COSO internal control integrated

framework expands from five components of internal control to eight

components of ERM (Lundqvist, 2014). The components include

•Internal environment. This is the control environment with the

additional concept of risk management philosophy and risk

appetite, integrity, ethical values, and the environment in which the

entity operates (Rubino et al., 2017). This component forms the

basis for which risk and controls are understood and dealt with by

the entity’s personnel. The internal environment sets the

foundation for how risk is viewed (Tomas et al., 2017).

•Objective setting. Objectives must exist before management can

identify potential events affecting their results (Berry‐Stölzle &

Xu, 2018). ERM ensures management has put in place a process to

set objectives, and the chosen objectives support aligning with the

entity’s mission, vision, objectives and are consistent with the risk

appetite (Lundqvist, 2014).

•Event identification. Internal and external events affecting the

achievement of an entity’s objectives must be identified,

distinguished between risks and opportunities (Lundqvist, 2014).

•Risk assessment. Risks are assessed per their likelihood and impact

on both an inherent and residual basis (Berry‐Stölzle & Xu, 2018).

Risks are analyzed, considering likelihood and impact, as a basis

for determining how they should be managed (Lundqvist, 2014).

Risk assessments require proper identification, measurement,

analysis, and documentation of significant business activities,

associated risks, and existing risks (Berry‐Stölzle & Xu, 2018).

Financial risk assessment focuses on identifying control

weaknesses and material errors in financial statements such as

incomplete, inaccurate, or unauthorized transactions (Rubino et al.,

2017).

•Risk response. Risk response techniques include avoidance,

reducing, accepting, and sharing the risk (Rubino et al., 2017). The

risk response techniques should align with residual risk, risk

tolerance, and the entity’s risk appetite (Murphy & Free, 2016)

•Control activities. Policies and procedures must be established and

implemented to ensure that risk management actions are

effectively carried out (Murphy & Free, 2016). Preventive controls

are designed to deter the occurrence of undesirable events, while

detective control is designed to identify operational weaknesses

and help effect corrective actions (Tomas et al., 2017).

•Information and communication. Relevant information is

identified, captured, and communicated in a timeframe and form

that enable users of the information to make informed decisions

(Anderson, 2017). Effective communication occurs when

information flows horizontally and vertically across the entity

(COSO, 2013; Rubino et al., 2017).

•Monitoring. Ongoing monitoring is essential for the entity to

proactively reach change (Berry‐Stölzle & Xu, 2018). A separate

evaluation is necessary to provide assurance the ongoing

management activities are well designed and operate effectively

(COSO, 2013; Rubino et al., 2017).

Graham (2015) asserted that the implementation of ERM is driven by

the combination of internal and external factors (Graham, 2015). This

framework enables entities to effectively and efficiently develop systems of

internal controls that adapt to evolving business and operating environments,

mitigate risk to an acceptable level while supporting sound decision making

and governance to the entity (COSO, 2013; Rubino et al., 2017).

In September 2017, the COSO board collaborated with

PriceWaterhouseCoopers and released an update to the 2004 ERM integrated

framework. Rubino et al. (2017) asserted that the new COSO ERM

framework is the first authoritative framework to focus and provide some

guidance on the vital role of risk management in long-term value creation

and preservation. COSO is one of the most widely recognized and applied

risk management frameworks worldwide (COSO, 2013). This initiative

enhanced the framework’s content and relevance in the increasing business

environment so that entities can better attain value from a holistic and

enterprise-wide approach (Anderson, 2017). The update further highlights

the importance of ERM in strategic planning. The update emphasizes

embedded ERM throughout the entity, as risk influences strategy and

performance (Banerjee, 2016). Challenges and evolving expectations faced

by business leaders and board members require an understanding of

economic markets, evolving technologies, and changing demographics

(Anderson, 2017).

The new ERM - integrating with strategy and performance clarifies

the relevance of ERM strategic planning (Anderson, 2017). ERM is

embedded throughout the entire entity since risk influences and aligns

strategy and performance across all departments and functions (Berry‐

Stölzle & Xu, 2018). The 2017 updated COSO ERM framework consists of

five interrelated components. The components include:

•Governance and culture. Governance sets the entity’s tone and

establishes oversight responsibilities for ERM (Anderson, 2017).

Culture pertains to ethical values, desired behaviors, and the

understanding of risk in the organization (COSO, 2017).

