A Theoretical Framework for Enterprise Risk Management and Organizational Performance

The implementation of holistic risk management, enterprise risk management (ERM), is believed to contribute significantly to the successful performance of modern-day organizations that operate in an increasingly volatile and dynamic environment. In an environment of scarce resources and information uncertainty, ERM, risk culture, and strategic planning is required to face an unstable business environment to achieve organizational goals. Several conceptual and empirical studies have provided mixed evidence on the value relevance of ERM. Scholars have also demonstrated that the effects of ERM on performance are contingent upon certain contextual variables. Currently, the academic literature is silent on the joint relationship of ERM, risk culture, strategic planning, and organizational performance. The purpose of this study is to uncover this research gap by analytically reviewing pertinent conceptual and empirical literature to establish the possibility that the impact of ERM on organizational performance is transmitted through risk culture and strategic planning. This paper advances these evolving suggestions, which hinges on the conclusion that the direct effect of ERM on organizational performance is debatable and hence inconclusive due to the possible mediating influence of risk culture and strategic planning. A framework is conceptualized to examine the mediating effects of these two constructs on the relationship. The study proposes partial least squares structural equation modeling for statistical analysis using the unexplored multiple mediation analysis in the ERM academic literature. This paper’s postulations would guide empirical research in various contexts to address the knowledge gaps in the extant literature.


Introduction
The pursuit of organizational objectives involves making several choices, with each choice bringing its form of risk. Enterprise risk management (ERM) is a new paradigm for managing risk from an inclusive perspective. It is widely embraced by boards of directors to address conflicts in the "principal-agency theory" and "information asymmetry" (Jankensgård, 2019). ERM implementation enhances sound decision-making through the complete flow of risk information and the minimization of information asymmetries (Bohnert, Gatzert, Hoyt & Lechner, 2018). Empirical evidence on the usefulness of ERM implementation is abundantly clear in the USA, with Europe gradually providing empirical evidence (Anton & Nucu, 2020;Florio & Leoni, 2016). Scanty evidence of the relationship is provided in underdeveloped and emerging economies (Anton, 2018). Despite the increased popularity of ERM adoption by organizations, due to its perceived value creation, it is still beset with unclear standards and lacks a consensus on its usefulness (Kopia, Just, Geldmacher, & Bubian, 2017).
Empirical evidence thus far provided for ERM value creation has been mixed with more studies providing positive effects (Bohnert et al., 2018;Florio & Leoni, 2016;Gordon, Loeb, & Tseng, 2009;Malik, Zaman, & Buckby, 2020). Other empirical studies reveal no significant effect (Agustina & Baroroh, 2016;Alawattegama, 2018;Gonzá lez, Santomil, & Herera, 2020;Li, Wu, Ojiako, Marshall, & Chipulu, 2014). All these studies have used various measures of ERM and organizational performance (OP), thus contributing to the conflicting results. While academic scholars continue to find suitable proxies for ERM and OP metrics to establish their relationship correctly, the need to include appropriate mediating variables such as risk culture and strategic planning remains unexplored. This is probably due to the lack of comprehensive qualitative ERM studies to identify these gaps in the literature. The popularity of COSO (2017), ISO (31000:2018), and similar other ERM frameworks have not been matched with academic research on the conjoint relationship of these constructs, even though they are explicitly raised in the frameworks and ERM definitions.
Culture is the outcome of repeated behaviors shaped by attitudes (Hillson, 2013), and that risk culture is the impact of organizational culture on risk management. Sound risk cultures enable organizations to comply with regulatory requirements, effectively manage risk and determine OP (Hillson, 2013). Empirical studies in the ERM literature on how risk culture relates to ERM and its effect on OP are scarce. The increasing need to integrate ERM at the strategic planning stage by organizations has not been matched with academic research to empirically examine the mediating roles of strategic planning on the ERM OP relationship. Of the 521 document types, 191 (36.7%) of them are research articles, and with the 20 most cited papers on ERM, Anton and Nucu (2020) did not find any study that investigated how strategic planning or risk culture relates to ERM adoption. There is a is a clear need to investigate how these three constructs relate and how they interact to impact OP.
