Enterprise risk management at higher education institutions: How management concepts support its implementation

Higher education institutions are under increased pressure from government agencies, the public, and members of the campus community to manage risks. Traditionally, risk management responsibility has been delegated to individual operating units. This approach lacks an overarching strategy for managing risks and is being supplanted by an approach gaining favor in higher education for strategically managing risks now termed enterprise risk management. As a senior leadership lead initiative, enterprise risk management provides a comprehensive strategy for managing risks. However, since existing models originate from the business sector they lack guidance for implementing the approach in a higher education environment. The focus of this study examines why higher education institutions would adopt an enterprise risk management strategy and how critical success factors influence its implementation. The central thesis of this study is that management concepts drawn from theory can enhance the implementation of enterprise risk management in higher education. To test this thesis, a conceptual framework for enterprise risk management implementation was derived from a review of the theoretical literature on change management, decision making, and organizational learning. A systematic review methodology was employed to test the conceptual framework against findings from 55 research studies. Implications for practice include approaches for adopting enterprise risk management to improve organizational performance, clarifying its purpose, reflecting the culture of the institution in its design, assigning a program champion and cross-functional implementation team, assigning risk assessment methodologies based on the type of risk, and using an enterprise risk management approach to build organizational learning and resiliency. Theoretical implications include exploring how theories on change management, decisions making, and organizational learning can further extend research on this topic.ENTERPRISE RISK MANAGEMENT AT HIGHER EDUCATION INSTITUTIONS: HOW MANAGEMENT CONCEPTS SUPPORT ITS IMPLEMENTATION By Steven Christopher Deck Dissertation submitted to the Faculty of the Graduate School of the University of Maryland University College, in partial fulfillment of the requirements for the degree of Doctor of Management 2015 Advisory Committee: Dr. Thomas J. Mierzwa Dr. Denise A. Breckon ii © Copyright by Steven Christopher Deck 2015 iii iv ABSTRACT Title of Dissertation: ENTERPRISE RISK MANAGEMENT AT HIGHER EDUCATION INSTITUTIONS: HOW MANAGEMENT CONCEPTS SUPPORT ITS IMPLEMENTATION Steven Christopher Deck, Doctor of Management, 2015 Dissertation Directed By: Dr. Thomas J. Mierzwa and Dr. Denise A. Breckon, Doctor of Management Higher education institutions are under increased pressure from government agencies, the public, and members of the campus community to manage risks. Traditionally, risk management responsibility has been delegated to individual operating units. This approach lacks an overarching strategy for managing risks and is being supplanted by an approach gaining favor in higher education for strategically managing risks now termed enterprise risk management. As a senior leadership lead initiative, enterprise risk management provides a comprehensive strategy for managing risks. However, since existing models originate from the business sector they lack guidance for implementing the approach in a higher education environment. The focus of this study examines why higher education institutions would adopt an enterprise risk management strategy and how critical success factors influence its implementation. The central thesis of this study is that management concepts drawn from theory can enhance the implementation of enterprise risk management in higher education. To test this thesis, a conceptual framework for enterprise risk management implementation was derived from v a review of the theoretical literature on change management, decision making, and organizational learning. A systematic review methodology was employed to test the conceptual framework against findings from 55 research studies. Implications for practice include approaches for adopting enterprise risk management to improve organizational performance, clarifying its purpose, reflecting the culture of the institution in its design, assigning a program champion and cross-functional implementation team, assigning risk assessment methodologies based on the type of risk, and using an enterprise risk management approach to build organizational learning and resiliency. Theoretical implications include exploring how theories on change management, decisions making, and organizational learning can further extend research on this topic. Keywords: Change management, decision making, enterprise risk management, organizational learning, sensemaking, systematic review, resiliency, risk, risk management vi Acknowledgements First, I would like to thank my advisory committee, Dr. Thomas Mierzwa and Dr. Denise Breckon, for their guidance during the dissertation journey. Their hard work and commitment to my growth as a scholar enabled me to complete my dissertation and grow intellectually. I would also like to thank the staff at the UMUC doctorate of management program, specifically Marina Caminis, Monica Graham, and Cindy Thomas, for their help on my research and ensuring that my doctoral experience was enjoyable. Last, to my cohort members, thanks for all your insight, support, and encouragement throughout this long and challenging process! I would also like to acknowledge Dr. Roger Ward, Chief Accountability Officer, Vice President for Operations and Planning, and Vice Dean, Graduate School at the University of Maryland Baltimore for encouraging me to pursue my doctoral degree and his continued support throughout the process to achieve my doctorate degree. I would like to thank my two puppies, Jenny and Trixie, who gladly took walks with me as pondered how to proceed with this dissertation. Last, and most importantly, I would like to thank my wife, Bonnie, for her patience and support as I fulfilled the demanding requirements of the doctor of management program. Her tolerance for deferring home improvements until after completing the program is appreciated! vii Table of Contents ABSTRACT .................................................................................................................................. iv Acknowledgements ........................................................................................................................ vi List of Tables ............................................................................................................................... xii List of Figures .............................................................................................................................. xiii Chapter 1: Introduction and Management Problem ...................................................................... 14 Problem Statement ........................................................................................................................ 