I. The Emergence and Development of Internal Control and Comprehensive Risk Management
The concepts of internal control and risk management gradually emerged, developed, and were refined in practice.
In the 1930s, affected by the worldwide economic crisis of 1929–1933, about 40% of banks and enterprises in the United States went bankrupt, and the economy regressed by about 20 years. To cope with the business crisis, many large and medium-sized U.S. enterprises set up internal insurance management departments responsible for arranging the enterprise's various insurance programs. It can be seen that internal control and risk management at that time mainly relied on insurance.
In 1949, the Special Committee on Internal Control under the American Committee on Auditing Procedure, after two years of study, published a special report entitled 'Internal Control: Elements of a Coordinated System and Its Importance to Management and the Certified Public Accountant', which for the first time gave an authoritative definition of internal control. In 1955, Professor Schneider of the Wharton School of the University of Pennsylvania first put forward the concept of 'risk management'.
In the mid-1970s, as a result of the investigation of the 'Watergate scandal' in the United States, legislators and regulatory bodies began to attach great importance to internal control issues. To stop U.S. companies from bribing foreign government officials, the U.S. Congress passed the Foreign Corrupt Practices Act (1977). In addition to anti-corruption provisions, the Act also contains provisions requiring company management to strengthen accounting internal control. The Act became the first U.S. statute on corporate internal control. In 1978, the Cohen Commission under the American Institute of Certified Public Accountants issued a report that, first, recommended that company management submit a report on the internal control system when disclosing financial statements and, second, recommended that external independent auditors issue an audit report on management's internal control report. After 1980, professional standards for internal control auditing gradually took shape. Moreover, these standards gradually gained the recognition of regulators and legislators.
After the 1970s, as the risks faced by enterprises became more complex and diverse and the cost of risk increased, France imported internal control and risk management from the United States and spread them within the country. At the same time as France, Japan also began risk management research. Over the following 20 years, the United States, the United Kingdom, France, Germany, Japan, and other countries successively established national and regional risk management associations. At the 1983 annual meeting of the Risk and Insurance Management Society held in the United States, experts and scholars from around the world gathered in New York and jointly discussed and adopted the '101 Risk Management Guidelines', an important document in risk management's move toward practical application. In September 1992, the U.S. COSO issued 'Internal Control — Integrated Framework', which was subsequently incorporated into policies and regulations and used by thousands of enterprises in various countries to better control the actions taken to achieve their established objectives. The AS/NZS 4360, jointly formulated by Australia and New Zealand in 1995, clearly defined the standard procedures for risk management—this is what we usually call the Australia–New Zealand ERM standard, and it marked the birth of the first national risk management standard.
Over the years, people have gradually come to realize in risk management practice that the risks of different departments or different businesses within an enterprise sometimes stack up and amplify one another and sometimes offset and reduce one another. Therefore, an enterprise cannot consider risk merely from the perspective of a particular business or department; it must view risk from an enterprise-wide perspective based on the portfolio view of risk—that is, it must implement comprehensive risk management. However, although many enterprises are aware of comprehensive risk management, few have a clear understanding of it, and even fewer have implemented it. But the collapse of Enron in November 2001 and the WorldCom financial fraud case in June 2002, together with a series of other accounting fraud incidents, drew the attention of the whole of society to enterprise risk management. In July 2002, the U.S. Congress passed the Sarbanes-Oxley Act, requiring all companies listed in the United States to establish and improve their internal control systems. The Sarbanes-Oxley Act has been called the most important U.S. corporate statute since 1934; under its influence, countries around the world have introduced similar programs to strengthen corporate governance and internal control norms, increase disclosure requirements, and strengthen enterprise comprehensive risk management. Then, in September 2004, COSO released 'Enterprise Risk Management — Integrated Framework', which expanded internal control and focused more on the broader field of enterprise comprehensive risk management, and subsequently became a standard norm widely accepted by countries around the world and by numerous enterprises.