ERM continues to gain prominence from regulators and corporate governance bodies, with pressure exerted on boards of directors and subsequently on executive management for its implementation to make sound decisions. The constructs ERM, risk culture, and strategic planning have been studied in isolation with OP with mixed results. Malik et al. (2020), Bohnert et al. (2018) provided evidence of a positive relationship between ERM and OP, while Alawattegama, 2018, Gonzá lez et al. (2020 provided no empirical evidence. The effects of strategic planning implementation on OP have also been studied across industries and sectors with mixed findings (Glaister, Dincer, Tatoglu, Demirbag, & Zaim, 2008;Shea-Van Fossen, Rothstein, & Korn, 2006). Ma, Tang, Wang, and Gao (2020) empirically determined risk culture to related to OP. Scholars have also argued that risk culture influences and is influenced by ERM (Kleffner, Lee, & McGannon, 2003;KPMG, 2018). Risk culture and strategic planning have been argued to be related (Bozaykut-Bük, 2017). Sax & Andersen (2019) empirically determined ERM, and strategic planning as associated with the latter transmitting ERM effects on OP. The interrelatedness of these three constructs and their relationship with OP requires a conceptual and analytical scholarly approach to develop a theoretical framework to fill a research gap in the literature. This study puts forward this research gap in a theoretical framework for future empirical research on how the three constructs interact to influence OP. The proposed model is to be investigated using multiple mediation statistical methods, currently absent within the ERM domain, using partial least squares structural modeling. Multiple mediation analysis allows researchers to investigate conflicting theories using the same model. The remainder of this paper is organized as follows. Section 2 discusses OP. Sections 3 elaborates on the interrelationships of ERM, risk culture, strategic planning and OP and states the various hypotheses. The proposed research framework is presented in Section 4, and Section 5 concludes the paper.

Organizational Performance
OP is a complex and multidimensional widely used measure to establish the effectiveness of most management concepts in organizations. It has been widely debated since it overly focuses on efficiency and effectiveness (George, Walker, & Monster, 2019). OP comprises financial and non-financial measures that enable executive management to evaluate the extent to which organizational goals are achieved (Kaplan & Norton, 1992). They have also been classified as either marketing-based or accounting-based. Al-Matari, Al-Swidi, and Bt Fadzil's (2014) literature review from 2000 to 2012 identified return on assets (ROA) with 46% as the most used, followed by return on equity (ROE) with 27% of the seven accounting-based measures to judge corporate governance. Concerning marketing-based measures, they identified Tobin's q as 78%, followed by the market-to-book value (7%) of the nine measures identified. Accounting-based performance measures are backward-looking, have a short-term focus, and depend on the accounting system employed by the organization. This makes them likely to vary between organizations. Marketing-based measures are forward-looking and hence reflect the long-term survival of an organization. Measuring OP from a purely financial or non-financial perspective is very narrow compared to the broader perspective, including financial and non-financial measures. However, accounting-based and some marketing-based measures are objective, while non-financial-based measures are subjective. Scholars are more likely to use subjective measures because of the unavailability, problems, and access sensitivity of objective measures.
Most ERM studies measure OP using financial metrics such as ROA (Gonzalez, Santomil, & Herrera, 2020;Ramlee & Ahmad, 2015) and ROE (Alawattegama, 2018;Gonzalez et al., 2020;Ramlee & Ahmad, 2015). Other scholars have used mainly Tobin's q as a proxy for OP (Anton, 2018;Baxter, Bedard, Hoitash, & Yezegel, 2013;Bohnert et al., 2018;Gonzalez et al., 2020;Ramlee & Ahmad, 2015;Waweru and Kisaka, 2013). The ease of obtaining such data makes the use of non-financial OP measures largely absent in the ERM domain. The ERM construct is multifaceted, complex, and cuts right across the entire organization. OP measures should, therefore, not be restricted to financial, but to encompass both quantitative and qualitative measures to provide meaningful conclusions. The varied measures of OP presented in the ERM academic literature limit research into ERM and its practical implementation effectiveness (Kopia et al., 2017). The integration of financial, and non-financial-based measures provides a clear and better view of an organization with which the effectiveness of ERM can best be judged. Financial accounting measures tell the story of actions already taken and thus provide misleading signals for continuous improvement and innovation, while non-financial measures drive the future financial performance of an organization (Kaplan & Norton, 1992). The need for in-depth theoretical studies to investigate various dimensions of OP measurement continues to be advocated in the literature (George et al., 2019). Kaplan and Norton (1992) Balanced Scorecard (BSC) is a measurement technique that incorporates both financial and non-financial measures to provide a comprehensive view of an organization. It links performance measures from the four perspectives of financial, customers, internal business, and innovation and learning. Viewing an organization from these four perspectives is an integrated approach that matches well with the integrated risk management approach of ERM. The BSC considers the various stakeholders' interests in the organization, making it an appropriate measure of organizational effectiveness. A strong limitation of the BSC is its failure to consider environmental, social, and ethical issues which are of increasing strategic importance for organizations. These significant limitations gave rise to the Sustainable Balanced Scorecard (SBSC), which considers these strategic issues. The integration of these strategic issues into the BSC is prompted by instrumental, social or political, and prescriptive theoretical views (Hansen & Schaltegger, 2016). The SBSC is in line with the "legitimacy theory," which requires organizations to operate in line with the norms of their physical areas of operation.
