Risk is defined as a combination of the probability or frequency of an event and its consequences, which are generally negative (Elahi, 2013) or contain uncertainty about the objectives (International Organization for Standardization 31000, 2018). Risk involves an element of unpredictability and an undesirable result such as a loss (Soltanizadeh, Abdul, Mottaghi et al., 2016). One can have unwanted operations, strategy, competitiveness, finance, reputation and compliance obligations with adverse impact (Jalal-Karim, 2013).

Because the business environment is complex as a result of deregulation, globalization, downsizing and technological advancement (Rasid, Isa, & Ismail, 2014), companies face a wide range of risks that must be managed holistically; and thus, there is growing interest in ERM (Beasley, Clune, & Hermanson, 2005). Unlike traditional approaches to risk management, ERM is a holistic approach to risk management that involves a joint review of the risk that is assessed, quantified, funded and managed at the enterprise-level (Grace, Leverty, Phillips et al., 2015). ERM is also implemented at all levels of a company and applied in a configuration strategy so as to ensure the achievement of corporate goals (Zhao, Hwang, & Low, 2015). However, the successful implementation of ERM depends on several factors. A table 1 is presented to summarize several of them.

Table 1 Table 1 Several factors for ERM Source: Own elaboration

For example, there is a correlation between participative leadership style that allows employees to participate in the success of ERM (Sax & Torp, 2015). Other example can be the establishment of the ERM function being headed by a senior person, such as a Chief Risk Officer or Risk Director (Beasley et al., 2005; Oliveira et al., 2019). This person should be responsible for establishing and communicating policies regarding ERM, training current employees, and hiring ERM functional staff with professional experience in ERM (Kerstin, Simone, & Nicole, 2014).

In addition, it is important to have the corporate culture, values, beliefs, knowledge, attitudes and understanding of the risks shared by a group of individuals, teams and workgroups in order to boost ERM initiatives (Agarwal & Ansell, 2016; Oliva, 2016). These aspects contribute to the overall risk culture which has shown to be of great influence in facilitating ERM practices (Oliveira et al., 2019).

On the other hand, resource availability is a determining factor in advancing ERM efforts (Hallowell et al., 2013), such as estimates of qualified staff, experience and time, in addition to improving the risk management processes based on the participation of people and the proper allocation of resources, tools and techniques (Gibson & Young, 2012).

Because of its proactive nature of decision-making, ERM requires strong leadership, a substantial commitment of resources, timely reports, and real-time data insight (Moshesh, Niemann, & Kotzé, 2018). The absence or lack of these requirements could lead to implementation challenges that impact on the success of ERM. When managers perceive that other control systems and risk management are satisfactory, ERM initiatives may struggle to find a space and to sell its value added to owners (Arnaboldi & Lapsley, 2014).

Because of its integration of risk management practices and its holistic and different and simultaneous types of risk management, ERM has several benefits for organizations (Khan, Hussain, & Mehmood, 2016). It enables a consistent treatment of risk; it encourages a view of the longer-term risk while allowing accurate resource allocation and improved and faster reaction to the emerging risk identified. All of this can lead to increased profitability (Moshesh et al., 2018). It has also been shown that companies that have ERM systems in place have a higher market value (Hoyt & Liebenberg, 2011).

It is important to consider that these benefits are within the business as long as its context is associated with competition within the industry, company size, complexity of the company and its board of directors (Gordon, Loeb, & Tseng, 2009). Another benefits include the integration of decision-making across different risks within the business, the duplication of management risk fees are avoided, and a better understanding of aggregate risk in different commercial activities is obtained (Hoyt & Liebenberg, 2011). Through its approach to identification, assessment, treatment, monitoring and communication of risks, ERM can have a positive impact on the promotion of competitive business advantage (Jalal-Karim, 2013), and has even been found to allow for better management of organizational reputation (Pérez-Cornejo, de Quevedo-Puente, & Delgado-García, 2019).

