Comprehensive Enterprise Risk Management Report: Facebook Inc.

This report provides a comprehensive analysis of Facebook Inc.'s enterprise risk management (ERM) practices. It begins with an introduction to strategic management and its importance, followed by a background of Facebook Inc. and its global operations. The report then delves into various risk theories, including agency theory, cultural theory, and behavioral theory, and examines their implications for the organization. It assesses Facebook's existing risk framework and highlights major issues faced by the company, such as the Facebook-Cambridge Analytica data scandal, along with the company's responses. The report concludes with recommendations for improving Facebook's risk management strategies and preventing future issues, offering valuable insights into the complexities of ERM in a large-scale social media environment.

Enterprise risk management

TABLE OF CONTENTS
Introduction......................................................................................................................................3
Background of the organization.......................................................................................................3
Risk Theroies...................................................................................................................................4
Implication of theories on the organization.....................................................................................7
Existing risk framework in the organization...................................................................................8
Issue faced by the Facebook Inc. and their response.....................................................................10
Recommendation...........................................................................................................................11
References......................................................................................................................................13

INTRODUCTION
Strategic management plays a very important role in the success of the organization as it helps in
identifying and managing the internal factors with the external factors of the company1. The
present study is related to Facebook Inc., an international company along with the evaluation of
strategic risk management of the company. In this study, the theories related to the risk such as
agency theory, cultural theory, and behavioural theory also been described. Along with this, the
impact of all the above theory on the organization is evaluated.
The study revolves around the present risk framework approach of the Facebook Inc., in early
2018, the major scandal such as Facebook-Cambridge Analytical data scandal is also analysed.
The reason behind the scandal and response of the company to the same is described in the given
study. The recommendation for the prevention of further issues and the proper risk management
system is also given in the present study.
BACKGROUND OF THE ORGANIZATION
Facebook is the American based multinational company which provides services related with the
online social media. The headquarters of the company is located in Menlo Park, California,
United States2. The company was introduced in 2004, by Mark Zuckerberg and from then the
company holds the leading position in the market through the innovative and attractive
techniques. The company established its offices in many countries such as Dubai, London,
Sydney, and Amsterdam and so on, and around 33, 606 employees are presently working at
1 Seville, Martine, and Christine Teyssier. "Role of the governance system in strategic risk management." Risk
Management: Lever for SME Development and Stakeholder Value Creation (2017): 1-23.
2 "Company Info | Facebook Newsroom". 2018. Newsroom.Fb.Com. https://newsroom.fb.com/company-info/.

Facebook Inc. Moreover, around 1.49 Billion people are the active user of Facebook in a day,
and 2.27 Billion people are on an average monthly basis are the active user of Facebook. The
data suggest that a significant population of the world is engaged in online social sites such as
Facebook.
The Facebook was established with the main objective to bring the people closer. Facebook
assist the people to stay and associated with the family, relatives and friends. It also helps people
to get information regarding what is going in the whole world. Along with this the person can
share and express their view on any matter. This leads to creating the open culture in the world,
which also permits people to solve the problems of other. Overall this creates the power
community in the world. The company created an environment in which the appreciation is
given to the problem solving and fast decision making.
The user of the Facebook operates it from many numbers of devices such as desktop, laptop,
smartphones, and tablet only by having internet connectivity. After registration of the account
with the Facebook, the user can send the messages, call any other person, exchange and express
any article, share the photos and videos and many other things. Along with this, the user can join
the group in which they are interested such as business group, educational group, community
group and so on. Overall Facebook provides the platform to the people of the overall world to
remain close and connected by which the powerful society can emerge.
RISK THEORIES
Strategic management refers to the framework which assists in balancing the internal capabilities
of the organization with the external demands on the environment in which the company is

carrying out its operation3. It includes the identification and evaluation of the plans by which the
goals and objectives of the company can be achieved. It is the continuous process. Further, the
strategic risk management is an important part of the strategic management which deals with the
identification of the significant risk which impacts the operations of the organization4. There are
two elements of the strategic risk management which are as follows –
 The risk is evaluated as an integral part of the strategic management planning process and
at each step of planning such as analysis of the goals and objective of the company,
internal environment analysis, external environment analysis, creation of the strategies,
and selection of the strategies5.
 The management, analysis or the risk connected with the specific strategies and the
execution of the strategies.
Risk management is related with the identification of the possible risk in advance and make the
proper strategies and plan to eliminate and remove them6. There are some risk theories which are
defined as below –
 Agency theory – The agency describes the relationships exists between the principal and
the agents of the business. Agency theory is related to the identifying and analysing the
problem that is occurred in the agency relationship. The problem may arise from the
undefined goal or different risk taking capacity7. In a corporate organization, the
3 Bromiley, Philip, Devaki Rau, and Michael K. McShane. "Can strategic risk management contribute to enterprise
risk management? A strategic management perspective." A Strategic Management Perspective (October 20, 2014).
Forthcoming: Bromiley, P., Rau, D., and Mcshane, M (2016): 140-156.
4 Bromiley, Philip, Michael McShane, Anil Nair, and Elzotbek Rustambekov. "Enterprise risk management: Review,
critique, and research directions." Long range planning 48, no. 4 (2015): 265-276.
5 Hopkin, Paul. Fundamentals of risk management: understanding, evaluating and implementing effective risk
management. Kogan Page Publishers, 2018.
6 Calandro, Joseph. "A leader’s guide to strategic risk management." Strategy & leadership 43, no. 1 (2015): 26-35.
7 Uhl, Axel, and Lars Alexander Gollenia, eds. Business transformation management methodology. Routledge, 2016.