To date, more than 30 countries and regions around the world—including all developed capital-market countries and regions as well as some developing countries such as Malaysia—have issued regulatory rules and corporate governance codes for enterprises. Under the legal frameworks of various countries, effective enterprise risk management is no longer a spontaneous act of enterprises but has become a compliance requirement for business operations.
II. The Evolution of Comprehensive Risk Management Theory
Marked by Kent D. Miller's (1992) proposal of the concept of Integrated Risk Management, the subsequent decade-plus of development can be divided into two stages.
(1) The Stage of Contending Schools of Thought (1992–2001)
Experts and scholars in various fields, proceeding from the disciplines with which they were familiar, discussed and explored concepts similar to integrated risk management. The representative schools are as follows:
Integrated Risk Management. Scholars in industrial management and engineering project management proposed integrated risk management from the perspective of control and organization, arguing that enterprises should analyze, identify, and assess all the risks they face from a holistic perspective and implement corresponding management strategies. Its main viewpoint is that an enterprise can integrate multiple risk management approaches according to its specific risk situation, emphasizing the expansion of the scope of risk research.
Total Risk Management. Interdisciplinary scholars in psychology, sociology, and economics hold that risk management activities should involve three elements: price, preference, and probability. Price is used to determine the costs that must be paid to guard against various risks; probability is used to estimate the likelihood of these risks occurring; and preference is used to determine the capacity and willingness to bear risk and the degree of confidence. Risk management must integrate the three elements to make systematic and dynamic rational decisions.
Global Risk Management. Scholars of financial institutions, in the practice of risk management of financial institutions—especially banks—put forward the theory of global risk management. It emphasizes measuring the risks faced by financial institutions in a coherent, accurate, and timely manner, and attempts to establish a rigorous procedure for analyzing how total risk is distributed across trading processes, asset portfolios, and other operating activities, as well as how different types of risk should be priced and how capital should be allocated rationally. At the same time, specialized risk management departments are established within financial institutions, dedicated to preventing and defusing risks and absorbing the resulting costs.
(2) The Stage of Convergence of Integrated Risk Management Thinking (2001– )
As the understanding of risk and risk management has expanded in depth and breadth, the above theories are no longer confined to their original scopes, and the various doctrines have gradually converged and unified in connotation. The Casualty Actuarial Society (CAS) of North America defines integrated risk management
as: a process of assessing, controlling, developing, financing, and monitoring risks from all sources, through which enterprises in any industry can enhance short-term or long-term stakeholder value. This concept not only clarifies the value orientation of risk management, but also for the first time extends risk management measures to 'research and development' and 'financing', reflecting the latest achievements and a high level of risk management thinking. Subsequently, COSO—an authoritative body in the field of internal control—issued the report 'Enterprise Risk Management — Integrated Framework' in September 2004. Proceeding from the perspective of internal control, the report studies the process of integrated risk management and the key points of its implementation, representing a major breakthrough in the application of the integrated risk management concept.
(3) Development Trends of Enterprise Comprehensive Risk Management
Comprehensive risk management refers to the process and methods by which an enterprise, centered on its overall business objectives, executes the basic procedures of risk management in every link of enterprise management and in the course of operations, cultivates a sound risk management culture, and establishes and improves a comprehensive risk management system—including risk management strategy, risk financing measures, the organizational and functional system of risk management, risk management information systems, and internal control systems—thereby providing reasonable assurance for achieving the overall objectives of risk management.