The first modification of the BSC, SBSC-4, was introduced to embed the four components of the environment, safety and health performance, employment practices, and community investment into each of the four original BSC perspectives (Jassem, Zakaria, & Che Azmi, 2020). SBSC-5 then followed SBSC-4. The fifth perspective of sustainability parameters was introduced separately from the four perspectives of the BSC, thereby giving birth to two different schools of thought of SBSC-4 and SBSC-5 (Jassem et al., 2020). The challenge faced by scholars is to decide which architecture to adopt as various recommendations are presented in the literature about the integration process. This has led to various SBSC architectures. Scholars have discussed in the extant literature the challenges in embedding sustainability parameters into the four traditional perspectives, SBSC-4, suggesting their clustering into a fifth perspective to reduce complexity (Hansen & Schaltegger, 2016;Huang, Pepper, & Bowry, 2014;Jassem et al., 2020). The difference between SBSC-4 and SBSC-5 is significant only if strategic risk information is incorporated into the sustainability perspective (Jassem et al., 2020). Hansen and Schaltegger (2016) proposed a two-dimensional typology for a generic SBSC architecture based on an organization value system and its corporate sustainability strategy to simplify the choice of architecture. While the debate in the academic literature continues about the use of SBSC-4 or SBSC-5, other scholars have also advocated for the SBSC modification. Chaker, Manouar, and Idrissi (2017) presented a dynamic adaptive SBSC (D-ASBSC) framework developed from a combination of multi-criteria decision-making methods (MCDM), fuzzy logic, and system dynamic modeling. It is worth noting that the adoption of the SBSC is fraught with difficulties, as social impacts are more difficult to measure and quantify.
The ambiguous empirical evidence on the usefulness of ERM implementation can be explained by the difficulties in operationalizing and measuring the ERM construct on the one hand and the onerous task of identifying and integrating the complex and multidimensional OP measures. This paper proposes the adoption of the SBSC-5 to measure OP to address the conceptual and empirical gaps in the literature. This proposition is taken from the position of the "Harvard policy model," Andrews (1980), which states that the success of an organization is dependent on the extent to which the organization fits within its environment, and the "Legitimacy theory."

ERM, Risk Culture, Strategic Planning and Organizational Performance
ERM academic scholars continue to find it challenging to evaluate the level of ERM implementation in organizations because of the varied definitions of the ERM concept (Kopia et al., 2017). A research criterion to be used in the assessment of ERM implementation has also been limited (Waweru & Kisaka, 2013). Academic researchers have measured the constructs by hiring announcements of a chief risk officer or someone with a similar designation (Pagach & Warr, 2011), keywords search in known databases (Anton, 2018;Gordon, et al., 2009;Lechner & Gatzert, 2017), ERM ratings of Standard & Poor's (Bohnert et al., 2018, firms survey using either self-developed questionnaires (Annamalah, Rahman, Marthandan, & Logeswaran, 2018;Beasley et al., 2015;Brustbauer, 2016;Ramlee & Ahmad, 2015;Sax & Andersen, 2019) or well-established ERM frameworks (Alawattegama, 2018;Aleisa, 2018;Kasim & Hanafi, 2017;Lundqvist, 2014). The various measures of the ERM construct partially contribute to the different and contradictory evidence so far provided (Adam, Soliman & Mahtab, 20021). ERM is a comprehensive risk management tool whose implementation affects all aspects of an organization. Any attempt to measure it must be equally comprehensive to capture all organization features and must be multifaceted (Adam et al., 20021).
Unlike other measurement-centered practices such as value-based management, BSC, or activity-based management, with a focus on past performance, ERM has a complete focus on potential events. This creates difficulty for researchers and practitioners to readily make available a unique and identifiable measurement technique (Mikes & Kaplan, 2014). ERM measurement should not be limited to the presence of a designated person within the organization, the implementation of a specific international framework, measures provided by rating agencies, presence of a risk committee at the board level, and availability of risk maps, but through a detailed investigation of how an organization implements its risk management and governance processes over time. The positive effect of ERM on OP is not complemented by a mere risk committee at the board level but by a strong board-level risk committee governance (Malik et al., 2020). The ERM proxy of 1 or 0 is established on the assumption that the firm has a full ERM implementation or none at all, which is not usually the case. Dichotomous measures of constructs can potentially bias the significance of the construct performance relationship (Shea-Van Fossen et al., 2006). An appropriate approach to measure ERM implementation is to determine the purpose of ERM and what constitutes its main components (Lunqvist, 2014). Thus, ERM firms are better identified and compared with each other and determine their true value-creating capabilities.
