Corporate stakeholders, environmental and social risks, and enterprise risk management: towards an integrating framework

Abstract

Over the years, there has been criticism about the limitations of the existing ERM frameworks, including COSO and the ISO 31000. The most notable being that these are ‘inward’ looking i.e. focus predominantly on management of internal operational and financial risks that yield gains solely for the interest of the business owners/shareholders and the management. This is to the detriment of ‘external’ stakeholders i.e. customers, suppliers, community, regulators, society, etc., who in today’s stakeholder sensitive business climate play a major role in generating and managing both - business risks as well as opportunities. There is also a criticism in the literature that these frameworks are inconsistent and fragmented in guidance as to their essential components and their links, making them difficult to understand and implement. During the course of review of these frameworks, the researcher has also observed that the existing ERM frameworks are developed mainly by the practitioners and as such lack a clear underlying theoretical rationale and guidance. This study attempts to address these gaps. The first objective of this research is to draw on insight from academic and professional literature on enterprise risk management, corporate social responsibility, corporate governance, and stakeholder theory to propose a conceptual framework for ERM that clearly integrates the role of external stakeholders in the risk management process. As the development of the framework is underpinned by sound theoretical insights from relevant literatures, it clearly identifies and draws clear consistent links between the stakeholders and their roles, responsibilities and processes that could be adopted in an external stakeholder integrated approach to enterprise risk management. The second objective of this study, is to draw on this framework, to describe and analyse risk management (including environmental and social risk management) practices at Gulf Petrochemical Industries Company (GPIC), a medium sized privately-owned complex in the oil and gas sector in Bahrain. This description and analysis of GPIC in the light of this framework has not only highlighted the strength and weaknesses of risk management at GPIC, but has also provided some illustration of the framework in action. To achieve the latter objective, the researcher has adopted an inductive qualitative approach. This began with an extensive review of the company’s archival data and documents to understand the evolution of risk management at GPIC. This was followed up by lengthy multiple interviews with key internal and external stakeholders to gain a rich insight and in depth understanding of the risk management process at GPIC. By doing so, the researcher has not only described the evolution of risk management at GPIC, but has also demonstrated evidences and examples of policies, procedures and practices implemented by GPIC over the years to integrate internal and external stakeholders in the management of risks including environmental and social risks. The key lessons emerging from this analysis are: first, the importance of the commitment at the top (as was the case with GPIC) to undertake effective risk management; second, the importance of achieving sound financial footing i.e. being financially strong and meeting the needs of shareholders and other internal stakeholders particularly employees before looking outside. GPIC has kept its shareholders happy (with consistent and growing financial rewards) and has also been effective in managing its employee related social risks. It has various financial and non-financial programmes and activities for keeping its workforce motivated and happy. Third, the importance of managing external stakeholders related risks especially as the company’s operations grow and become more visible – which is what GPIC did as it grew under Dr. Jawahery’s leadership. Dr. Jawahery acknowledged the importance of external stakeholders and undertook measures to address external stakeholders related environmental and social risks. The final important lesson emerging from this analysis is the importance of consulting, involving and regularly communicating with the relevant stakeholders in the risk management process. In the final respect, room for further improvement exists. While GPIC has addressed many external stakeholders related risks, some of its suppliers have noted the lack of communication between themselves and GPIC. Room exists for GPIC to communicate more effectively and regularly about various stakeholder relevant risks and how GPIC is managing them. This can help build goodwill and trust with these stakeholders which can act as a cushion for GPIC in adverse circumstances. While the study is limited to an in-depth analysis of only one company, the proposed framework and the rich insights gained from its application, can be used by future research to study other companies as well as to apply to other companies’ risk management processes. For regulators and policy makers, a key takeaway is the importance of encouraging companies through some regulation to communicate more effectively especially with external stakeholders like suppliers In today’s changing landscape of business environment resulting from increased globalisation, advent of technology and social media that amplifies the voices of social and environmental stakeholders, activists and regulators, the scope of ERM needs to be broadened to explicitly include external stakeholders, both in terms of engagement as well as communication in the risk management process.