Enterprise risk management revisited: a study to identify the elements of ERM

There is a need for organizations to pay more attention to enterprise risk management (ERM) in order to improve their internal control environment and be resilient for the future. To support organizations in doing so, this study effectively revisits and evaluates ERM by identifying the elements of ERM through a quantitative analysis of 420 respondents from organizations across all industries in the Netherlands over a 3-year period (2020–2022). ERM is conceptualized as an integrated and continuous process for holistically managing traditional and strategic risks to support the achievement of the organization's business objectives. Based on both exploratory and confirmatory factor analysis complemented with robustness analyses, our study (1) identifies a robust two-factor model emphasizing both fundamental ERM elements and strategic ERM elements, confirming the evolution suggested by the COSO ERM framework (2017), and (2) presents a focused measurement instrument comprising 36 ERM elements, less extensive yet more focussed than previous models, offering enhanced practical applicability and aligning with strategic objectives to enhance stakeholder value. Our study offers valuable insights into ERM practices, highlighting the evolving nature and growing importance of integrating ERM within organizational strategies, and underscoring the evolution towards a more holistic and strategic approach in managing enterprise risks. Implications for practice suggest that organizations prioritize embedding ERM practices within their strategic planning processes to adapt to the evolving risk landscape, thereby maintaining competitive advantage and promoting sustainable growth, while policy recommendations advocate for guidelines promoting ERM strategies as a means of maintaining competitive advantage. This study provides a foundation for future research into ERM, like factors influencing ERM processes, technological advancements, and longitudinal impacts on organizational resilience.