ERM academic research has so far treated the concept as self-evident and has failed to answer whether its use can be proven by its more than apparent popularity (Mikes & Kaplan, 2014). This requires a concise identification of ERM processes and maturity within the organization (Kopia et al., 2017). However, comprehensive measurement of ERM is possible where there is full disclosure of an organizations' risk management processes, structure, and governance. A systematic and empirical ERM literature search by Anton and Nucu (2020) from 2008 to 2019 identified the four streams of research on its adoption, driving factors for its adoption, its implementation effects, and other aspects that are exclusive of the roles of risk culture and strategic planning.
ERM is a complex phenomenon that requires several periods for full implementation. Most of the identified studies in the literature use data over one year, thereby limiting the study findings on the usefulness of ERM on OP. Longitudinal studies on ERM are required to provide a comprehensive measure. Gordon et al. (2009) noted that the relationship between ERM and OP depends on correctly matching ERM with environmental uncertainty, industry competition, size of the firm and its complexity, and monitoring from the side of the board of directors. ERM implementation should be carried out in conjunction with contextual variables in an organization's environment (Gordon et al., 2009).
The mixed findings of these studies can be attributed to methodological problems in measuring ERM and OP. Besides, the exclusion of the critical variables of risk culture and strategic planning as mediators on the relationship between ERM and OP may contribute to the inconsistent findings. To address this knowledge gap, this paper strongly argues that the positive effect of ERM on OP is indirect since it could be mediated by risk culture and strategic planning; hence, the following hypothesis is proposed.

Hypothesis 1 Enterprise Risk Management is not Directly Related to Organizational Performance
Risk culture gained prominence among professionals after the 2008 global financial crisis (GFC) (Bott & Milkau, 2018). Its weakness played a vital role in this financial crisis as well as more recent London Interbank Offer Rate, Payment Protection Insurance and "London Whales" scandals (Ashby, Power, & Palermo, 2014). The current procedures in assessing risk culture continue to grow and have not reached the level where extensive competence in risk culture is widely accessible (Australian Prudential Regulatory Authority -APRA, 2016). There are a few theoretical and empirical studies on the subject, with most studies on risk culture based on the cultural theory perspective (Śliwiński & Klapkiv, 2016). Studies on risk culture have been carried out in two different dimensions, measurement and its relationship with OP. Measurement of risk culture, which is just a tool, has attracted a lot of research, while research on the effects of risk culture on OP has been limited. A comprehensive literature review by Shahzad, Lukman, Khan, and Shabbir (2012) finds that corporate culture strongly influences organizational processes, employees, and performance. Highly committed employees whose norms and values are the same as those of the organizations help organizations achieve higher performance. A strong organizational culture influences an employee's decisions and behavior within the organization. Bui, Fang, and Lin (2018) empirically determined risk culture as the most significant variable in predicting crisis performance. The relationship between risk and firm performance is hardly linear and one-to-one and the risk appetite of an organization must reflect its culture (COSO, 2017). Ma et al., (2020) empirically established that risk culture positively impacts performance with a more substantial influence in developing economies than in developed economies. The paper strongly argues that the behavior of organizational employees concerning risk management strongly influences its performance and states the following hypothesis:

Hypothesis 2 Risk Culture is Positively Related to Organizational Performance
Strategic planning and OP are critical areas for examination in strategic management studies, with hardly any uniformity in the application of the strategic planning construct (Boyd & Reuning-Elliott, 1998;Shea-Van Fossen et al., 2006). Empirical evidence on the relationship between the two constructs is mixed and ambiguous (Glaister, Dincer, Tatoglu, Demirbag, & Zaim, 2008 Planning is evident for modern-day organizations. They operate in a business landscape that is described as volatile, uncertain, complex, and ambiguous (VUCA); a military terminology now used in management studies. Strategic planning forms an essential aspect of strategic management, and it is generally considered to be a process undertaken by an organization to define its direction and take concrete actions to distribute its resources to seek the stated direction. It is a methodological process of imagining a desired future state and interpreting this vision into widely defined goals, objectives, and the related set of actions to achieve them. Strategic planning involves recognizing future goals and allocating resources to attain these goals (Sosiawani et al., 2015). Strategic planning is also about learning, increasing organizational possibilities, discovering organizational fit with the environment, and finding and telling compelling stories about the future. It is therefore assumed by scholars that organizations that plan strategically perform better than those that do not. Strategic planning is considered to be the compelling action organizations take to move from their current status quo to their desired future state which makes them competitive using their available resources efficiently. This bears on the "Resource-Based View" (RBV) theory of the firm. The ability to develop and implement a strategic plan that can provide superior performance is dependent on the resources at the firm's disposal. According to the RBV, the strategic goal of the firm is value creation and capture from its capabilities and resources (Rigtering, Eggers, Kraus, & Chang, 2016). The motivation for adopting strategic planning in an organization is to create value for its stakeholders. Organizational efforts should align coherently to achieve this impact, with the success of its implementation assessed externally from a stakeholder value perspective (Fisher, 2018). For the process of strategic planning to be a success and value created, the vision, mission, values, and objectives must be well communicated to all those responsible for its implementation, and they should be fully involved in the entire process itself. The plan must be produced in a timely fashion with performance measurement metrics and an ongoing system for monitoring, progress review, and updating of the strategic plan (Fisher, 2018).