Internationally, many countries have begun, at the level of institutional arrangements, to establish comprehensive risk management frameworks centered on risk capacity control—such as the implementation of the Sarbanes-Oxley Act in the United States. The Act set higher requirements for the governance and management control of companies listed in the United States; its Section 404 (management's assessment of internal control) stipulates requirements regarding internal control and internal control evaluation reports, which have had a considerable impact on U.S. enterprises in sorting out internal processes, strengthening supervision of financial investment, and improving management transparency. In 2004, COSO—the committee of sponsoring organizations of the famous U.S. commission against fraudulent financial reporting—building on the concept of the internal control framework, issued a conceptually new COSO report, 'Enterprise Risk Management — Integrated Framework' (abbreviated ERM), bringing internal control research to a new stage. COSO proposed that enterprise risk management is a process participated in by an enterprise's board of directors, management, and other employees, applied in strategy setting and across the enterprise's various departments and business activities, used to identify potential events that may affect the enterprise and to manage risk within its risk appetite, thereby providing reasonable assurance of the achievement of the enterprise's objectives.
III. Enterprise Comprehensive Risk Management in China
Domestically, the central government has attached increasing importance to risk control, elevating risk management to an important position in enterprise management. In June 2006, the State-owned Assets Supervision and Administration Commission of the State Council (SASAC) issued the 'Guidelines for Comprehensive Risk Management of Central Enterprises'. The Guidelines put forward overall principles for how central enterprises should carry out comprehensive risk management and provided relatively detailed guidance on the basic processes, organizational systems, and risk assessment of enterprise risk management. The promulgation of the Guidelines will play a positive role in preserving and increasing the value of state-owned assets and in the healthy development of enterprises, providing a guide for Chinese enterprises to respond to the challenges of economic globalization and to internal and external risks under market economy conditions.
In March 2007, the All-China Federation of Industry and Commerce issued 'Several Opinions on Guiding Private Enterprises to Strengthen Crisis Management', guiding private enterprises to enhance crisis awareness, establish crisis early-warning mechanisms for guarding against risks and emergency response mechanisms for resolving crises, and improve their ability and level of crisis prevention and resolution.
It can be seen that China has taken a big step forward in enterprise comprehensive risk management, rising from the initial stage of awareness education to the substantive stage of concrete planning and implementation. However, comprehensive risk management remains a relatively weak link in Chinese enterprise management: many enterprises lack experience, have weak risk awareness, and have relatively scarce risk management tools. Therefore, extensively carrying out theoretical and practical research on enterprise comprehensive risk management, actively drawing on international techniques and experience in enterprise comprehensive risk management, and striving to raise the level of comprehensive risk management of Chinese enterprises will be an increasingly urgent and important task facing the Chinese government and Chinese enterprises.
IV. The Basic Process and Requirements of Enterprise Comprehensive Risk Management
Enterprise comprehensive risk management differs from the management of individual enterprise risks. It requires the unified, centralized identification, ranking, and control of the enterprise's various risks, and requires the establishment of a scientific comprehensive risk management process to ensure the orderliness and effectiveness of enterprise comprehensive risk management work. To better guide enterprise risk management, Article 5 of the 'Guidelines for Comprehensive Risk Management of Central Enterprises' sets out in detail the main tasks of the basic process of comprehensive risk management for China's central enterprises, specifically including:
(1) Collecting Initial Risk Management Information
Collecting initial risk management information is the first link in enterprise comprehensive risk management; its purpose is to promptly discover the various risks the enterprise may face and to provide a basis for enterprise risk assessment.
Different risks originate from different internal and external aspects of the enterprise and may occur at any time and place. Therefore, the collection of initial risk management information should run through all of the enterprise's business units and be carried out as a regular task. It requires the enterprise to effectively establish a risk information collection and management system and to broadly and continuously collect internal and external initial information related to the enterprise's various risks and risk management, mainly including domestic and international macroeconomic policies, economic operating conditions, industrial policies, technological progress and technology policies, changes in market supply and demand, information on competitors, the enterprise's own strategy and internal conditions, and relevant laws and regulations related to the enterprise's strategic risk, financial risk, market risk, operational risk, and legal risk.
(2) Conducting Risk Assessment
Enterprise risk assessment is the risk assessment of the enterprise's various business management activities and important business processes based on the collected initial risk management information; it specifically includes three steps—risk identification, risk analysis, and risk evaluation—and its purpose is to identify and describe enterprise risks, assess the degree of impact and the risk value of the various identified risks on the achievement of the enterprise's objectives, and give priorities for risk control.