In the Colombian public sector, risk management is established as a guideline in Decree 1499 of 2017 in which, among other elements, it is defined as the MIPG. The MIPG is structured in different dimensions and policies, with respect to the issue of risk management. It is referred to as Internal Control, and is contemplated within the dimension in the politics of the same name. The basis for implementing this internal control policy is the Standard Model of Internal Control, which adopted the structure of the 2013 Committee of Sponsoring Organizations of the Treadway Commission (COSO) Integrated Framework, which includes the component of risk assessment (Committee of Sponsoring Organizations of the Treadway Commission, 2013). Another factor to take into account within the internal control dimension is the model of the three lines of defense, which facilitates communication of the different roles regarding risk management and control in order to determine the different roles that must be completed; in this model the first line of defense refers to the monitoring of risks to be performed by management, the second line encompasses the various supervisory functions determined by the respective administrative and financial controls, security, risk management, and quality, among others; while the third line of defense is the internal audit (Institute of Internal Auditors, 2020).

The International Organization for Standardization (ISO) 31000 risk management standard was developed by professionals around the world, and used by all types of companies, this has made it the leading global guide for risk management practices (Govender, 2019). There is a lack of integrated approaches that consider the different types of risks, and the different sources of information to identify the risks, for this the use of ISO 31000 has been recommended as an adequate basis (Parviainen, Goerlandt, Helle et al., 2021). The aforementioned standard, recognized as a worldwide standard, allows organizations to implement the risk management process following key factors for successful implementation and contribute to performance (Rampini, Takia, & Berssaneti, 2019). Additionally, it integrates a set of systematic techniques for the different stages of risk management, which allows excellent adaptability to companies in different sectors (Antonionia & Moreno, 2019).

To implement risk management the following steps must be followed: Establish the context, assess risk, address the risk, communicate and consult, review and monitor, and record and report (International Organization for Standardization 31000, 2018).

Companies must look within the organization in order to determine the cultural level of risk management that permeates both existing practices as well as individual behavior. It should also analyze the specific nature of the context of each company in order to determine if there are significant variations in the ERM practices, including companies that are in the same industry (Caldarelli, Fiondella, Maffei et al., 2016). Thus, risk management also includes another internal factors such as its own goals and activities of the company. It is important to consider that organizational factors could generate risks, hence the importance of conducting a thorough review of the internal context (International Organization for Standardization 31000, 2018).

The external context of the organizations must also be established since the exogenous factors create risks that must be managed with the implementation of the ERM (Gordon et al., 2009). Therefore, external variables must be detailed that may affect the objectives and results of the organization; once the context of the company is defined, the scope of risk management can already be defined (International Organization for Standardization 31000, 2018). With this defined context, the entire portfolio of risks that could be presented can also be analyzed, controlled and monitored (Farrell & Gallagher, 2015)

This stage includes the identification of risks which must determine the events that may affect the achievement of objectives, including the causes and effects of each risk (Mejía, 2006); after this, the valuation of each risk based on the probability of the occurrence of each event and the magnitude of the consequences of these risks is determined (International Organization for Standardization 31000, 2018); subsequently the risks are ranked in order to set up the priority of events that must be treated (Brustbauer, 2016).

At this stage, companies determine how to respond to risks, with actions that reduce their frequency and / or impact, or establish the source of resources that will cover the losses generated by an event such as insurance or the company’s own financial funds (Committee of Sponsoring Organizations of the Treadway Commission, 2017; Mejía, 2006). Thus, there are a variety of ways to mitigate significant risks that must be analyzed according to each context (Calandro, 2015). Allowing such treatment measures to respond to different risks and improve organizational management, increases opportunities and reduce threats (Jaraba, Nuñez, & Villanueva, 2018)

It is essential to conduct a periodic review of risk behavior over time, and this stage must be carried out in a planned manner, with responsibilities defined by the company (International Organization for Standardization 31000, 2018). This is why the relationship of the ERM system and organizational performance depends largely on adequate monitoring of risks (Gordon et al., 2009). The dynamism of the environment leads to new risks which arise, that are becoming more complex, and that may affect organizations. This monitoring should be done in a nonlinear manner that integrates different natural sciences, both technical and social (Kravchenko, 2018).

