Detailed Analysis of Enterprise Risk Management at ARCADIS

This report provides a comprehensive analysis of Enterprise Risk Management (ERM) at ARCADIS. It begins with an introduction to risk management and ERM, defining its purpose and importance within an organization. The report then reviews the literature on ERM, tracing its evolution and highlighting key standards like COSO and ISO 31000. A detailed narrative of ARCADIS's ERM framework follows, outlining the roles and responsibilities within the organization, including the executive board and risk management committee. The report identifies and categorizes ARCADIS's current key risks, including strategic, operational, and compliance risks, with examples such as market, reputation, and project risks. It concludes by discussing the difficulties in managing risk information, emphasizing the need for effective data management and mature ERM processes to ensure agile decision-making and strategic alignment.

Enterprise risk management

Introduction
Taking of risk is a natural part in any running enterprise. Risk has been expressed an issue
that associated with the unpleasant events. Risk management can be defined as analysing and
limiting the probability and undesirable events. The purpose of risk management is to allow
the organisations to solve uncertainty which include not only old problems but also new
problems that are happening in ever changing environments. Simply, risk management is a
way that can prevent uncertainty and risk from disturbing the strategic objectives and
achievement of an organisation. It is also a logical and rational means of understanding the
past and possible alternative project futures in order to make the better decisions.
Risk can happen in activities of every business; therefore, there is a need for risk
management. There are two basic ways that an organisation can take to manage the risks, first
is managing certain risk at certain duration or managing them based on interpreted basic
facts. Enterprise risk management is often referred as the latter approach. (Nocco and Stulz,
2006). Enterprise Risk Management is the latest way of vocabulary that emerge from risk
management industry that function is to signify all aspects of an enterprise including
activities for profit creation and loss prevention.
According to the COSO (2004), the definition of Enterprise Risk Management is a process
that is structured and consistent for identification, assessment and communication of the
objective and achievement of organisation. Therefore, it can be concerned that Enterprise
Risk Management is for the whole picture enterprise wide and the purpose is to ensure the
possible balance between threats and opportunities and to control the risk at a moderate level.
In practical way, this means certifying the possible basis for getting at decisions at the diverse
level of the organisation, therefore, overall decisions will be supported by those decisions. As
a subsequence, having a sound process and observing of decided activities are crucial to
certain the achievement.
Literature review of Enterprise risk management
In 1990s, the evidence of Enterprise Risk Management is occurred owing to related multiple
views on risks and it is resulted that the traditional risk management is not effective in
managing process and the framework of ERM is happened to fulfil the need. The occurrence
of risk in operation state, strategic state, politic state, technological state, legal state, financial
state, human resource state, state concerned with reputation are varied even in an
organisation. Cassidy (2005) stated that Enterprise Risk Management should be relevant to
Name – Zwe Nyunt Naing
ID - 10386856

organisational activities in order to organise, plan, control and minimise the major risks of
firm.
Generally, risk management is defined by international organisation for standardisation as the
activity to control and maintain an organisation in order not to occur risk, which means
uncertain events which will affect the achievement of organisations. The Committee of
sponsoring organisations of treadway commission (COSO 2004) defined the most widely
used ERM standard, which is a procedure or process which can have an effect of board of
directors and other management level personnel and can be used across the enterprise to
identify the potential events which can affect the objectives by settled strategy and can give
the reasonable certainty success for organisations.
Walker (2013) states that ERM can create the success of companies in terms of effective
costs, efficient labour, good location and other dimensions by using the basis management of
risk.
In the daily operation, the risk that company face seem to be more definite and obvious, often
seem to have catastrophic impacts which can create more shocking states for the companies
or organisations. Due to this condition, risk management require discipline to commit and
resolve recognising shocks and reallocate the assets for the organisations (Walker 2013).
According to the Wu et al. (2010), enterprise risk can be specified as external, internal and
procedural risk which have interdependent impacts. Risks need to be identified and managed
because risk itself is strongly connected to uncertain events and if these risks cannot be
minimised, the result can lead to loss and negative outcome for the organisations.
Rather than structural and functional approach, Enterprise risk management is more like the
procedural approach because the essence of ERM is to reduce and mitigate the uncertainty
occurrence and ifs effect which can be found along the project cycle and change these issues
into possible outcome.
Identifying, assessing and evaluating are the main basic of risk analysis, which should be
reformed and personalised according to several different internal and external risk conditions.
Hence, ERM , a very sensitive analytical tool, more approach to procedural activities such as
engineering, finance, banking, education and health care services.
There are two major ERM standards which are used mostly such as COSO ERM integrated
framework (2004) and the ISO 31000 standard (ISO,2009). The scope and definitions of