•Strategy and objective setting. Objective setting, strategy, and

ERM work together in the strategic planning process (Berry‐

Stölzle & Xu, 2018). A risk appetite is establishing and aligned

with strategy while business objectives put the strategy into

practice that serves as a basis for identifying, assessing, and

responding to risk. (COSO, 2017)

•Performance. The board and management need to identify and

assess risks that may impact the achievement of strategy and

business objectives (BerryStölzle & Xu, 2018). Risks are

prioritized by severity in the context of risk appetite (Jing et al.,

2017). The entity manager and the board then select risk responses

and take a portfolio view of the amount of risk at stake (Jing et al.,

2017). The results of this analysis are shared with key risk

stakeholders

(COSO, 2017).

•Review and revision. Risk officers and stakeholders review entity

performance and ascertain how well the ERM components are

functioning, the substantial changes identified, and what revisions

are needed (COSO, 2017).

•Information, communication, and reporting. ERM mandates a

continuous process of obtaining and sharing necessary information

from both external and internal sources, which flows horizontally

and vertically (COSO, 2017).

The five components in the 2017 updated framework are supported by a

set of principles. These principles cover a wide range of items from

governance to monitoring (Berry‐Stölzle & Xu, 2018). These principles are

manageable in size and describe practices practitioners can apply in different

entities regardless of the size, type, or sector (COSO, 2017). Adhering to

these principles can provide bank managers and the board with the

reasonable expectation that the entity understands and strives to manage the

risks associated with its strategy and business objectives (COSO, 2017). The

20 governing principles are subdivided into five categories:

•Governance and culture. The governance and culture category

comprises of the following principles: exercise board risk oversight

establishes the organizational structure, defines desired culture,

demonstrate the commitment

to core values, and attract, develop, and retain capable individuals

(COSO, 2017).

•Strategy and objective setting. The strategy and objective setting

category comprise the following principles: analyses business

context, defines risk appetite, evaluate alternative strategies, and

formulate business objectives

(COSO, 2017).

•Performance. The performance category comprises of the

following principles: identifies risk, assesses the severity of the

risk, prioritizes risk, implement risk responses, and develop

portfolio view (COSO, 2017).

•Review and revision. The review and revision category comprises

the following principles: assess substantial change, reviews risk

performance, and pursues improvement in the ERM (COSO,

2017).

•Information, communication, and reporting. The information,

communication, and reporting category comprise the following

principles: leveraging information and technology, communicates

risk information, and report risk, culture, and performance (COSO,

2017).

Academia and scholars have no doubt that entities will continue to

face a future of volatility, complexity, and ambiguity (Murphy & Free,

2016). However, ERM will be an important part of how bank managers

make decisions in the future. Lundqvist and Vilhelmson (2018) suggested

that regardless of the type and size of the entity, strategies need to stay true

to the mission. The updated framework clarifies that ERM is not an isolated

activity (Berry‐Stölzle & Xu, 2018). An effective ERM process should

leverage the processes, functions, departments, and committees that already

manage risk (Lam, 2016). Ewers (2017) asserted that by instilling a culture

of risk awareness and transparency, organizations could create an

environment where everyone takes the role of a risk manager. An ERM

process enables entities to benefit from an integrated approach to risk

management as it looks at portfolio diversification (Lam, 2016). Although

the enterprise-wide risk management framework does not eliminate risk, it

enhances the maximization of the entity’s value (Jing et al., 2017).

The ERM Framework and Competitive Advantage

Banks can gain a competitive advantage only when they implement

strategies that create value, making it challenging for potential or current

competitors to imitate (Graham & Kaye, 2015). Managing risk from an

integrated perspective can help banks to achieve their objectives and attain

competitive advantage (Lam, 2016). Ewers (2017) asserted that the

management of inherent risk is vital towards achieving organizational goals

and competitive advantage. An entity’s potential or current competitors must

be unable to replicate the benefits of the company’s strategy to attain and

sustain a competitive advantage (Barney, 1991). The concept that firms have

different strengths and weaknesses lies in their access to and control of

strategic resources and the development of critical skills (Douglas, 2016).