This step facilitates interaction with different stakeholders through accessible channels, so that they can be informed about the decisions that the organization must make regarding risk management and disagreements leading to these decisions; Similarly, it also allows for feedback from stakeholders to adjust the guidelines regarding how to act in the face of risks (International Organization for Standardization 31000, 2018). If an effective communication and consultation process is carried out, it will facilitate the generation of awareness in the company regarding the importance of risk management for decision-makers (Zhao et al., 2015).

This step is intended to document the entire risk management process in an official or formal consultation text, documenting the activities carried out and the results obtained, which support decision making. It is recommended that this report and all related quality data be presented and shared at all relevant levels within the organization, formally recording and sharing all actions taken, contributing to the overall risk management initiative (Shi, Wong, Li et al., 2018).

The establishment for the development of each of the 12 processes (see table 2) within the entity, where internal and external factors were identified, was based on the risk management guide (Departamento Administrativo de la Función Pública, 2018), established for the public sector in Colombia. As a result of this stage, common variables were found in in the exercises developed within each process. For each variable, its positive or negative incidence was determined, and the effect, positive or negative, for the same process was described. An example of the analysis performed for one of the identified variables is presented in table 2

Table 2 Table 2 Example of the way to obtain a unified variable Source: Own elaboration.

Once the analysis was carried out, resorting to the crossing of information from each of the context identification exercises in the processes, the following was obtained: The variable with the greatest recurrence mentioned in the processes was the shortcomings in the organizational structure, which was identified in 92% of them. In the following way, the 83% of the processes owners agreed that the weakness of the information systems constituted a negative variable, which could be a cause of risks. Similarly, a comprehensive analysis of the information resulting from this phase was carried out, and the following recurrent variables were additionally identified: (67%), decrease in resource allocation (67%), inadequate physical work environment (58%) and shortcomings institutional planning (58%).

Based on the information obtained in the context setting phase, and taking into account: The strategic plan; the process map and the characterization of each of them; the internal audit reports from the internal control office and from the quality management system audit exercises; the external audit reports focused on financial and public procurement matters, as well as regulations from control and regulatory bodies of the public sector and the existing risk matrices, 79 risks were identified, based on the knowledge and review of the objectives for each process.

The results are presented in table 3. In this regard, the results presented in table 3 were obtained. To help understand the results, it is important to take into account two aspects: First, the 79 risks classified according to the typologies proposed by the Departamento Administrativo de la Función Pública (2018) are presented in its guide to managing risks, that is, it mentions whether they are strategic, operational, corruption, technological, compliance and financial. Second, as shown in figure 1, an example of risk assessment is presented, for some risks of the Social Management process, in which the probability and impact tables presented in the appendix of this article were used (see table A1 and table A2).

With the initial evaluation, the inherent risk was identified, that is, the evaluation without considering the control measures already established in the process. Subsequently, the residual risk was identified, which is the one that remains once the impact of the controls on the causes that generate the risk has been analyzed. In the example presented in figure 1, it is observed that risks R1, R2 and R4 had a considerable change in terms of their risk zone, from extreme to low and moderate. For R3, although it had a decrease in its probability of occurrence, the impact remained the same.

Table 3 Table 3 Results of the risk evaluation Source: Own elaboration.

Figure 1 Figure 1 Example of inherent and residual risk by Social Management process Source: Own elaboration.

As can be seen in Table 3, among relevant results, 57% of the risks were classified as operational, that is, they are events that can be caused by failures or inadequacy of processes, people or external events (Committee on Banking Supervision Basel, 2003). On the other hand, 13% of the risks associated with strategic situations, that is, they are the most important events for the organization to achieve its objectives, build and protect value (Frigo & Anderson, 2009). Risks related to legal matters or compliance matters accounted for 11% of the total. The risk of corruption accounted for 10% of the total, which is a type typical of the public sector in Colombia, which began work on the issues after the issuance of Law 1474 of 2011.