The strategic planning OP relationship has been widely reported in developed economies, particularly the USA (Glaister et al., 2008), with very few studies in developing economies, Africa in particular (Namada, Bagire, Aosa, & Awino, 2017). With data from Africa, scholars have been able to find support that strategic planning improves OP (Chavunduka, Chimunhu, & Sifile, 2015;Donkor, Donkor, & Kwarteng, 2018;Musi et al., 2018;Namada et al., 2017). From a developing economy perspective, Dibrell, Craig, and Neubaum (2014), and Sax and Andersen (2019) found a strong positive association between strategic planning and OP. On the contrary, Walheiser, Schwens, and Engelen (2019) affirm that no relationship exists between formal strategic planning and company performance. Rigtering et al. (2017) studied 2,506 organizations in nine different areas (ranging from manufacturing to services) from developed (Germany, the Netherlands, the USA, and Spain) and emerging countries (India, China, and Malaysia) and concluded that strategic planning drives performance. Statistical evidence from their study indicates that strategic planning positively influences OP, with a more substantial impact on emerging economies than in advanced economies.
Research on the nature of the relationship between constructs continues to be reported in the academic literature. These studies are still characterized by several limitations, warranting further theoretical investigations based on sound theory and statistical tools. The lack of local literature in certain circumstances to underpin the constructs of strategic planning and OP has limited research from this perspective. However, the conducted studies provide a foundation in terms of literature to further investigate the positive effects of strategic planning on OP from a broader perspective based on solid theory and statistical analysis. Most of the studies reported have failed to view strategic planning as a multidimensional activity that requires strong statistical methods (Chavunduka et al. 2015). Individual firm characteristics and deficiencies in study methodology are contributing factors that positively influence the relationship between strategic planning and OP (Shea-Van Fossen et al., 2006). Scholars critical of the strategic planning positive effects on OP have cited the non-inclusion of control variables such as industry sector, firm size, and the turbulent environment in such studies to have provided positive impact. A firm's size has been determined not to be a contextual variable in the strategic planning OP relationship (Rigtering et al., 2017). However, the industry sector has been established as a determinant. Donkor et al. (2018) found that firm size and age, but not industry had a significant positive association with performance. Glaister et al. (2008) affirm that firm size, the organization's industry, and industry turbulence are positively associated with strategic planning. Studies that have controlled for the industry have provided a greater effect size on the nature and type of relationship between constructs and are not significant for larger firms (Shea-Van Fossen et al., 2006). The results for the contextual variables are also inconsistent.
Self-reported performance data are more biased, perhaps reporting significantly higher performance results than archival data, such as audited financial statements (Shea-Van Fossen et al., 2006). Studies in which strategic planning has been measured dichotomously provide insignificantly and almost zero coefficients of the relationship between constructs as opposed to studies that have measured strategic planning with some level of sophistication, giving results with a highly significant positive relationship (Shea- Van Fossen et al., 2006). Despite the continued importance of strategic planning and performance in the normative literature, much attention has not been attached to sound empirical research on the management concept. The principles of strategic planning have universal applications, but national differences in strategic planning exist. Country-dependent factors influence business culture, and the effects of different national trading circumstances limit the generalizability of the results. To present a new empirical affirmation of the relationship between the two constructs and from the foregoing controversy, this paper argues that if strategic planning and OP are comprehensively measured as multidimensional items, the following hypothesis is proposed:

Hypothesis 3 Strategic Planning is Positively Related to Organizational Performance
The limited academic research on how risk culture influences ERM warrants academic investigations on the role of risk culture in ERM implementation. Culture is the main element of ERM, and the risk culture of an organization can significantly impact its ability to take strategic risks and fulfill its aspired goals and objectives (COSO, 2017;Institute of Risk Management -IRM, 2012). ERM provides the framework and defines the various risk management processes to use together with the organization's aspired values. In contrast, the risk culture is about the perceived rules and norms considered to be rational and important. Risk culture and ERM are ingrained, affecting each other, and risk culture serves as a foundation for effective risk management (KPMG, 2018). The decision to adopt and implement an ERM program is dependent on the organization's culture, which can inhibit the effectiveness of ERM implementation (Kimbrough & Componation, 2015;Kleffner et al., 2003;Viscelli, Beasley, & Hermanson, 2016). Suppose risk culture and organizational culture have a direct relationship with each other and the latter is a deterrent to ERM implementation. In that case, one can infer that risk culture is also a deterrent to ERM implementation.