When banks’ resources are economically valuable, relatively rare, difficult to

imitate, and imperfectly mobile, bank managers can explain the differences

in an entity’s performance (Douglas, 2016). Firms can attain a competitive

advantage through social capital, organizational process, and innovation

(Koroteeva et al., 2016). Firms can create agility, adaptability, and alignment

as distinct business strategies to gain sustainable competitive advantage

(Dubey et al., 2018). With such a complex, interlocking system of company-

wide risk, it is obvious that a silo-based risk management strategy is inferior

to the integrated and holistic framework of ERM (Lam, 2016). According to

Murphy and Free (2016), the level of strategic risk management

implementation in an entity is based on several contingent variables such as

board independence, firm size, ownership structure, growth rate, effective

communication, organization risk culture, regulation, and industry type.

Ewers (2017) asserted that for a risk management system to be effective, it

must be able to coordinate the various sectors responsible for risk.

According to the ERM framework, ERM is endemic in that it

considers all major risks facing an entity and an inherent part of corporate

strategy (Wu et al., 2015). Brustbauer (2016) noted that enterprise risk could

include a variety of factors with potential impact on banks' activities,

processes, and resources. The risk continues to evolve as the public changes

its views on products and services over time. Bailey et al. (2017) asserted

that a systematic approach to risk management could lead to more rational

organizational management and competitive advantage. King (2016) noted

that ERM seeks to provide means to recognize and mitigate risk and provide

the tools to address those risks. Epstein (2018) suggested that one of the

most critical factors for ERM is the integration of risk management into

business processes. ERM provides integrated analyses, integrated strategies,

and integrated reporting pertaining to the entity’s key risk, which addresses

their interdependencies and aggregate exposures

(Gatzert & Martin, 2015). According to Douglas (2016), profit maximization

entities should consider implementing ERM programs to mitigate risk and

boost competitive advantage. The applied conceptualization of ERM may

help entities adjust to changing environments to gain strategic advantage,

thus increase competitiveness and business success (Abu Hussain & Al-

Ajmi, 2017). Frazer (2016) noted ERM is the discipline by which entities

monitor, analyze, and control risks from across the organization, with the

objective of identifying underlying correlation and thus optimize the risk-

taking behavior in a portfolio context. Therefore, entities that have

successfully integrated the ERM process into both the strategic and everyday

activities display a superior ability to uncover risk dependencies and

consequently enhance value (Farrell & Gallagher, 2015).

Recommendation for Using the ERM Application

ERM incorporates a comprehensive approach to risk management,

aligning with the entity’s strategy, objectives, and mission while involving

employees at all levels of the entity (Graham, 2015). Pett et al. (2015)

argued that risk has holistic effects, creating the need for comprehensive

management. This strategic application of dealing with risk identifies and

assesses risks faced by entities and examines potential control mechanisms

(Hopkin, 2018). ERM involves a broader perspective that considers several

types of risk associated with the entity’s objectives.

The ERM framework provides a better understanding of risk appetite

and tolerance (Annamalah et al., 2018). However, more clarification is

needed on the updated framework. For instance, many entities have

struggled to find a mechanism to express risk appetite and tolerance

(Anderson, 2017). Other entities have developed a slightly more granular

risk appetite methodology (Brustbauer, 2016). However, very few entities

have succeeded at identifying helpful appetite and tolerance statements

(Cohen & Falcione, 2016). The new ERM update framework is a step in the

right direction that will facilitate good debates in the future.

The framework also focuses on strategy within the context of the

entity’s core values, vision, and mission (COSO, 2017). By focusing on the

inherent risk in carrying out strategies and achieving business objectives, an

entity can improve the likelihood of managing and mitigating risks

effectively and efficiently (Lam, 2016). Risk management is an overlay and

additional objective that complements the expected return strategy the entity

chooses (Wisutteewong & Rompho, 2015). While the framework does not

translate to strategic risk, it can provide a mechanism to evaluate strategic

options (Anderson, 2017). Risk management is all about strategy and

performance (COSO, 2017). Risk management is an integral component in

formulating better decisions (Anderson, 2017). According to Wisutteewong

and Rompho (2015), successful entities that use the ERM framework

practice the five categories and 20 categories of the strategy-focused entity

to accomplish strategic focus and alignment.

Value is also a major point of focus with the new framework. Each

entity defines value differently; however, an entity’s purpose is to provide

value to stakeholders (Hopkin, 2018). When making decisions, as part of a

risk-aware culture and opportunities are filtered through the optimized risk

management process, the entity’s performance likely trend positively (Dubey

et al., 2018). Managers assert that the most important aspect of the updated

ERM framework provides a means to assess an entity’s risk practices (Rae et

al., 2017). Jing et al. (2017) assessed the ERM maturity level by using risk

management principles. For entities to benefit from this framework, they

need to be at the maturity level, which helps facilitate a tailored assessment

that factors in the culture and complexity of the entity (Dubey et al., 2018).