Subsequently, as the analysis of the identified risks developed, it was necessary to determine the probability of their occurrence and impact. In this phase, the controls for each of the causes associated with risks were also identified. Controls were rigorously analyzed, determining for each one: Frequency, responsibility for the individual in charge, evidence of application and its nature (corrective or preventive). In those cases, in which the cause had no established controls, it was indicated so that the treatment step risk actions permitted that the development or strengthening would be documented.

The assessment of the residual risk, taking into account the incidence of controls, yielded the results shown in table 3, where it is highlighted that 37% of the risks were located in the extreme zone and 25% in high zone, with the data indicating that corrective action should be taken immediately for the treatment of risks. For risks located in moderate and low zone, which correspond to 16% and 22%, respectively, actions should continue to be taken in implementing and or maintaining controls to manage these areas.

The purpose of the risk treatment plan is to specify the manner in which the options chosen to mitigate the risks will be implemented, so that those involved understand the provisions, and that progress can be monitored regarding the planned actions (International Organization for Standardization 31000, 2018). The risk treatment indicated that 27% would be accepted, given that: They were located in lower zone, because the treatment actions were sufficient, or because the causes depended on external generating agents, for which there was no higher incidence.

On the other hand, 73% of the risk would be reduced through treatment actions. In this regard, the entity formulated 34 treatment actions in order to avoid the materializing of the risks. The formulation of the actions was carried out by the individual responsible for each process. In this regard, a documented action in a given process could impact others, so it was only formalized once and proceeded to socialize with the other processes on which some kind of effect would be presented.

It is highlighted that of the actions taken, 53% focused on updating or designing operating policies and 26% on raising awareness on existing training. The previous data are consistent with the risk distribution (see table 3), as 57% of them were classified as operational, so issues related to possible process failures and human failures had to be adjusted.

The purpose of monitoring and review is to ensure and improve the quality and effectiveness of the design, implementation and results of the process ( International Organization for Standardization 31000, 2018). Given the definition of the risk criteria, a preliminary evaluation of the risk is defined, formalized and carried out according to the Risk Management Policy, where the monitoring and review processes are established based on the three lines of defense model (Institute of Internal Auditors, 2020). This was adopted by the National Government through the issuance of Decree 1499 of 2017, with specifically-developed operating manuals for implementation. As such, department head leaders would be responsible as the first line of defense through the ongoing supervision and monitoring of day-to-day activities.

This review process was carried out in three stages, as follows: First, although process leaders were charged with continuous monitoring of risks, it was also established that activities would be consolidated into quarterly reports, which were forwarded to the Corporate Planning area entity. Secondly, based on information from the first step, the Corporate Planning area proceeded with validating the consolidated quarterly reports with regular frequency. This allowed for the identification of possible improvement actions, in a focused and targeted manner for each process, with a transversal character for the entire risk management system. These activities configured the role of the second line of defense.

This corporate level risk report, consolidated by corporate planning, is integrated into the work of the Institutional Coordinating Committee for Internal Control for the organizational entity. This Committee is comprised of senior management, and operates as the highest monitoring and decision-making body in terms of control for the organization. As such, those decisions that could affect the operation in terms of risk management are taken by this committee since it has, as one of its main functions, the establishment and review of the risk management criteria, among which is the policy for risk management. Given this structure, the responsibility for strategic direction is established in the MIPG of the Consejo para la Gestión y Desempeño Institucional, and as such, is structured by the Institutional Committee Coordinator for Internal Control, an advisory and decision-making body on internal control for the overall senior management entity (Departamento Administrativo de la Función Pública, 2015).

Finally, there is the role of the third line of defense, which is responsible for implementing the risk-based audit plan, (Institute of Internal Auditors, 2017) an exercise which makes it possible to independently evaluate the effectiveness and efficiency of the controls for the established risks. This third line also serves as an information provider for the risk update exercise, as it generates reporting that identifies risks that become inputs for updating the overall process for the entity’s risk matrices.