these standards are same in whole managing process. According to both standards, ERM is
defined as an ongoing process which is effected by people at the every level of organisations
or companies. What is more, it is pointed out that the essential processes and details of ERM
can be varied due to the conditions of specific firm or organisation. That is why, although
general processes and guidelines are provided by both standards, there have no designation to
support uniformity of management throughout the organisations.
On the one hand, in perspective way, both standards COSO (2004) and ISO (2009) are not
exactly same. They have their specific emphasis on aspects. Though, the ISO 31000 standard
(2009) involve steps and recommendation for the implementation of framework of ERM,
COSO’s (2004) more focus on details and suggestions of framework.
In establishing way, COSO (2004) offer a three dimensional model which present concepts
and ideas such as risk tolerance, risk appetite and portfolio view of risk, and ISO 31000
propose two dimensional model, however, the two approaches are same complication and
incorporation.
Narrative on the Organisation
Effective Enterprise Risk Management plays a critical role for achievement of strategic
objectives of ARCADIS as well as it is important for stakeholders of ARCADIS. The
ARCADIS Business Control Framework is a risk control system to identify the key risks
which can have positive or negative impact on strategic goals of organisation.
In ARCADIS, the overall responsibility is based on the executive board of organisation to
identify, analyse and manage the risks which is associated with activities and strategic ways,
for example, establishing the level of risk, designing and implementing the control system
and monitoring the impact and performance of that control system. The executive board of
organisation, headed by the chief risk officer who have support of corporate management
team and regional risk managers, has started establishment to bring support and assistance.
The committee of risk management also contribute the board members to get the right
balance between threats and opportunities with the provision of global outlook and ensure the
ARCADIS run on the right risk management framework.
That risk management function assists the board in order to be effective implementation of
framework on annual basis. For the achievement of strategic objectives, it is needed to
consider the amount of risk as well as the appropriate controls and measures for each key

risk to reduce the risk exposure of ARCADIS. Moreover, with the management function,
ARCADIS was able to communicate the risk level, capacity of risk and overall risk profile of
organisation.
The corporate risk management team of ARCADIS analysed and discussed with the every
members of organisation and committee to identify and test the risk that occurred within the
organisation. All the findings and improvements are reported and recommendations are given
from internal and external audit whose objectives are to ensure and enhance the performance
of ARCADIS through assurance and consulting the Executive board. After monitoring those
improvements and actions, the final items are reported to the executive board quarterly.
Narrative of the current key risks of organisation
The key risks are divided into categories: Strategic, Operational and Compliance.
Under strategic risks, there are market risk, reputation risk, M&A risk, Financial risk, People
Risk. Due to decreasing of market volatility, the markets can have an expectation to remain
stable or develop for the future. However, there are uncertainty remains such as Brexit and
development of the Middle East which could have impact on current situation of market.
Consolidation of several mergers has become the competitive field in recent years. However,
these scale remain the ARCADIS’ ambition to keep and maintain in top three design and
engineering firm. In recent years, digitalisation of industry has increased with the low
productivity and limited innovation. This shifting create both opportunities and new risks.
Being the global brand is the strength of ARCADIS, on the other hand, maintaining the same
level of quality is the issue that driven the ARCADIS in order to satisfy and fulfil the client
expectation. Any reputation harm can impact the whole operation of organisation. In 2017,
the excess liquidity in banks could make a positive effect on ARCADIS to get the capital
from external source. There are banks to collaborate with ARCADIS to provide financial
support. However, there have to focus on leverage with low amount of debt. After
recognising the risk and effect of people and culture, ARCADIS focus on recruiting good
people with sufficient talent to deliver projects. ARCADIS keeps continue building the
capacity and capabilities of resource to get differentiator for organisation.
In the operational risks, the first thing to consider is about client and project risk, client who
are looking for the ways to solve the complex problem with insufficient way that can lead to
risk for supply chain. For coping this case, ARCADIS engage with the contractors who give

