The uncertainties of risk management - A field study on risk management internal audit practices in a Finnish municipality

Abstract

<p><em>Purpose: </em>The paper analyses the implementation of risk management as a tool for internal audit activities, focusing on unexpected effects or uncertainties generated during its application.</p> <p>&nbsp;<em>Design/methodology/approach:</em> Public and confidential documents as well as semi-structured interviews are analysed through the lens of Actor-Network Theory to identify the effects of risk management devices in a Finnish municipality.</p> <p>&nbsp;<em>Findings: </em>We found that risk management, rather than reducing uncertainty, itself created unexpected uncertainties that would otherwise not have emerged. These include uncertainties relating to legal aspects of risk management solutions, in particular the issue concerning which types of document are considered legally valid; uncertainties relating to the definition and operationalisation of risk management; and uncertainties relating to the resources available for expanding risk management. More generally, such uncertainties relate to the professional identities and responsibilities of operational managers as defined by the framing devices.</p> <p>&nbsp;<em>Research limitations/implications:</em> Risks do not &ldquo;exist&rdquo; before they are a fact that can be clearly witnessed and agreed upon by most parties; until then they are just a construction, a set of beliefs, which might or might not ever become a fact. Risk management is supposed to reduce uncertainty by following procedures dictated by the framing. However, that very framing generates overflowing and thus emphasises the debated and more or less controversial nature of the manner in which we calculate risks.</p> <p>&nbsp;<em>Practical implications</em>: Based on the study, we encourage COSO spokespersons, auditors and others involved to engage more thoroughly in the debate concerning whether risk management is, for instance, too bureaucratic and time consuming for operational managers and other organisational actors.</p> <p>&nbsp;<em>Originality/value: </em>The paper offers three contributions to the extant literature: first, it shows how risk management itself produces uncertainties. Secondly, it shows how internal auditors can assume a central role in the risk management system. Thirdly, it develops Callon&rsquo;s framing/overflowing framework with the notion that multiple frames are linked and create unexpected dynamics, and applies it to the study on the effects of risk management tools in an internal audit context. It shows how, despite recurring attempts to refine risk management, further uncertainties are continuously produced, thus providing an empirical illustration of how reframing and overflowing intertwine in a continual process.</p>