16 Higher Education Institutions ................................................................................................... 17 Traditional Risk Management................................................................................................... 19 Enterprise Risk Management .................................................................................................... 21 Research Question .................................................................................................................... 25 Study Purpose and Significance ................................................................................................... 26 Scope and Limitations .................................................................................................................. 28 Organization of Dissertation Chapters .......................................................................................... 28 Chapter 2: Literature Review ........................................................................................................ 30 Program Implementation Process ................................................................................................. 30 Enterprise Risk Management ........................................................................................................ 32 Organizational Change.............................................................................................................. 32 Decision Making ....................................................................................................................... 35 Organizational Learning ........................................................................................................... 37 Theoretical Perspectives on ERM Implementation ...................................................................... 38 viii Theories on Organizational Change.......................................................................................... 38 Theories on Decision Making ................................................................................................... 41 Theories on Organizational Learning ....................................................................................... 42 Organizational Risk ...................................................................................................................... 43 Risk Defined ............................................................................................................................. 43 Dimensions of Risk ................................................................................................................... 45 Risk and Opportunity ................................................................................................................ 49 Organizational Change ................................................................................................................. 50 Institutional and Legitimacy Theory ......................................................................................... 51 Organizational Culture .............................................................................................................. 53 Change Management ................................................................................................................ 56 Organizational control. ......................................................................................................... 58 Change management models. ............................................................................................... 59 Organizational Resiliency ......................................................................................................... 62 Decision Making ........................................................................................................................... 64 Decision-Making as an Ongoing, Retrospective, and Social Process ...................................... 67 Decision-Making Bias .............................................................................................................. 69 Decision-Making Framing ........................................................................................................ 71 Organizational Learning ............................................................................................................... 73 Sensemaking-Based Learning ................................................................................................... 75 Team-Based Learning ............................................................................................................... 79 Theses on Enterprise Risk Management Implementation ............................................................ 80 ix Conceptual Framework ................................................................................................................. 83 Summary .................................................................................................................................. 85 Chapter 3: Methodology ............................................................................................................... 88 Research Design ........................................................................................................................... 88 Selection of the Research Methodology ................................................................................... 89 Search Strategy and Eligibility ................................................................................................. 90 Inclusion and exclusion criteria. ........................................................................................... 90 Inclusion of grey literature. ................................................................................................... 91 Quality and Relevance Appraisal.............................................................................................. 92 Data Collection ......................................................................................................................... 94 Synthesis Method ...................................................................................................................... 95 Using the Research ................................................................................................................... 97 Summation of the Research Design .......................................................................................... 98 Considerations from Expert Panel Review ................................................................................... 99 Summary of Results .................................................................................................................... 103 Synthesis of the Results .............................................................................................................. 106 Grey Literature ........................................................................................................................ 106 Factors that Influence the Decision to Adopt ERM ................................................................ 110 Evidence on the financial value of adopting ERM. ............................................................ 