The use of an ERM framework increases risk awareness and

eventually increases knowledge that leads to sound decision-making (Ogutu

et al., 2018). Bogodistov and Wohlgemuth (2017) argued that without a

holistic ERM, entities could have a higher acceptable risk level compared to

an entity with a mature enterprise-wide risk management framework where

risk is better mitigated. Whereas traditional risk management techniques

limit earnings volatility when compared to the enterprise-wide risk

management framework help reduce volatility by preventing the aggregate

of risk (Hopkin, 2017). In addition, technological advancements in computer

software and increasing sophisticated statistics and economic analytical

models have made the ERM framework more viable and robust (Setiyawati,

2016).

Limitations of the ERM Framework

Although the ERM framework provides assurances to stakeholders

that inclusive goal achievement would be at minimal risk, it has limitations

(Dubey et al., 2018). The ERM framework implemented by entities in the

past has not done well to focus on strategic value creation objectives (Lam,

2016). However, the growing empirical research on ERM is not without

limitation. Sadgrove (2016) argues that the issue of endogeneity and other

related issues, especially of methodology, make it challenging to draw

general conclusions about ERM effectiveness. Lam (2016) also argued that

even though prominent framework claims to represent “best practices,” there

appeared to be no theoretical or empirical evidence about such claim. In

addition, despite the extensive literature on ERM, practitioners have not

adequately addressed inter-firm differences in enterprise-wide risk

management.

Lundqvist (2014) observed that ERM has no defined process that

assures total management of risk or focuses on the sensational and obvious

risk while ignoring the routine. Sadgrove (2016) explained the goal of ERM

is to address risk in all areas of the companies. Murphy and Free (2016)

argued ERM is subject to interpretations and turns to be elusive rather than

descriptive. In addition, Graham (2015) stated ERM is reactive as opposed to

proactive. Graham further stated ERM framework does not take into

consideration the cost of mitigation. Therefore, management understands the

severity and likelihood with no assessment of mitigation cost. If mitigation

cost is assigned to risk assessment decisions, stakeholders will make a better

and informed decision based on the cost-benefit analysis (Graham, 2015).

ERM is a system addressed, developed, and implemented by individuals,

and the human resource system drives its success (COSO, 2017). Factors

causing technical system failures, such as misguided cultural assumptions

and values, fiscal pressures, errors, injudicious agentic decisions, and control

failure, can cause an ERM system to fail (Agarwal & Ansell, 2016).

Alternative Theories

The founding members of the COSO framework are dedicated to

providing thought leadership through the development of a comprehensive

framework and guidance on internal control, ISO 31,000, and fraud

deterrence designed to improve board oversight and entity overall

performance (Graham, 2015). Alternative business theories and frameworks

to the COSO ERM framework include; the general system theory, fraud

triangle model, and portfolio theory. These models and theories encompass

various means managers utilize to achieve organizational goals (Länsiluoto

et al., 2016).

The General System Theory von Bertalanffy introduced the general

systems theory by establishing that a system is an entity and coherently

whole (Hughes et al., 2015). According to Keynes (2018), the general

system theory is a logical-mathematical discipline applicable to all sciences

concerned with systems. von Bertalanffy (1972) noted that entities could use

the system thinking concept to understand how the different components of a

system interact and affect one another (Tittle, 2018). From the systems

theory perspective, an entity can achieve its objectives when all key tasks

form a whole system (Fang et al., 2015). Systems exist when interdependent,

but related components are achieving a valued preset objective (Hughes et

al., 2015). General systems theorists argued that an entity is a whole system

that consists of interrelated and interdependent activities (Keynes, 2018).

These activities consist of processes and techniques for investigating and

improving the entire system (Hughes et al., 2015). The performance of one

task in an entity has a direct effect on the other components (Millar & Porter,

1985).

Systems thinking provide a deeper understanding of how a dynamic

and complex system behavior contributes to firm success (Tittle, 2018).

