Recent trends in corporate reporting and governance in the UK and elsewhere have increased
the importance of risk management in business enterprises. Carey and Turnbull (2001), for
example, depict risk management as an ‘integral part’ of sound business management2
. Others
call attention to ‘the rise and rise of risk management’ (Hunt 2001) and to its strategic
potential by arguing that ‘with their specific skills … risk managers can more easily identify
relevant potential risks and can give focussed advice on controlling them to line managers’ as
well as to chief executives (Butterworth 2001: 22).
Accordingly, the emerging notion of Enterprise Risk Management (ERM)3
operates with a
rather wide remit. Moving beyond an initial financial risk agenda, it concerns itself with
strategic and operational issues.
In the mid-1990s, following a series of financial disasters (such as the collapse of Barings
Bank and other billion-dollar losses in the financial services sector) that directed attention to
the problems posed by complicated financial instruments let out of control, risk management
emerged as a financial discipline that offered a means of controlling risk. Risk management as
a financial subject alluded to portfolio theory (Markowitz 1959) and was originally applied in
managing the insurance portfolio of business organisations. It was with the invention of new
techniques such as Value-at-Risk (J.P. Morgan Bank 1995; Jorion 1997; Dowd 1998) that risk
management could be implicated in the day-to-day trading and lending activities of financial
institutions. Risk management, initially adopted by financial institutions as a means of
strengthening internal control over their trading and lending activities soon caught the
attention of corporate governance policy makers.4
Risk management is particularly topical in banking – apart from bankers seeing their business
as the intermediation of risks, the international regulatory framework for risk management in
banking is under review (Basel Committee on Banking Supervision, 2003). Regulators have,
in the last decade, guided risk management in practicing institutions by not only suggesting
certain risk assessment techniques, but also by determining what risks to include into risk
management frameworks. What was at stake was in effect the determination of what type of