111 Evidence on nonfinancial factors influencing ERM adoption. ........................................... 114 Factors Influencing ERM Implementation ............................................................................. 123 Influence of management practices. ................................................................................... 124 x Influence of organizational culture. .................................................................................... 127 Influence of change agent. .................................................................................................. 127 Influence of program design. .............................................................................................. 129 Influence of barriers to implementation. ............................................................................. 130 Influence of decision-making processes. ............................................................................ 133 Influence of organizational learning. .................................................................................. 137 Chapter 4: Analysis of Findings ................................................................................................. 140 Findings on ERM Adoption ........................................................................................................ 140 Findings on ERM Implementation ............................................................................................. 142 Process for Enterprise Risk Management Implementation at Higher Education Institutions .... 145 Factors Influencing Enterprise Risk Management Adoption.................................................. 146 Factors Influencing Enterprise Risk Management Program Setup ......................................... 148 Program champion and implementation team. ................................................................... 149 Program design factors. ...................................................................................................... 150 Risk assessment factors....................................................................................................... 151 Factors Influencing ERM Implementation and Ramp-up ....................................................... 156 Organizational learning factors. .......................................................................................... 158 Factors Influencing ERM Integration ..................................................................................... 160 Summary of Findings .................................................................................................................. 161 Limitations of Interpretations ..................................................................................................... 163 Chapter 5: Conclusions and Implications for Practice and Theory ............................................ 165 xi Study Conclusion ........................................................................................................................ 166 Implications for Management Practice ....................................................................................... 167 Principle 1: Adopt ERM to Improve Performance ................................................................. 168 Principle 2: Clarify the Purpose and Goals of the ERM Program .......................................... 168 Principle 3: Design ERM to Reflect the HEI's Culture and Organizational Routines ............ 169 Principle 4: Select a Program Champion and Implementation Team with the Proper Skills . 170 Principle 5: Use Decision-Making Methodologies Appropriate for the Risk ......................... 171 Principle 6: Stimulate Organizational Learning on Risk ........................................................ 172 Principle 7: Build Organizational Resiliency Capabilities through ERM .............................. 172 Summary Comments on Implications for Management ......................................................... 173 Implications for Management Theory ........................................................................................ 174 Implications for Future Research ................................................................................................ 179 Concluding Thoughts .................................................................................................................. 180 References .................................................................................................................................. 182 Appendix A: Quality Assessment Tool ...................................................................................... 204 Appendix B: Databases Included in UMUC OneSearch ............................................................ 208 Appendix C: Summary of Studies Included in Dataset .............................................................. 209 Appendix D: Summary of Studies Excluded for Failing the Quality Assessment ..................... 238 Appendix E: Literature Search Results by Year ......................................................................... 239 Appendix F: Journal Search Results ........................................................................................... 240 xii List of Tables Table 1. Summary of Propositions and Theses Statements ...........................................................87 Table 2. Search String and Database .............................................................................................90 Table 3. Rationale for Including Articles in the Systematic Review .............................................92 Table 4. Quality Appraisal Rating Categories ...............................................................................94 Table 5. Panel of Subject Matter Experts and Panel Feedback ...................................................101 Table 6. Enterprise Risk Management and Financial Value ........................................................115 Table 7. Compliance Outcomes Organizations Desire from Adopting an ERM Strategy ..........122 Table 8. Performance Outcomes Organizations Desire from Adopting an ERM Strategy .........123 Table 9. Mechanisms that Facilitate or are Barriers to ERM Implementation ............................134 Table 10. Decision Making Facilitators and Barriers ..................................................................138 Table 11. Organizational Learning Facilitators and Barriers .......................................................139 Table 12. Characteristics of Ambiguous Situations .....................................................................158 Table 13. Principles for ERM Adoption and Implementation at HEIs ........................................167 xiii List of Figures Figure 1. Risk management techniques .........................................................................................20 Figure 2. Components of the COSO ERM framework ..................................................................24 Figure 3. Program implementation process ...................................................................................31 Figure 4. Management theories.............................................................................