|
Article Excerpt
Uncertainty abounds in today's economy. Every organization is in the business of risk management to some extent. It is impossible to "create a business that doesn't take risks." (1) Thomas Stewart aptly summarizes the implication of risk in business: "Risk--let's get this straight upfront--is good. The point of risk management isn't to eliminate it; that would eliminate reward. The point is to manage it--that is, to choose where to place bets, where to hedge bets, and where to avoid betting altogether." (2)
Historically, risk management in even the most successful business tended to occur in silos--the insurance risk, the technological risk, the financial risk, the operational risk, the environmental risk--all managed independently in separate compartments or departments. Coordination of risk management was usually nonexistent, and the identification of new risks was sluggish. (3) As a business continually changes, so do the risks. In today's business environment, stakeholders increasingly want companies to identify and manage their business risks.
The mismanagement of risk can carry an enormous price. The business community has witnessed a number of risk debacles in recent years that resulted in considerable financial loss, decreased shareholder value, damaged company reputations, the dismissal of senior management, and, in some cases, the destruction of the business. Consider the impact of companies selling defective products or unnecessary services, coupled in some cases with severe mishandling of the product recall or service problem; environmental disasters and inadequate attention to the resulting crisis; rogue traders lacking oversight and inadequate controls assuming enormous risks; organizations trading in complex derivative instruments without understanding the risks involved; mergers destroying shareholder value; insurance salespeople churning customers' accounts; sexual harassment of employees; and racial slurs by management and discrimination against employees.
This risk environment, in which a debacle can have major and far-reaching consequences, requires that senior management adopt enterprise risk management (ERM). The value of ERM is that it makes managers and employees at all levels sensitive to and concerned about risk management. Table 1 identifies three key aspects of ERM that are distinct from traditional risk management.
ERM is also referred to as integrated, strategic business-wide risk management. Here we use these risk terms interchangeably. In general, the term "risk" includes any event or action that will adversely affect an organization's ability to achieve its business objectives and execute its strategies successfully. The scope of risk covers all events, internal and external, that may prevent an organization from achieving its objectives. Adding the word "management" to integrated, business, or enterprise-wide risk implies a "structured and disciplined approach" that "aligns strategy, processes, people, technology, and knowledge with the purpose of evaluating and managing uncertainties that the enterprise faces as it creates value." (4)
STUDY OBJECTIVES
The business climate in the United Arab Emirates (UAE) in general--and Dubai in particular--is similar to that in other countries globally. The UAE is a federation of seven emirates that includes Abu Dhabi and Dubai. Abu Dhabi has exploited its comparative advantage in large-scale capital and energy-intensive downstream industries such as petrochemical and fertilizers. In light of its depleting oil resources, Dubai has pursued an outward-oriented strategy of openness to trade, trade facilitation, and a favorable business environment that has enhanced diversification by stimulating trade and trade-related services. The diversification of the economy also has been driven by the rapid expansion of the services sector in the areas of tourism, finance, transport, and communication. The prudent management of oil wealth, trade openness, and an efficiently functioning business environment supports a higher intensity of trade integration and diversification in Dubai relative to other neighboring countries in the Middle East. Dubai plays a key role as the country's commercial capital. At the same time, businesses in Dubai are exposed to the various risks inherent in rapidly growing economies.
This article evaluates the current status of ERM in the business organizations in Dubai by specifically focusing on several key questions concerning businesses there. We surveyed business executives in Dubai to find answers to these questions: What types of risks are crucial for these businesses? How important is ERM for them? How do the companies identify and measure risk? What tools and processes are in existence for ERM, and are they adequate? How are various risks categorized by the businesses? What steps could be followed to improve implementation of ERM in Dubai?
We will begin with a discussion of the methodology and survey results. Based on the survey results, we suggest an appropriate step-by-step ERM process for Dubai businesses to follow. We then finish with an examination of the limitations and various conclusions that can be drawn from the results.
METHODOLOGY AND STUDY RESULTS
The survey was conducted by the senior graduating BBA Finance and Banking students registered in Insurance and Risk Management in February-March 2006 at the College of Business Administration-University of Dubai. Responses were received from managers and executives from more than 100 businesses in Dubai, UAE. Of these, 92 responses contained complete information and were usable. The survey comprised a structured questionnaire that covered the five components of the Enterprise Risk Management--Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO): control environment, risk assessment, control activities, information and communication, and monitoring. In addition to a preliminary analysis,...
|
