Many observers commenting on the development of risk management in financial institutions,
highlight the increasing spread and codification of risk practices under the fashionable ERM
term. International bank capital regulation and corporate governance are two areas where the
prominence of ERM is observable5
. So much so, that Power (2003a: 10) wonders if ERM
might be emerging as a ‘world model’: ‘If we were to imagine the creation of a new banking
organization, we know that it could not be founded without rapidly adopting the mission and
principles of ERM… .’
Still, enterprise risk management remains a rather elusive and under-specified concept. Its
broad definition (eg, COSO 2003) is an umbrella for diverse risk management techniques and
arrangements, to create an image of consistent and comprehensive application. Like Lam
(1999) and Gilbert (2004), ERM advocates typically outline a set of risk management tasks
and envision a ‘framework’ for the treatment of these under the auspices of an appointed
senior risk officer. This requires the prioritisation and the ordering of the various elements
into a control cycle (as described by corporate governance advocates and regulators) with
recognisable structural and personnel arrangements.
However, digging below the surface of the loosely defined enterprise-wide risk practices, one
finds variations in the specific conceptualisations and uses of risk management in individual
organisations. This paper proposes that in a given organisation various risk management
practices form a constellation, the risk management mix that corresponds to the particularities
of the organisation and its context. As for the content of the risk management mix, four
increasingly clear types of risk management ideal types are surfacing. These are Risk Silo
Management, Integrated Risk Management, Risk and Value Management, and Strategic Risk
Management. As can be expected, in practice, these four types emerge in various
combinations, constituting in any organisation the risk management mix. However, I do not
intend to argue that the risk management mix is entirely firm-specific. Instead, this paper
proposes that systematic variations in ERM practices exist. In particular, the paper presents
field-based evidence from two large banking organisations, which is suggestive of the current
co-existence of two alternative models of ERM practices.
The objective of the case study presentation is two-fold. Firstly, the cases illustrate the four
ideal types and show how they form a ‘risk management mix’ in a given organisation.
Secondly, the paper attempts at explaining the differences in the two risk management mixes
pointing towards firm-specific and institutional pressures.
In particular, following on Power’s (2004) notion of calculative cultures, it is proposed that
senior risk officers develop ‘personal philosophies’ about the ‘manageability’ of risks. While