Preliminarily to the development of the focus groups, as well as the theoretical explanation of the concepts, the importance and stages necessary to develop the risk management process were carried out so that members involved in the processes were made aware of the importance of the exercise. This served to facilitate knowledge seeking and the transfer of the methodological development for the application and implementation stages in the risk management process. These processes and procedures were developed so that any interested party within the management entity could be consulted and engaged.

Additionally, the selection of participants for focus groups for each process was made taking into account the need to have different training profiles, roles and responsibilities in order to promote discussion and feedback from a variety of viewpoints.

The results of the focus group’s working sessions were consolidated into a risk matrix process, which later would serve as the official consultation document. In establishing the criteria for risk management, it was determined by the Corporate Planning entity that progress reports would be consolidated and that implementation results for overall risk management would be disseminated to the Institutional Internal Control Committee Coordinator. This committee was composed of leaders from each of the processes as well as the legal representative. Similarly, in each of their own departmental meetings, the risks are monitored, emphasizing the existing controls, as well as the actions established for the treatment of the risks. As well, the assessment of the residual risks resulted in them being categorized as being in either high or extreme areas, as well as being classified as corruption (as required by the sector). The dissemination of information in these aforementioned areas is aimed at reviewing aspects that may be useful for updating risk the matrices.

This research has theoretical implications to the literature because it contributes to the literature on the key success factors in implementing risk management. Theoretical knowledge is also strengthened on the importance of adapting flexible risk management frameworks adjusted to the organization's environment and not only using rigid and standardized frameworks to implement ERM.

On the other hand, other practical implications could be taken into account: The implementation of the process of managing risk within the organization sought to integrate practices based on a holistic management approach, so the methodology used articulated regulatory requirements which Colombian legislation has issued to respond to risk management. This helped to avoid reprocesses, confusion and duplication efforts. Another key aspect was the active participation of the different roles of the organization, an aspect that is recommended in the deployment of initiatives of similar contexts, highlighting that of management, as this enabled the empowerment of employees at all levels within the organization. Finally, the rigor in the design and qualification of the controls for the risk causes was a key point in undertaking the execution of pertinent action plans.

The practical implications could be useful to be considered in the areas in charge of comprehensive risk management, specifically from the role of chief risk officer. In the organizational context, it could also be of interest to senior management roles, from where the conditions for effective integrated risk management must be ensured. From the point of view of the public sector in general, the contributions of this research are useful to be taken into account by other organizations obliged to implement the ERM, as well as by entities in charge of providing guidelines on the matter.

A limitation of this current study is to have a single entity and, therefore, no comparisons are made that would allow for observing different behaviors of managing risk within different contexts. It is important to note, that for this reason, this study is not intended to generalize the results which are exposed in the research. Future studies could expand the sample, allowing for the ability to carry out comparative analyzes. For example, it would be interesting to conduct a similar study in small and medium-sized companies, which, having different characteristics, may reflect different realities regarding the implementation of risk management.

On the other hand, while the current research included aspects of leadership style and its relationship to ERM, it is suggested that further research could deepen the professional experience of the members of the board of directors, and how they are associated with the ERM system, given that they are responsible for monitoring the performance of the company and are responsible for the value of the company.

In this same sense, this present research inquired about the benefits received when implementing ERM in regard to the opinion of the people who participated in the exercise. Future research could also include how benefit is perceived from different exogenous interest groups within the entity, to broaden the implications in managing risks.

Another limitation is the use of the qualitative approach to observe the factors driving risk management in the company. It would be interesting to use, in future research, a quantitative study with structural equations that could help to identify factors associated with the development of such management in public companies, and to include a representative sample for the population, so that the results could be generalized. This could also make a theoretical contribution by raising possible factors supported by more robust samples.

The study focused on observing the stage of ERM implementation in a public entity, the process followed, the benefits achieved and the difficulties encountered. Although it is an interesting contribution from the case study perspective, it would, on the other hand, be interesting to carry out future research to analyze important aspects in the design, in the framework and in the principles of risk management (International Organization for Standardization, 2018), and, to include a quantitative study to relate variables associated with the characteristics of the company (size, structure, sector, trajectory), and the impact on the planning stage.