مقاله انگلیسی رایگان در مورد مدیریت ریسک و کنترل داخلی – امرالد ۲۰۱۸

Purpose – This article examines management accounting practice in relation to the two aspects of Enterprise Risk Management (ERM): risk management and internal controls. Methodology/Approach – We conducted a survey of experienced management accountants to find out about the risk management and internal control aspects of their current ERM practices, and their perceived effectiveness in performing various ERM roles, within the context of the ERM culture and the level of information systems support for ERM in their organizations. Findings – In terms of the risk management aspects of ERM, the management accountants in the survey contribute highly to managing risks of a financial or compliance/legal nature and tend to focus mostly on risks with potentially higher impact and higher likelihood of occurring. In terms of the internal control aspects of ERM, they play a highly important role in ERM activities related to prevention and internal risk treatment. Their organizations have an ERM culture that is perceived as open to challenging discussions about risk and have implemented IS support for management accounting in areas such as information security and standardized information architecture. Overall, the effectiveness of their contributions to ERM is perceived to be high in the areas of compliance and finance-related risk. Originality/Value – We develop a framework and offer empirical evidence about the ERM contributions of management accountants. We propose and use two original scales: one to classify ERM activities, and the other to assess ERM culture.

INTRODUCTION

Over the past decade, there has been increasing pressure for organizations to design and implement Enterprise Risk Management (ERM) systems. Largescale accounting frauds such as Enron and WorldCom have prompted new legislation such as the Sarbanes–Oxley (SOX) Act of 2002. This has resulted in the revamping of internal controls in a wide range of companies to comply with SOX section 404 requirements. The private sector has also responded, issuing a comprehensive Internal Control Integrated Framework (first issued in 2004, then revised in 2013) through the Committee of Sponsoring Organizations of the Treadway Commission (COSO), explicitly identifying risk assessment as a key component for effective corporate governance. COSO’s Enterprise Risk Management Framework, published in 2004, further expanded the Internal Control framework to develop detailed guidelines for objective setting, event identification, risk assessment and response, among other elements. Since COSO’s original ERM framework, other proposals for improved risk management (RM) have been published, such as the International Organization for Standardization (ISO)’s standard 31000. In the fall of 2016, COSO’s board received public comments about a proposed update of its ERM framework. The revised framework, which addresses the increasing complexity of risk management, is scheduled for release in 2017. Since the financial crisis of 2008, close scrutiny of ERM practices for the purposes of ratings by agencies such as Standard & Poor, additional Securities Exchange Commission (SEC) proxy statement requirements of risk oversight disclosures, and public awareness of the consequences of neglecting risk management have led to mounting pressure on boards of directors and senior executives to take ERM seriously (see review in Merchant & Spaulding, 2012). This pressure for technical improvements in ERM practices should help organizations develop their capacity for identifying and treating risk more systematically. In this context, management accountants can make a valuable contribution. With their experience in designing and implementing internal controls and providing relevant information for decision-making, management accountants “can champion the importance of good risk management, including internal control…they can set the tone for good RM/IC [risk management/internal control] throughout the organization … [and] ensure RM/ IC is part of every decision-making process and subsequent planning and execution” (McNally & Tophoff, 2014, pp. 35–۳۶).