Risk identification, risk analysis, and risk evaluation are highly professional and organizational management tasks. They may be carried out by the enterprise organizing the relevant functional departments and business units, or external experts and even qualified, reputable, and professionally capable intermediary agencies may be engaged to assist. In any case, methods combining qualitative and quantitative approaches must be adopted, such as questionnaire surveys, expert consultation, management interviews, group discussions, scenario analysis, statistical analysis, and simulation analysis. To improve the quality and efficiency of risk assessment, it is also necessary to uniformly formulate various risk measurement units and risk assessment models and to ensure the rationality and accuracy of the assumptions, data sources, and assessment procedures of risk assessment. Necessary correlation analysis should also be conducted on the interrelationships among various types of risk, so that all types of risk can be managed centrally. In addition, risk assessment is also a regular task that requires dynamic management.
(3) Formulating Risk Management Strategies
Formulating risk management strategies means, according to internal and external conditions and for the various identified risks in the given order of priority, and centered on the enterprise's objectives and strategy, determining risk appetite, risk tolerance, and risk management effectiveness standards; selecting appropriate risk management tools such as risk retention, risk avoidance, risk transfer, risk conversion, risk hedging, risk compensation, and risk control; and determining the principles for allocating the human and material resources needed for risk management. This is the primary link in risk control and determines the cost and efficiency of enterprise risk control. The enterprise should regularly summarize and analyze the rationality and effectiveness of the risk management strategies it has formulated, and promptly revise or adjust inappropriate risk management strategies.
(4) Proposing and Implementing Risk Management Solutions
Proposing and implementing risk management solutions means formulating risk solutions for various types of risk or each major risk in accordance with the risk management strategies that have been formulated. This is the concrete implementation of risk management strategies and generally includes: proposing and determining the specific objectives of risk resolution, the organizational leadership required, the management and business processes involved, the conditions and means needed, and the various internal control systems; as well as the specific response measures (including outsourcing plans) and risk management tools to be taken before, during, and after the occurrence of a risk event.
The formulated risk management solutions should meet compliance requirements, while emphasizing the balance of cost, quality, and efficiency; adhering to the unity of business strategy and risk strategy and of risk control and operating efficiency; protecting the enterprise's own trade secrets; and preventing the enterprise from developing dependence risk on outsourced solutions.
(5) Supervision and Improvement of Risk Management
The focus of enterprise risk management is the identification, analysis, and control of major risks bearing on the enterprise's survival and development. Therefore, the enterprise should, with a focus on major risks, major events, major decisions, and important management and business processes, supervise the implementation of the above risk management tasks and use effective methods to test their effectiveness. Based on the results of supervision and testing, existing problems or deficiencies should be corrected.
To strengthen the supervision and improvement of risk management, the enterprise should establish and improve self-inspection systems for risk management work, supervision and evaluation systems (including external evaluation systems), reporting systems, and information feedback systems, so as to provide assurance for improving and effectively implementing risk management strategies and risk management solutions.
V. The Basic Steps of the Comprehensive Risk Management Framework
The general procedure of comprehensive risk management includes seven steps. These seven steps are:
• Establishing an integrated information framework;
• Risk assessment;
• Formulating risk strategy;
• Constructing risk management solutions;
• Implementing risk management solutions;
• Monitoring and improving the risk management process;
• Information communication running through the entire risk management process.
VI. Comprehensive Risk Management and Enterprise Internal Control
When it comes to risk management, there is one concept that must be mentioned: enterprise internal control. In practice, many enterprises cannot truly understand the difference and connection between comprehensive risk management and internal control—they either completely separate the two or simply equate them. So what is the connection and what are the differences between them? At present, the international community has basically accepted the interpretation of the two given in 'Enterprise Risk Management — Integrated Framework' (also translated in China as the 'Comprehensive Risk Management Framework') issued by COSO (the Committee of Sponsoring Organizations of the Treadway Commission) in 2004.
