Linking Risk Management to Strategic Controls: a Case Study of Tesco Plc
Linking risk management to strategic controls: a case study of Tesco plc Margaret Woods
Nottingham University Business School, Wollaton Road, Nottingham, UK E mail: margaret.woods@nottingham.ac.uk
Abstract: Definitions and perceptions of the role and styles of risk management, and performance management/strategic control systems have evolved over time, but it can be argued that risk management is primarily concerned with ensuring the achievement of strategic objectives. This paper shows the extent of overlap between a broad-based view of risk management, namely Enterprise Risk Management (ERM), and the balanced scorecard, which is a widely used strategic control system. A case study of one of the UK 's largest retailers, Tesco plc, is used to show how ERM can be introduced as part of an existing strategic control system. The case demonstrates that, despite some differences in lines of communications, the strategic controls and risk controls can be used to achieve a common objective. Adoption of such an integrated approach, however, has implications for the profile of risk and the overall risk culture within an organisation.
Keywords: balanced scorecard; case study; corporate governance; enterprise risk management; risk controls; strategic control, Tesco plc.
1 Introduction
The notion that risk is inherent to any business activity is a long standing one, but the establishment of formalised risk functions in organisations is a much more recent phenomenon. Corporate governance frameworks serve to create structures that help to facilitate management accountability in a world characterised by a divorce of ownership from control (Spira and Page, 2003), but such controls seem so far to have failed to stem the recurrence of corporate scandals across the globe. Regulatory bodies have responded by introducing a mix of practice recommendations and specific requirements that emphasise the importance of internal control systems as a way of improving accountability
Nottingham University Business School, Wollaton Road, Nottingham, UK E mail: margaret.woods@nottingham.ac.uk
Abstract: Definitions and perceptions of the role and styles of risk management, and performance management/strategic control systems have evolved over time, but it can be argued that risk management is primarily concerned with ensuring the achievement of strategic objectives. This paper shows the extent of overlap between a broad-based view of risk management, namely Enterprise Risk Management (ERM), and the balanced scorecard, which is a widely used strategic control system. A case study of one of the UK 's largest retailers, Tesco plc, is used to show how ERM can be introduced as part of an existing strategic control system. The case demonstrates that, despite some differences in lines of communications, the strategic controls and risk controls can be used to achieve a common objective. Adoption of such an integrated approach, however, has implications for the profile of risk and the overall risk culture within an organisation.
Keywords: balanced scorecard; case study; corporate governance; enterprise risk management; risk controls; strategic control, Tesco plc.
1 Introduction
The notion that risk is inherent to any business activity is a long standing one, but the establishment of formalised risk functions in organisations is a much more recent phenomenon. Corporate governance frameworks serve to create structures that help to facilitate management accountability in a world characterised by a divorce of ownership from control (Spira and Page, 2003), but such controls seem so far to have failed to stem the recurrence of corporate scandals across the globe. Regulatory bodies have responded by introducing a mix of practice recommendations and specific requirements that emphasise the importance of internal control systems as a way of improving accountability
References: Beasley, M.S., Clune, R. and Hermanson, D. (2005) ‘ERM: a status report’, The Internal Auditor, Vol. 62, No. 1, pp.67–73. Beck, U. (1998) ‘The politics of risk society’, in J. Franklin (ed) The Politics of Risk Society, London: Polity Press. Berry, A.J. and Otley, D. (2004) ‘Case based research in accounting’, in C. Humphrey and B. Lee (eds) The Real Life Guide to Accounting Research, London: Elsevier. Committee of Sponsoring Organisations of the Treadway Commission (COSO) (1992) Internal Control – Integrated Framework, New York, NY: AICPA. Committee of Sponsoring Organisations of the Treadway Commission (COSO) (2004) AICPA Enterprise Risk Management, New York, NY: AICPA. De Haas, M. and Kleingeld, A. (1999) ‘Multilevel design of performance measurement systems: enhancing strategic dialogue throughout the organisation’, Management Accounting Research, Vol. 10, pp.233–261. Deloitte & Touche LLP (1997) Perspectives on Risk, Deloitte & Touche Tohmatsu International. Grady (1991) ‘Performance measurement: implementing strategy’, Management Accounting, June, pp.49–53. Helliar, C.V., Lomie, A.A., Power, D. and Sinclair, C.D. (2002) ‘Managerial attitudes to risk: a comparison of Scottish chartered accountants and UK managers’, Journal of International Accounting, Auditing and Taxation, Vol. 11, pp.156–90. Humphrey, C. (2001) ‘Paper prophets and the continuing case for thinking differently about accounting research’, British Accounting Review, Vol. 33, No. 1, pp.91–103. Institute of Chartered Accountants of England and Wales (ICAEW) (2002) ‘No surprises: working for better risk reporting’, London: ICAEW. Institute of Risk Management (2002) A Risk Management Standard, London: IRM. Ittner, C.D. and Larcker, D.F.(1998) ‘Innovations in performance measurement: trends and research implications’, Journal of Management Accounting Research, Vol. 10, pp.205–239. Kaplan, R.S. and Norton, D.P. (1992) ‘The balanced scorecard – measures that drive performance’, Harvard Business Review, January–February, pp.71–79. Kaplan, R.S. and Norton, D.P. (1993) ‘Putting the balanced scorecard to work’, Harvard Business Review, September–October, pp.143–152). Kaplan, R.S. and Norton, D.P. (1996a) ‘Using the balanced scorecard as a strategic management system’, Harvard Business Review, January–February, pp.75–85. Kaplan, R.S. and Norton, D.P. (1996b) The Balanced Scorecard, Boston, MA: Harvard Business School Press. Kaplan, R.S. and Norton, D.P. (1996c) ‘Linking the balanced scorecard to strategy’, California Management Review, Fall, pp.53–79. Kaplan, R.S. and Norton, D.P. (2000) ‘The strategy-focused organisation’, Strategy and Leadership, May/June, pp.41–43. McLave, N. (1996) ‘Breakthrough approaches to managing risk’, Bank Management, March–April, pp.1–10. Merchant, K.A. (1989) Rewarding Results: Motivating Profit Center Managers, Boston, MA: Harvard Business School Press. Norreklit, H. (2000) ‘The balance on the balanced scorecard – a critical analysis of some of its assumptions’, Management Accounting Research, Vol. 11, pp.65–88. Nottingham, L. (1997) ‘A conceptual framework for integrated risk management’, Members’ Briefing Publication 212-97, The Conference Board of Canada. Otley, D. and Berry, A.J. (1994) ‘Case study research in management accounting and control’, Management Accounting Research, Vol. 5, No. 1, pp.289–299. Scapens, R.W. (1990) ‘Researching management accounting practice: the role of case study methods’ British Accounting Review, Vol. 22, No. 3, pp.259–281. Selim, G. and McNamee, D. (1999) ‘The risk management and internal auditing relationship: developing and validating a model’, International Journal of Auditing, Vol. 3, pp.159–174. Spira, L. and Page, M. (2003) ‘Risk management: the reinvention of internal audit and the changing role of internal audit’, Accounting, Auditing and Accountability Journal, Vol. 16, No. 4, pp.640–661. Tesco Annual Report (2004) Annual Report and Financial Statements, 2004, Cheshunt, Herts: Tesco plc. Unsworth, E. (1995) ‘EU risk managers assume larger risk’, Business Insurance, November, p.13. Appendix Figure 4 Tesco governance model