Systems theory focuses on the interrelationships, influences, and dynamics

of business activities and how they affect the firm in achieving its objectives

and attain sustainable performance (Brown & Ulgiati, 2018). Critical

components, interdependency, relationships, and objectives represent

fundamental elements of systems theory. The key components of a firm

include its activities, which comprise a system that is critical for the firm to

operate and contributes to achieving the overall objectives (Hughes et al.,

2015). An entity’s systems and processes consist of the end-to-end

sequencing of activities required to acquire and transform resources into

products, services, and solutions that are of value to customers (Paucar-

Caceres et al., 2016). The activities are related, and their relationships affect

firm performance (Hughes et al., 2015). By observing a phenomenon with a

holistic perspective, firm managers and owners can understand and improve

firm performance and achieve sustained competitive advantage (Fang et al.,

2015).

According to the general system theory, a firm is a system that

consists of parts that are interdependent and connected (Tittle, 2018). The

activities of the firm are interconnected, and the effect in one part of a chain

can affect performance in other parts. Therefore, the performance of one

activity directly affects the cost and effectiveness of the others (Millar &

Porter, 1985). The entity’s systems and processes comprise activities

necessary to acquire and transform resources into assets that will return

value to the firm. Through these systems and processes, entities can

accumulate and leverage tangible and intangible resources that result in

value creation (Peace et al., 2018).

Bank managers can understand the relationships between different

parts of a system and how the components depend on one another as a

whole, rather than looking at one key component (von Bertalanffy, 1972).

Business owners and managers can use systems thinking to broaden

sustainability initiatives beyond optimizing efficiency by focusing on

strategy rather than tactics (Waller et al., 2015). Using systems thinking

approach, bank managers can understand how the different activities of a

bank interact and how each department affects or is affected by other

departments (Turner & Endres, 2017). Considering that bank activities are

complex and influenced by various factors, bank managers can use systems

thinking to analyze firm performance (Fang et al., 2015). Bank managers can

use systems thinking to establish accountability in bank activities, ensure fair

treatment of stakeholders, and create a sustainable impact on communities

(Tittle, 2018).

Bank managers and senior executives can use the systems thinking

approach to resolve organizational problems by establishing that the

activities of the bank are linked and interconnected (Tittle, 2018). Bank

managers can view a bank as a system comprising of different components

that are intertwined (Turner & Endres, 2017). The components include

customers, suppliers, economy, technology, cultural, physical, and the legal

environment (Więcek-Janka et al., 2016). Bank managers should view their

organizations as mental constructs to enable them to conceptualize, learn,

and improve problematic situations (Paucar-Caceres et al., 2016). Entities

can achieve their goals when all activities contribute and operate efficiently.

However, the failure of one key component may threaten or reduce firm

performance (Hughes et al., 2015). From the systems thinking perspective,

firms can attain sustainable growth, minimize risk, and performance by

understanding the relationship and interaction between the economic, social,

and environmental factors (Grayson & Hodges, 2017; Pollanen et al., 2016).

These activities work together, influence each other, and have a positive

interaction (Fang et al., 2015).

The Fraud Triangle

In the 1950s, an American criminologist, Donald R. Cressey,

developed the fraud triangle framework to illustrate the components that

cause an individual to commit fraud (Cressey, 1952). The fraud triangle

framework has evolved over time and is used to understand why employees

commit fraud, how it is detected, and the preventive measure to mitigate the

risk (Free, 2015). Marshall and Cali (2016) suggested that components of

fraud triangle theory are dynamic and could be taken into consideration

when determining why individuals commit fraud. Perceived pressure is a

motivating factor to commit fraud (Said et al., 2018); perceived opportunity

paves the path of the fraudster to commit fraud (Norazamina et al., 2018);

and rationalization helps the fraudster justify their action (Lokanan, 2015).

Norazamina et al. (2018) defined three elements that need to be present for

an employee to commit fraud. These elements included (a) non-sharable

financial problems, (b) perceived opportunity, and (c) rationalization.

Bank managers use the fraud triangle framework to understand how

and why bank employees commit fraud (Kramer, 2015). In-depth knowledge

and understanding of the fraud triangle can assist bank managers in fraud

prevention (Kramer, 2015; Lokanan, 2015). Kramer (2015) noted that bank

managers deploy the fraud triangle to address fraud risk elements

proactively. Bank managers with an understanding of the opportunity

component of the fraud triangle are quick to modify and strengthen internal

controls (Glodstein, 2015). Bank managers must ensure strong internal

control when using the fraud triangle as an instrument to detect and prevent

fraud schemes (Lokanan, 2015). To gain insight into the thinking of

individuals and provide training on codes of ethics, bank managers adapted

the fraud triangle methodology (Kramer, 2015; Verschoor, 2015).

