Transferring knowledge of risk management to the board of directors and executives

Enterprise risk management (ERM) and knowledge management (KM) both encompass top-down and bottom-up approaches developing and embedding risk knowledge concepts and processes in strategy, policies, risk appetite definition, the decision-making process and business processes. The capacity to transfer risk knowledge affects all stakeholders and understanding of the risk knowledge about the enterprise's value is a key requirement in order to identify protection strategies for business sustainability. There are various factors that affect this capacity for transferring and understanding. Previous work has established that there is a difference between the influence of KM variables on risk control and on the perceived value of ERM. Communication among groups appears as a significant variable in improving risk control but only as a weak factor in improving the perceived value of ERM. The ERM mandate, however, requires for its implementation a clear understanding of risk management (RM) policies, actions and results, and the use of the integral view of RM as a governance and compliance programme to support the value-driven management of the organisation. Furthermore, ERM implementation demands better capabilities for unification of the criteria of risk analysis, alignment of policies and protection guidelines across the organisation. These capabilities can be affected by risk knowledge sharing between the RM group and the board of directors and other executives in the organisation. This research presents an exploratory analysis of risk knowledge transfer variables used in risk management practice. A survey to risk management executives from 65 firms in various industries was undertaken and 108 answers were analysed. Potential relationships among the variables are investigated using descriptive statistics and multivariate statistical models. The level of understanding of risk management policies and reports by the board is related to the quality of the flow of communication in the firm and perceived level of integration of the risk policy in the business processes.