The importance of culture has been highlighted in all the major ERM frameworks. COSO's (2017) definition of ERM explicitly raises the importance of culture and it is also underscored in its first principal component, "Governance & Culture." This can be attributed to the increasing attention, focus, and significance of the culture of risk within ERM. Risk practitioners have opined that risk culture impacts all aspects of ERM, with the likelihood of affecting decision making. It is a powerful ERM foundation that combines each component of risk management. Risk culture is crucial for the effective implementation of the processes and practices of risk management. An organization's risk appetite must reflect its culture (COSO, 2017) and that an entity's approach to risk positively or negatively impacts its risk management process. The realization of a sound ERM is dependent on the embedment of an organization's risk management framework into its structure, processes, and culture (IRM, 2012). The 2008 GFC created an increase in the advancement of risk cultures in organizations and the need for financial authorities to ask financial institutions for direction and guidance on its management to recover from financial instability (Bott & Milkau, 2018;Marshall, 2016). According to the Financial Stability Board -FSB (2014), "A sound risk culture consistently supports appropriate risk awareness, behaviors, and judgment about risk-taking within a strong risk governance framework." Risk culture is an important attribute of risk management, requiring the total comprehension of everyone in the organization from the board level. The benefits of ERM implementation cannot be achieved if risk culture is not embedded at all levels of the organization. There is insufficient empirical evidence on the relationship between ERM and risk culture, which calls for an academic investigation into how risk culture and ERM are naturally related and how the former influences the latter (Viscelli et al., 2016). The efficiency and dynamics of ERM activities are better understood by organizations that consider their culture than those without it (Ahmed & Manab, 2016). Thus, this paper argues strongly that there is a direct correlation between ERM and risk culture and hence the stated hypothesis.

Hypothesis 4 ERM is Positively Related to Risk Culture
Studies have shown that theoretical and empirical research on risk culture is scarce, although there is a wealth of commentary on strategic planning (Bozaykut-Bük, 2017). An institution's resilience to a considerable extent depends on its risk culture. Strategic planning involves taking hard long-term choices to make organizations resilient in the future. Senior management's strategic planning process is based on the "upper echelon theory," since senior management views their situations and that of the organization through their personalized lenses. Nevertheless, the implementation of the plan itself is the responsibility of everyone in the organization. Each strategic choice is accompanied by its own set of risks. The behavior of organizational employees about managing these risks and the implementation of the strategic plan is crucial. An organization with a risk-aware culture embedded throughout the organization is most likely to strategically plan well; fully and effectively implement its strategic plan. Bozaykut-Bük (2017) posited that for organizations to nurture risk management culture strategically, risk culture should be mapped in strategic planning on an instrumental and symbolic level. The instrumental level involves the introduction of analytical tools to detect and control risk, while employees' attitudes toward risk are captured at the symbolic level. Therefore, this article argues that risk culture and strategic planning are related, and that the following hypothesis is worth investigating empirically.

Hypothesis 5 Risk Culture is Positively Related to Strategic Planning
COSO's (2017) ERM definition stresses the exigency to combine ERM with strategic planning. Since 2004 when COSO released its first ERM framework, organizations still do not implement ERM and strategic planning jointly (Pierce & Goldstein, 2018). When ERM and strategic planning are integrated, organizations can understand their risk appetite in the pursuit of their goals and objectives. The organization is also well placed to comprehend if the strategy and the business objectives are aligned, the characteristics and magnitude of risk faced and realized because of the adopted strategy (COSO, 2017). When organizations fail to integrate ERM and strategic planning, they shall craft strategic initiatives, objectives, and goals, which do not foresee obstacles in acquiring firm value. ERM must be implanted in the strategic planning process to increase the organization's value (Bromiley, McShane, Nair, & Rustambekov, 2015;Frigo & Anderson, 2011). In the strategic planning process, an organization should identify its risks, state its risk appetite and tolerance level (Bozaykut-Bük, 2017). The benefits of integrating ERM and strategic planning have not been fully realized, with organizations struggling to do so (Viscelli et al., 2016). The failure of organizations to link ERM and strategy closely yields minimal beneficial impacts on performance (Viscelli et al., 2016). Organizations tend to view ERM as a strategic tool when they state their risk appetite in the strategic planning process. From a European context, Sax and Andersen (2019) were able to provide empirical evidence that ERM and strategic planning are related. The study argues that ERM and strategic planning are associated, and that the following hypothesis is proposed:

Hypothesis 6 ERM is Positively Related to Strategic Planning
Risk management processes flourish in a cultural context in which organizations implement well-designed risk cultures (Marshall, 2016). The success of an ERM relies on the active involvement of all organizational employees in proactively reacting to threats and seeking opportunities. A sound risk culture controls inappropriate risk-taking by employees and protects an organization from the dangers of reckless risk-taking behaviors. Organizations that develop and integrate sound risk cultures in their ERMs are expected to provide superior OP. The objective of risk culture is for institutions to put in place, maintain and align appropriate risk cultures with corporate values, objectives, and risk appetite. This will minimize the potential for unwanted behaviors that endanger the organization's financial well-being (APRA, 2016). The value of a firm is enhanced if risk culture is a well-fitting part of the business processes and practices of the organization. Also, risk culture can enhance current processes and aid firms in continuously managing and reducing the current and evolving threats that they continuously encounter in a dynamic environment (Baxter & Vermeulen, 2013). However, there is insufficient empirical evidence on the relationship between ERM and organizational culture and how they impact OP (Kimbrough & Componation, 2015).