Understanding the fraud triangle, bank managers maintain a positive work

environment to mitigate fraud occurrence (Kramer, 2015).

While regulators and practitioners utilize and support the fraud

triangle framework in the detection and prevention of fraud, the framework

is not free from limitations (Stone, 2015). Glodstein (2015) noted that every

fraud case is unique; therefore, some critics of the framework believe it has a

narrow interpretation (Murphy & Free, 2016). Other critics noted that the

fraud triangle addresses the motive of fraud from an individual’s perspective

whereas, perceived pressure and rationalization cannot be observed and

controlled by the organization (Mui & Mailley, 2015). Said et al. (2018)

noted that the theory provided inadequate motives on the actions of

individuals capable of committing and concealing fraudulent activities.

The Portfolio Theory

The rationale behind the portfolio theory before turning to ERM is the

argument that portfolio theory and holistic risk management are closely

related. According to Schied et al. (2018), organizational-wide risk

management is related to and originated from the portfolio theory proposed

by Markowitz (1952), as they both suggest that risk should be managed on a

portfolio basis. The goal of this theory is to minimize the overall impact of a

given 21 risk through a holistic management approach (Schied et al., 2018).

Another proposition of this theory is that the expected variance in the returns

of a firm is best minimized by bringing the independent, noninteractive

business units together

(Jarkas & Horner, 2015).

Researchers use the portfolio theory to determine the highest return

for a given level of risk (Madan, 2018). In other words, it enables the

determination and selection of a portfolio with the lowest risk possible

(Hwang & Pedram, 2018). The assumption of the modern portfolio theory

includes the notion that the effect of the overall portfolio risk is less than the

impact of the individual risks (Markowitz, 1952). Consistent with this

observation, Hoyt and Liebenberg (2015) observed that by implementing an

integrated risk management framework, an organization could combine its

various risks into a risk portfolio resulting in increased productivity and

profitability through cost savings. Further developments and improvements

of the portfolio theory include; postmodern portfolio theory, stochastic

portfolio theory, and fuzzy portfolio theory (Hwang &

Pedram, 2018).

Risk in the Financial Markets

Risk is the possibility of an event occurring that will have an impact

on the achievement of objectives and measures in terms of impact and

likelihood (Bilgihan & Wang, 2016). However, estimating likelihood and

impact can be difficult and challenging. Risk begins with strategy

formulation and objective setting (Tittle, 2018). Halliru (2016) suggested

that since no two entities are identical, each entity have unique strategies and

objectives and face different types of risks. Risk does not present a single

point estimate; risk represents a range of possibilities. Without a single

outcome, the range is what creates uncertainty when understanding and

evaluating risks (Campbell & Park, 2017). Risk is inherent in all aspects of

life; risks associated with conducting a form of business are considered a

business risk (Hemrajani & Sharma, 2018). Douglas (2016) asserted that

business risks are uncertainties related to the achievement of business

objectives. An entity has to take some level of risk if it wants to achieve

business objectives (Dubey et al., 2018; Schied et al., 2018). More ambitious

objectives may require that more risk be accepted; however, if the effort is

successful, the reward should also be greater.

Sadgrove (2016) stated that an entity that does not take enough risk

fails by being supposed by the company that does take the necessary risks.

While some risks should be avoided, other risks need to be accepted as a cost

for doing business (Frazer, 2015). An entity’s size, formality, management

team dynamics, industry, regulatory requirements, and other demographics

are just some of the potential influencing factors (Tittle, 2018). Business risk

is the possibility an entity will have lower than anticipated profits or

experience a loss rather than taking a profit (Schied et al., 2018). However,

frameworks for assessing and developing risk-based plans vary from

enterprise to enterprise. Bessis (2015) asserted that entities must develop

their capabilities to respond to and mitigate risks. Developed capabilities are

a strategic strength in highly competitive areas, as well as essential to the

longevity of the entity (Feinstein et al., 2017).

Types of Risk in the Financial Markets

The regulations that emerged from the global financial crisis and the

fines that were levied in its wake triggered a wave of change in risk function

(Sweeting, 2017). The inherent risk in the retail loan liquidity risk portfolio

for banks still exists despite regulations enacted by the Federal Government

post the 2008 financial crisis (Silva et al., 2017). Financial institutions such

as banks own large retail loans and other closed-end loan instruments. Big

banks like Wells Fargo, Citi Bank, and Bank of America underwrite loans or

purchase loan portfolios of other banks; these banks also sell a portion of

their own loan portfolio off to their bank competitors. Customarily, banks

continually assess and reassess the loan quality within their loan portfolio.