(1) According to the COSO framework, the connection between the two is as follows:
(1) Comprehensive risk management encompasses internal control. The COSO framework clearly states that the comprehensive risk management system framework includes internal control, treating it as a subsystem.
(2) Internal control is a necessary link in comprehensive risk management. The driving force of internal control comes from the enterprise's understanding and management of risk. For most of the operational risks an enterprise faces—or, in other words, for the risks within all of the enterprise's business processes—an internal control system is a necessary, efficient, and effective risk management method. At the same time, maintaining an adequate internal control system is also a compliance requirement of many domestic and foreign laws and regulations. Therefore, meeting the requirements of the internal control system is also a basic state that the establishment of an enterprise risk management system should achieve.
(2) The differences between internal control and comprehensive risk management are as follows:
(1) The two differ in scope. Internal control is only one function of management, achieving its own objectives mainly through after-the-fact and in-process control, whereas comprehensive risk management runs through all aspects of the management process and, more importantly, fully takes the existence of risk into account when setting objectives in advance. Moreover, in terms of the objectives to be achieved, comprehensive risk management has more than internal control.
(2) The two differ in activities. Not all of the series of specific activities of comprehensive risk management are to be done by internal control. The comprehensive risk management currently advocated includes activities such as setting risk management objectives and strategies, selecting risk assessment methods, hiring management personnel, related budgeting and administrative management, and reporting procedures. Internal control, by contrast, is responsible for the important activities in the middle of and after the risk management process, such as the assessment of risks and the control activities implemented accordingly, information and communication activities, and supervision, review, and the correction of deficiencies. The most obvious difference between the two is that internal control is not responsible for the specific setting of the enterprise's business objectives; it only evaluates the objective-setting process, and in particular assesses the risks involved in the formulation of objectives and strategic plans.
(3) The two differ in their responses to risk. The comprehensive risk management framework introduces concepts and methods such as risk appetite, risk tolerance, risk responses, stress testing, and scenario analysis. Therefore, on the basis of risk measurement, this framework facilitates the alignment of the enterprise's development strategy with its risk appetite, links growth, risk, and return, enables economic capital allocation, and uses risk information to support front-office business decision-making processes, thereby helping the board of directors and senior management achieve the four objectives of comprehensive risk management. These are all things that the current internal control framework cannot do.
Judging from international and domestic development trends, as internal control or risk management continues to improve and becomes more comprehensive, the two are bound to intersect, merge, and eventually unify.
(3) The Enterprise Comprehensive Risk Management Framework of the Stanford Research Institute
The Stanford Research Institute proposed the Comprehensive Enterprise Risk Management (CERM) framework.
Comprehensive Enterprise Risk Management (CERM) emphasizes decision analysis supported by quantitative analysis to control, at the decision-making level, the risks in areas such as strategic direction selection and major business decisions. By contrast, the COSO risk management framework is centered on internal control and emphasizes controlling risks in the course of operations and processes at the business level through systems, procedures, and financial means. CERM can formulate risk strategy at the enterprise-wide level, build an internal control system, improve risk management systems, and optimize processes and organizational functions, building a long-term risk management mechanism for the enterprise, fundamentally improving the efficiency and effectiveness of risk management, and ultimately helping the enterprise achieve the various objectives of risk management, including:
• Establishing an enterprise risk management system that includes risk identification, risk assessment and measurement, risk response, and risk monitoring
• Using systematic and scientific methods to identify and analyze all types of risk
• Implementing risk response measures in the enterprise's systems, organization, processes, and functions
• Forming an enterprise risk management strategy that supports the achievement of the enterprise's business strategic objectives
• Enabling all enterprise stakeholders to understand the enterprise's risks and meeting the requirements of shareholders and regulators
