Houston, we have a System:Design Choices of Enterprise Risk Management Practices

Based on survey data, this study examines configurations of enterprise risk management (ERM) practices in non-financial firms and focuses on the joint implementation of risk management practices in different ERM configurations. Thereby, we focus on an established set of practices which we condense into five ERM components. As non-financial firms have a less regulated risk management environment compared to highly regulated financial firms, we use a distinct range of context factors to provide an explanation for different levels of implementation of these ERM component. We also find that those ERM components considered as management choices are complements. Using cluster analysis to classify firms based on their risk management practices for a further context-dependent examination of ERM components, we identify four configurations of ERM components. These configurations allow profiling the companies dependent on contextual characteristics related to external standards, financial reporting and compliance, and ownership. Based on an analysis of conditional correlations between ERM components considered as management choices in these clusters we find different sets of complements (systems). This study contributes to ERM literature by addressing the question about what types of organizations
implement ERM, and shedding more light on the internal structure and patterns of ERM practices in non-financial firms embedded in distinct contexts.