Quality can range from interest rate earned, FICO score of customers,

customer payment history, and type of loan (Jian & Zhi, 2018; Laeven et al.,

2016). Risk management in banks has changed substantially. Although

banks share many same risks as other entities and businesses, the major risk

that especially affect banks are liquidity risk, credit default risk, systemic

risk, and operations risk (Cohen et al., 2014).

Liquidity Risk

Khan et al. (2017) defined liquidity risk as the risk stemming from the

lack of marketability of an investment that cannot be bought or sold in due

time to prevent or minimize losses. Bessis (2015) defined liquidity risk as

the risk of not being able to raise cash when needed. Liquidity risk in banks

arises from funding or long-term assets with short-term liabilities, thereby

making the liabilities subject to rollover or refinancing risk (Waemustafa &

Sukri, 2015). Liquidity risk is closely associated with other dimensions of

the bank's financial structure, such as interest rate, market risk, profitability,

and solvency (Rahman & Banna, 2016). Liquidity risk can be sub-divided

asset and funding liquidity risk. Funding liquidity risk designates the

exposure to loss if an institution is unable to meet its cash requirements,

while asset liquidity risk designates the exposure to loss based upon the

inability to effect a transaction at a current market price due to either relative

position size (Ippolito et al., 2016). The failure or inefficiency of liquidity

management might be as a result of the strength of liquidity pressure, the

preparation of the financial institution liquidity instrument, the institution

condition at the time of liquidity pressure, and the inability of the institution

to find internal and external liquid sources (Bessis, 2015).

Systemic Risk

Systematic risk, also known as market risk, is the uncertainty inherent

to the entire market or business (Feinstein et al., 2017). This type of risk is

both unpredictable and impossible to avoid completely. Over the years,

financial markets and banks exhibited sudden and largely unforeseen

collapses at a systematic scale (Acemoglu et al., 2015). Business managers

cannot mitigate such risk through but rather hedge or utilize appropriate

asset allocation strategy (Feinstein et al., 2017). Laeven et al. (2016) argued

that systematic risk grows with bank size and is inversely related to bank

capital, and this effect exists above and beyond the effect of bank size and

capital. Estimating systematic risk in banks relies on granular data on the

financial network because of hidden business interaction s between banks on

confidentiality issues (Giglio et al., 2016). Laeven et al.

(2016) noted that large banks are riskier or create more systematic risk than

small banks. Freixas et al. (2015) suggested that the approach taken by bank

managers towards identifying systematic risk is to utilize disaggregated data,

including information on the composition of the bank assets and liabilities,

maturity, and currency mismatching, and other balance sheet and income

metrics. While enormous progress has been made in measuring and

mitigating inherent bank risk, further improvements are possible, especially

in the analysis of banks' contribution to systematic risk (Ben Salah Mehdi &

Boujelbene Abbes, 2017).

Credit Default Risk

Paligorova and Santos (2017) defined credit default risk as the

potential of a bank borrower to fail to meet its obligations in accordance with

the agreed terms and conditions. Bessis (2015) defined credit risk as the risk

of losses due to borrowers’ default or deterioration of credit standing. The

sources of credit risk include loans, acceptances, interbank transactions,

financial futures, swaps, bonds, equities, options, and the extension of

commitment and guarantees and the settlement of transactions (Banks,

2016). An entity’s default risk is a forward-looking measure of the entity’s

own probability of default or current and future risk facing its creditors

(Lundqvist & Vilhelmson, 2018). Banks mitigate credit default risk by

screening applicants, require collateral for a loan, perform a credit risk

analysis, and by diversification of risks. Baron and Xiong (2017) noted

banks could substantially reduce credit risk by lending to their customers

since they have much more information about them, thus reduce adverse

selection. Lundqvist and Vilhelmson (2018) argued that ERM should

theoretically reduce the volatility of cash flow, agency risk, and information

risk, thereby ultimately reducing an entity’s default risk. Credit ratings are a

commonly utilized proxy for default credit risk, and multiple credit rating

studies have focused on the quantifiable data, retrospective factors, like

macroeconomic factors and financial ratios, to predict credit ratings

(Cornaggia et al., 2017).