shareholders are the actual owner of the company and the board of directors are
considered as the agent of the company as they are managing the business on behalf of
the shareholders of the company8. Sometimes the shareholders are not aware with the
operations which are carried out by the board of directors of the company, or they are
prohibited from obtaining the information of the company, which leads to the dispute
between the principal and agent of the company9.
 Cultural theory – Cultural theory of risk is related to the difference in culture such as in
language, traditions, consumer priority, regulations and so on10. It is a very important
theory of risk management framework as it focuses on the risk factors related to the
social and cultural aspect. In the current scenario, the cultural theory is generally applied
to addressing the policy-making conflicts11.
 Behavioural theory – This theory is related to the identifying and evaluating the risk
factors related to the organizational behaviour such as the interaction between the
workers and organization and psychology of the organization and the industry12. This
framework is implemented on the workers of the organization and on the organization
which leads to the elimination of the adverse impact from the inappropriate behaviour.
The negative behaviour in the organization make a significant impact on the efficiency
8 Slagmulder, Regine. "Strategic Risk Management in Dynamic Environments: A Management Control
Perspective." (2017).
9 Brustbauer, Johannes. "Enterprise risk management in SMEs: Towards a structural model." International Small
Business Journal 34, no. 1 (2016): 70-85.
10 Lam, James. Enterprise risk management: from incentives to controls. John Wiley & Sons, 2014.
11 Aven, Eyvind, and Terje Aven. "Enterprise risk management." In The Routledge Companion to Strategic Risk
Management, pp. 473-482. Routledge, 2015.
12 Farrell, Mark, and Ronan Gallagher. "The valuation implications of enterprise risk management
maturity." Journal of Risk and Insurance 82, no. 3 (2015): 625-657.

and effectiveness of the workers, along with this they feel uncomfortable and stressed13.
Moreover the due to negative behaviour the organization can lose its profit and also the
productivity. Therefore behavioural theory assists in making the common ground which
leads to effective communication and also the negative behaviour can be eliminated14.
IMPLICATION OF THEORIES ON THE ORGANIZATION
Risk theories play a very significant role in making the strategies and plan to be implemented in
the company for addressing the uncertainty in the organization. The agency theory assists the
organization to establish a balance in the managers and the shareholders. Facebook Inc. is a
large company, and it possesses the number of shareholders. Therefore any action or activity
affect the people significantly15. The management should make the policies and work towards the
best interest of the shareholders of the company. Though it is good to make the long-term
succession planning of the company, the management should also consider the short-term
profitability of the shareholders. Overall by implementing the agency theory, Facebook Inc.
make the stability in the requirement of the shareholders and the board of directors of the
company16.
Further the Facebook Inc. by implementing the behavioural theory in the company; make the
environment in which the employee of the company can interact with each other in a better way.
13 Hillson, David, and Ruth Murray-Webster. Understanding and managing risk attitude. Routledge, 2017.
14 Arnold, Vicky, Tanya Benford, Joseph Canada, and Steve G. Sutton. "Leveraging integrated information systems
to enhance strategic flexibility and performance: The enabling role of enterprise risk management." International
Journal of Accounting Information Systems 19 (2015): 1-16.
15 Slagmulder, Regine, and Bart Devoldere. "Transforming under deep uncertainty: A strategic perspective on risk
management." Business Horizons 61, no. 5 (2018): 733-743.
16 Gatzert, Nadine, and Joan Schmit. "Supporting strategic success through enterprise-wide reputation risk
management." The Journal of Risk Finance 17, no. 1 (2016): 26-45.

This theory leads to the more efficient working of the employees. The risk and the probable
losses from the behavioural factors can be identified and evaluated by the company17.
Apart from the agency theory and behavioural theory the cultural theory also plays a very
important role in managing and identifying the risk arises from the difference in culture or the
diversification workforce in the company18. The Facebook Inc., possess the workforce who may
belong to different countries, different area, different culture, therefore the cultural risk theory
assist the organization to analyse the risk which may arise due to the differentiation.
EXISTING RISK FRAMEWORK IN THE ORGANIZATION
The main objective of Facebook is to provide the platform to the people by this they can share
information and build the world more transparent and connected. Since all the information on the
Facebook can be shared publically, therefore it is very important for the company to take the
reasonable steps which lead to the mitigation of risk that can arise from the online social media19.
With this regards, the spreading of false news on public media is a major risk for the company.
The company for prevention of the spreading the false news, work together with the other
industries to find new ideas which leads address this problem. The company also through its
innovative techniques and solution; build the new product by which the false information can be
captured20.
17 Andersen, Torben Juul, and Gregory L. Shaw. "The key to sustainable risk governance." In The Routledge
Companion to Strategic Risk Management, pp. 90-102. Routledge, 2015.
18 Granville, Kevin. 2018. "Facebook And Cambridge Analytica: What You Need To Know As Fallout
Widens". Nytimes.Com. https://www.nytimes.com/2018/03/19/technology/facebook-cambridge-analytica-
explained.html.
19 Staking, Kim B. "Creating value through strategic risk management." In The Routledge Companion to Strategic
Risk Management, pp. 458-470. Routledge, 2015.
20 Elowe, Brian, and Lucy Nottingham. "Risk Management's Strategic Role." Risk Management 64, no. 11 (2017): 6-
7.

