ABSTRACT

We examine how organizational culture affects enterprise risk management (ERM) sophistication. We find that organizations whose leaders demand enhanced risk oversight and organizations perceiving pressure from external parties to improve ERM, have significantly higher levels of ERM sophistication than other organizations without similar demands or pressures. However, when there are perceived constraints on resources to support more advanced risk oversight or when there are perceptions that ERM may not add value, ERM processes are significantly less sophisticated. In addition, when the prevailing attitude among organizational leaders is risk-seeking, the level of ERM sophistication is significantly lower than in risk-averse organizations. Furthermore, the extent of perceived resource constraints dampens the impact of internal demands from top leadership and negative perceptions about the value proposition of ERM lower the impact of perceived external pressures for more ERM sophistication. Our findings suggest that cultural factors help explain differences in risk oversight effectiveness.