An effective ERM can be achieved when organizational leaders integrate their structure, culture, and processes into their risk management framework (IRM, 2012). The development of sound risk cultures in organizations is one of the outcomes of the 2008 GFC (Marshall, 2016). This crisis forces financial authorities to ask financial institutions to appropriately execute risk management within a sound risk culture to once again become financially stable (Bott & Milkau, 2018). From a banking perspective, Brian Moynihan, CEO of Bank of America, stated in January 2014 that: "Individual accountability is at the heart of our risk culture-this means that each employee is responsible for understanding and complying with all applicable policies, completing all mandatory risk-related training, and for using his or her judgment to the management of risk in their daily business activities." In the same year, the FSB, in their April 2014 report on "Guidance on Supervisory Interaction with Financial Institutions on Risk Culture," emphasized the need for a sound risk culture for effective risk management. "A sound risk culture consistently supports appropriate risk awareness, behaviors, and judgment about risk-taking within a strong risk governance framework" (FSB, 2014).
Several studies have indicated that risk perception is environment-dependent and varies among people, ages, organizations, and countries (Śliwinński & Klapkiv, 2016). The formation of risk culture is dependent on the nature of the organization and the availability of information on the occurrence of events. For an ERM system to function fully and coordinated well, a strong risk culture must be established across the entire enterprise (Gatzert & Martin, 2015). Other scholars have investigated the relationship between risk culture, ERM, and other variables. Empirical evidence has shown that risk culture moderates the relationship between leadership comprising the board of directors, executive management, and chief risk officer with ERM implementation (Selamat & Ibrahim, 2018). Kimbrough and Componation (2015) empirically investigated the correlation between organizational culture and ERM implementation. The results of the study supported the hypothesis of a strong and direct relationship between organic cultures and ERM implementation levels. Therefore, this paper argues that, rather than investigating the direct correlation of ERM on OP, this relationship could be mediated by risk culture; hence, the following hypothesis is presented:

Hypothesis 7 Risk Culture Mediates the Relationship between ERM and Organizational Performance
The ERM definition by COSO (2017) stresses the fact that it is a procedure to be applied in a strategy setting, indicating the inevitable connection between ERM and strategic planning. Since 2004, when COSO released its first ERM framework, organizations continue to implement the fragmented procedure of risk management and fail to integrate it into strategic planning (Pierce & Goldstein, 2018). The purpose of the COSO 2017 ERM framework is to address this issue. When ERM is integrated with strategic planning, organizations can better understand the nature, type, and magnitude of risk to tolerate while pursuing its intended direction. Furthermore, management shall have the capacity to know whether the strategy and business objectives are moving in the same direction. They shall also be guided by the type and magnitude of risks they will face as a result of the chosen strategy and what type of risks and to what extent they face such risks in the implementation of the chosen strategy (COSO, 2017). When senior management fails to do this integration, the formulated strategic initiatives, goals, and objectives will fail to consider foreseeable obstacles that eventually affect OP's enhancement (Deloitte, 2017). The integration of ERM and strategic planning is thus mandatory for value addition in organizations (Bromiley et al., 2015;Frigo & Anderson, 2011).