Further, the targeted data collection is another major risk for the company because in this the
hacker can gain access to the personal and private data information of the user. Facebook has a
focus for protection of the personal information of users. For mitigating this risk, the company
provides customized security and privacy functions to the users, in which they can set their
setting of the account as per their own wish. The company also provides the notification system
to the user if any hacker attempts to gain the information. Further, the company is also working
with the government bodies for the protection of the data of users.
The Facebook Inc. for addressing the risk of the company established the Audit and Risk
Oversight Committee. The main objective of the establishment of the risk committee is to
improve in the quality of risk reporting and also to identify the risk for the management as well
as the board. This framework leads to the management to focus on the large areas of the risk.
This committee also makes the support and help the managers who are having the
responsibilities of managing the risk of the company. Along with this, it also assists the company
to allocate the proper resources for management of the risk.
The audit and risk committee supervise the process implemented in the company for accounting
and financial reporting along with an audit of the financial statement of the company. Along with
this, the internal audit function of the company also monitored by this committee, by which any
loophole in the internal audit function can be addressed, and risk can be mitigated. Further, the
company for identifying the risk or certain area also give the responsibility to the audit and risk
committee to observe and evaluate the impact on the operations of the company, which leads to
the proper strategic planning and procedures for reducing the risk to an acceptable level. Along
with all the above, the audit and risk committee identify the legal and regulatory compliance in
the organization by which the risk of financial loss in terms of penalty can be reduced. Company

for the protection of the data of the user taken the several steps and also comply with all the
regulatory norms related with the protection of the private information of users.
By the setting of the audit and review committee, the company has taken the major steps for
reducing the risk. This committee reviews the related party transaction, whether the company
entered into the transaction with the related party in the normal course of business. Further, the
committee from time to time makes the discussion with the management about the risk exposure
of the company.
On the basis of the above analysis, it has been observed that the company has adopted many
steps for the mitigation of the risk.
ISSUE FACED BY THE FACEBOOK INC. AND THEIR RESPONSE
The company in early 2018 faced a significant political issue which is known as Facebook-
Cambridge Analytical data scandal. The Cambridge analytical Ltd is the British company
engaged in the political consulting which included data analysis, data mining, with the strategical
communication at the time of the electoral process. In the year 2018, it was exposed that the
company Cambridge analytical Ltd, had collected the personal information of the several users
of the Facebook through their profile without their permission and consultation and the gathered
information used by the company for the political purpose.
Earlier in the year 2015, it was exposed that the Cambridge analytical Ltd was working for the
United States in the political matter and at that time the company also collected the information
of the people from the Facebook. But Facebook Inc. did not take the matter seriously and replied
that the matter is under the investigation.

The scandal happened in 2018, leads to the significant decrease in the share price of the
Facebook in the market, which leads to the reduction in the revenue and requirement of the strict
regulation from the protection of the public data arise. The company also suffered from many
penalties for fails to protect the information of the public, such as the Information commissioner
office of the United Kingdom announced its intention to levy £ 500000 as a fine on Facebook for
the infringement of law related with the protection of public information.
The founder of Facebook Mark Zuckerberg made the apology from the public and referred to
this scandal as a breach of trust, mistake or problem. The company making the changes in the
structures by which a similar mistake in the future can be prevented. Along with this, after this
scandal, the company implement General Data Protection Regulation related with the EU law,
not only on the EU public but in the all areas of the activities, which leads to the strict
compliance for the protection of the information of users.
RECOMMENDATION
On the basis of the above analysis, it has been observed that although the company has taken
several steps for the risk management, also it fails to protect the private information of the
public, which is reflected through the Facebook-Cambridge Analytical data scandal. It is
recommended that the company should implement better risk management techniques for the
protection of the data. The company should establish the risk assessment team, who will engage
in the identification and the evaluation of the risk emerging from the internal as well as the
external environment. Further, the team must consist of experts in the related field so that they
can advise the company to take action for addressing the risk. The team must be work along with
the major stakeholders so that the company can get the knowledge about the risk from

communications, policy and for the viewpoints regarding the safety. Therefore by establishing
the above approach, the company can mitigate the risk and ensure the safety of the valuable
information related to the public.