procured service. As a global listed company, ARCADIS is required to do according to
requirement of reporting for financial case. Even misstatements in reporting affect
significantly in the reputation and market value of ARCADIS. It is crucial that all operations
report under the same high quality standards. To enable cooperation and smooth delivery of
project, IT systems have to be centralised and harmonised. As the increase of efforts on IT
systems, there will also likelihood of vulnerabilities to that system such as sophisticated
cybercrime and criminals.
In order to control the compliance risk, each functional head work together with partners who
are also responsible and have good awareness on laws and regulations. To assist such
compliance, implementation and development of local and global policies are performed as
well as all new employees have to undertake the training of code of conduct of ARCADIS
which can deliver to recognise the cases and irregularities concerned with compliance issues.
Narrative of difficulties on risk information
Organisation take risks all the time but mostly they fail to monitor, control and manage
effectively. Even the strong brand companies, the poor management of risk can lead to
demise of corporations. Therefore, it need to understand as an organisation the ways to
monitor whether the risks they take are right or wrong. In this way, Enterprise Risk
Management has become the part of everyone’s job and not just for the risk management
office.
In this era, the enormous amount of data in organisations has become Big Data and can
change into Big Risk Data. Therefore, they need to manage high amount of data from
multiple systems, processes and relationships to get the bigger picture of performance and
risk of organisation. These overwhelmed volume disrupts the organisation to delay when the
situation needs to be agile.
Effective risk management require several inputs and analysing. In order to provide this
requirement, this require to gather information so the organisation has enough perspectives
and can get better decisions. Mature Enterprise Risk Management is fulfilled with good
management process, information and technology resources that can show up the relationship
clearly between objectives, risks and measures. That is why, it need to consider workability
and availability of resources beforehand and organisation need to know clearly the purpose

of risk management strategy and make selection of right information as well as technology
which is essential to meet the needs of ever changing environment.

References
Arcadis. (2019). Risks and Risk Management. [online] Available at:
https://www.arcadis.com/en/global/who-we-are/governance/risks-and-risk-management/
[Accessed 22 Mar. 2019].
Cassidy, D. (2005). Enterprise Risk Management (ERM): A New Reality for Businesses.
Employee Benefit Plan Review, 29-31.
Choi, Y., Ye, X., Zhao, L. and Luo, A. (2015). Optimizing enterprise risk management: a
literature review and critical analysis of the work of Wu and Olson. Annals of Operations
Research, 237(1-2), pp.281-300.
COSO,I.(2004).Enterpriseriskmanagement-
integratedframework.CommitteeofSponsoringOrganizations of the Treadway Commission.
DoubleCheck Software. (2019). Why Enterprise Risk Management (ERM) is Critical to
Modern Business - DoubleCheck Software. [online] Available at:
https://www.doublechecksoftware.com/why-enterprise-risk-management-erm-is-critical-to-
modern-business/ [Accessed 22 Mar. 2019].
Epetimehin, P. (2014). The Role of Enterprise Risk Management in Health Systems
Development. IOSR Journal of Business and Management, 16(9), pp.47-50.
ISO (2009) Risk management-principles and guidelines. International Organization for
Standardization.
Kerstin, D., Simone, O. and Nicole, Z. (2014). The Role of Enterprise Risk Management in
Health Systems Development. IOSR Journal of Business and Management, 16(9), pp.47-50.
Liu, J., Low, S. and He, X. (2011). Current Practices and Challenges of Implementing
Enterprise Risk Management (ERM) in Chinese Construction Enterprises. International
Journal of Construction Management, 11(4), pp.49-63.
Nocco, Brain and Stulz, Rene (2006) Enterprise risk management: theory and practice,
Journal of Applied Corporate finance, 18 (14), pp 8-20
Rosenberg, Joshua and Schuermann, Till (2004) A general approach to integrated risk
management with skewed, fat-tailed risks, Federal Reserve Bank of New York, Staff Report
Steven (2017). Guidelines for the Risk Management function. [online] Iia.no. Available at:
https://iia.no/wp-content/uploads/2017/05/2017-Guidance-for-the-Risk-Management-
Function.pdf
Walker, R. (2013). Winning with risk management. Singapore: World Scientific.
Wu,D.,&Olson,D.L.
(2010).Enterpriseriskmanagement:Copingwithmodelriskinalargebank.Journal of the
Operational Research Society, 61(2), 179–190.