The integration process of the two constructs is yet to be fully achieved, with difficulties still encountered by organizations to fully take advantage of the benefits of ERM (Beasley et al., 2018;Viscelli et al., 2017). Academic research on the processes and activities required to incorporate ERM in the strategy-setting process is limited, creating a need for such research. When organizations integrate ERM and strategy poorly, the general impact on OP is minimal (Viscelli et al., 2017). Beasley et al. (2015), in their study of 645 organizations in different industries, found that ERM is more likely to be perceived as a strategic tool when the entity states its risk appetite in the process of strategic planning. Firm value can be created if ERM is applied in strategy settings (Frigo & Anderson, 2011). Sax and Andersen (2019) empirically determined that strategic planning mediates the effects of ERM on performance. By successfully integrating ERM with strategic planning with more emphasis on the latter and developing ERM into fundamental capabilities, firms can benefit from a competitive advantage (Sax and Andersen, 2019). Arguably, this study thus proposes the following:

Hypothesis 8 Strategic Planning Mediates the Relationship between ERM and Organizational Performance
Empirical studies have espoused positive significant relationships between each of the three strategic management concepts of ERM, risk culture and strategic planning with OP. Although there are contradictory results on the positive effects, the integration of all three concepts in instances where they all impact OP positively shall enhance superior firm value. Bozaykut-Bük (2017) strongly argues that strategic planning embedment of risk management and risk culture enhances competitive advantage in dynamic business environments. Sax and Andersen (2019) did not find full mediation of strategic planning on the ERM performance relationship, implying the possibility of other mediators such as risk culture. Osman and Lew (2020) qualitatively provided insights into the importance of risk culture in strategic decision-making, contingent upon certain factors. COSO (2017) recognizes that linking these three concepts enables organizations to create, preserve, and realize value. Employees are central to attaining organizational goals that are spelled out in the ERM and strategic planning processes. Proponents of the "Goal setting theory," states that the performance of organizations with goals is superior to those without goals and that goals ensure activities and resources are directed toward addressing fundamental issues with organizational preferences understood by the employees. Employees' behavior is thus central to ERM and strategic planning processes. How these three strategic management concepts interact to impact OP is not articulated in the literature to provide insights into empirical research, the aim of this paper. The analytical methods for testing multiple mediation hypotheses are relatively unknown (Preacher & Hayes, 2008). In contributing to the emerging debate, this paper strongly argues that ERM should be deployed within a sound risk culture and integrated into the strategic planning stage to improve OP. Thus, the following hypothesis is presented with the constructs of risk culture and strategic planning serving as mediators of the exogenous variable of ERM and the endogenous variable of OP.

Proposed Research Framework
The stated hypothesis can all be studied in a single framework, as shown in Fig. 1.0. In the proposed model, ERM has been modeled to casually influence risk culture and interact with strategic planning to cause OP.
The variables in the study are latent variables to be measured indirectly by multiple indicators and better analyzed using partial least squares structural equation modeling (PLS-SEM) which can analyze hidden structures in the model not measured directly (Hair, Risher, Sarstedt, & Ringle, 2019). A mediation test using the Sobel test, a parametric test that assumes normality in the distribution of product coefficients, requires substantial sample sizes (Aguinis, Edwards, & Bradley, 2016). The Sobel test lacks statistical power for very small sample sizes thus, this study further justifies the use of PLS-SEM which has the capability of handling small datasets as it separates the measurement model from the structural model in the analyses. Data on these constructs should be collected at the organizational level and hence characterized by smaller responses than surveys at the individual level, such as employees and customers. The parametric assumption of the Sobel test does not usually hold for the indirect effect and that the product of two coefficients that are normally distributed gives a product that is a non-normal distribution. The Sobel test also requires path coefficients to be unstandardized as inputs for the test statistic. A suitable mediation testing approach recommended by this study is the non-parametric bootstrap method that is not based on Baron and Kenny's (1986) casual step approach (Aguinis et al., 2016;Zhao, Lynch, & Chen, 2010).

Conclusion
Studies on the value relevance of ERM on OP remain reported with little attention paid to the mediating role of strategic planning on their relationship despite there is a clear need to do so. The extant literature is also silent on the mediating role of risk culture on the ERM and OP relationship; never mind risk culture and ERM have been established to be related with risk culture also having a positive relationship with OP. Some methodically flawed evidence shows that ERM implementation substantially influences performance. However, the processes through which they exert this influence are still not very clear. To date, no empirical study has been identified that systematically traced the causal path of the effects of ERM on OP by examining the mediating influence of risk culture and strategic planning. ERM adoption does not merely lead to high performance, since other antecedents of OP may play a greater role. These revealed knowledge gaps revolving around the interrelationships of ERM, risk culture, strategic planning, and OP require academic research to advance theory on these constructs. The findings of this study provide evidence to risk practitioners on the need to establish ERM within a sound risk culture and integrate it in the strategic planning stage to improve the performance of their organizations. Further research is required to empirically study the proposed model and provide evidence as to whether ERM effects on OP are transmitted through risk culture and strategic planning. These empirical studies should be based on multiple mediation analysis that enables one to study several theories in a single model. The second-generation statistical tool of PLS-SEM that is widely used in other fields of study but relatively lacking in the ERM literature is recommended in such empirical studies.