Operational Risk

According to the Bank of International Settlements (BIS), operational

risk is defined as the risk of loss resulting from inadequate or failed internal

controls processes, people, and systems of external factors. Operational risk

is fundamentally different from all other risks taken by banks. Risk is a

consideration in the activities, products, and services of an entity. In contrast

to conventional financial markets, it is difficult to measure and model

operational risk measures. Bessis (2015) argued operational risk includes

malfunctions of the information systems, reporting systems, internal risk

monitoring rules, and procedures designed to take corrective actions in a

timely manner. Due to operational risk management, bank managers can

evaluate the entire enterprise in a holistic manner to create a detailed risk

profile for senior managers and the board to make informed decisions

(DeAngelo & Stulz, 2015).

Operational risks range from compliance, credit risk, information

technology risk, transaction processing, human resource, liquidity, taxation,

and fraud. Saeed and Izzeldin (2016) noted that operational risk governance

would recognize that business line management is responsible for identifying

and managing the inherent risk in products, processes, systems, and

activities. Ames et al. (2015) suggested that bank personnel performing an

internal and independent review on bank operations must be competent and

appropriately trained with segregation from developmental projects,

implementation, and operation of risk framework. To calculated operational

risk capital, banks a required to use four data elements, internal loss data,

external loss data, scenario analysis, business environment savvy, and

internal control factors. Bessis (2015) noted banks should have a strong

control environment that utilizes policies, processes, and systems,

appropriate internal controls, and appropriate risk mitigation and transfer

strategies.

ERM Framework and Retail Loan Portfolio in Banking

In banking, ERM is a comprehensive risk-optimization process that

integrates risk management across the entity (Kimbell, 2017). Lam (2016)

stated that the board of directors ultimately makes the decisions to develop

and implement an ERM framework. The ERM framework often aligns risk

with the strategic objectives of an entity. ERM is not a process to eliminate

risk or to enforce risk limits, rather encourage banks to take a broad look at

all the risk factors, understanding the interrelationships among those factors,

define an acceptable level of risk, and continuous monitoring areas to ensure

that the risk defined threshold is achieved (Tittle, 2018).

Sadgrove (2016) asserted that the enterprise-wide aspect of ERM is

what differentiates it most fundamental from more traditional risk

management techniques. Many entities, including banks, have utilized the

services of internal auditors to perform risk assessments and report their

findings to senior executives and the audit committee (Feinstein et al., 2017).

Douglas (2016) argued that under the internal audit approach, risks are

addressed individually, sometimes without the consideration of strategic

implementation. However, the ERM reduces this sole effect and ensures

ongoing communication with all stakeholders (Halliru, 2016). There exists

no tailored ERM approach; instead, banks can meet their specific needs with

various tailored approaches that consider their complexity, resources, and

expertise (Cram & Gallupe, 2016).

Feinstein et al. (2017) argued that for the board and senior executives to

establish a risk culture to mitigate risk related to retail loan portfolios, they

provide consistent support for the ERM framework throughout the

organization, from all stakeholders. Future objectives are reasonably

achieved without exceeding a predetermined, stated risk tolerance (Banks,

2016).

Laeven et al. (2016) suggested that for each uncertainty related to

retail loan portfolios, a leading indicator is created along with parameters

that would trigger a risk management response. On a risk assessment

strategy, a risk map evolves from manager surveys to determine the priority

of risks (Tittle, 2018). Glodstein (2015) noted that management identifies the

cost and benefits for accepting each risk type prior to implementation. Bank

managers and staff must understand the differences between risk avoidance,

risk reduction, risk-sharing, and risk avoidance to better address the risk.

Top management stays abreast with ERM responsibilities with a robust and

reliable reporting regime. On monitoring, management reports performance

versus establish risk limits to assess effectiveness (Halliru, 2016).

Transition

In Section 1 of this research study, I discussed the problem statement,

purpose statement, nature of the study, conceptual framework, research

question, significance of the study, and the review of the literature. In

Section 2, I restate the purpose statement; review the role of a researcher and

participants. This section also includes an overview of the research method

and design, population and sampling method, and ethical research. The

section also describes the data collection instrument, techniques of data

organization, and data analysis. I finalize Section 2 with the reliability and

validity of the study.

Section 3 includes the research study findings, including applications to

professional practice, implications for social change, recommendations for

further study, and reflection on my experience as a researcher.

Section 2: The Project