Evaluating the Application of Components Governance and Culture Based on COSO ERM at PT. Agro
- Faculty of Business, Widya Mandala Catholic University
Journal of Business Management and Accounting 14(2) (2024) · https://doi.org/10.32890/jbma2024.14.2.5
Abstract
This article explores the effective establishment of governance and corporate culture within companies by implementing the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Enterprise Risk Management (ERM). Utilizing COSO ERM provides an understandable framework for shaping corporate governance, defining company strategy, instilling culture and values, and appreciating competent employees. The study demonstrates that companies implementing COSO ERM's governance and culture components can attain their anticipated goals by minimizing potential risks. By employing a qualitative case study analysis, researchers explored the topic in depth; the research focuses on PT. Agro, revealing its successful implementation of COSO ERM's governance and culture components. The findings showcase PT. Agro established robust directorial supervision, an effective assessment system, adoption of a three-line organizational structure prioritizing risk control, and cultivation of an influential work culture through applying the BISA culture and IACE company values. The article emphasizes the significance of employees as valuable assets for companies, with PT. Agro consistently develops competent individuals for mutual benefit. Through ongoing training, skill-building workshops, and mentorship programs, PT. Agro invests in its workforce, fostering a culture of excellence and innovation. This commitment strengthens internal capabilities and nurtures employee satisfaction and loyalty. This study contributes to the limited discussion on the COSO ERM governance and culture components, providing a detailed exploration of the five principles and serving as a valuable material for future research in other companies.
Keywords: Governance and culture, COSO ERM, ERM, risk management
INTRODUCTION
Corporate governance (CG) is a concept that has become the core of modern corporate strategy, integrating it into the company’s decision- making process. In a fast-moving economy filled with uncertainty, companies that adopt a proactive approach to good governance protect assets and find a competitive advantage. This approach demands precision in identifying potential threats and opportunities, ensuring the organization is ready to face challenges and take advantage of any opportunities. Thus, implementing good governance will be the primary key for companies to move forward confidently in an unpredictable market.
The global financial crisis has been a critical moment that significantly changed CG and risk management practices. The relationship between these two aspects, previously only understood theoretically, became evident after the financial crisis occurred, as revealed in research by (Conyon et al., 2011)and (Sun et al., 2011). Research conducted by Rajab dan Schachler (2009), Clarke (2010), and Yeoh (2010) underscores the role of deficient governance processes and procedures in contributing to the corporate bankruptcies witnessed during the 2008-2009 financial crisis. Similarly, the OECD’s Kalia and Gill’s (2023) report underscores the significance of shortcomings and breakdowns within corporate governance frameworks as primary factors behind the financial turmoil experienced during that period.
In addition to governance, organizational culture is pivotal in moulding a company’s performance. Elements such as innovation, risk-taking, meticulousness, results-driven focus, people-centric approach, teamwork, assertiveness, and stability collectively shape the fabric of an organization. These factors form the essence of organizational culture and dictate its operational dynamics, ultimately impacting its success and adaptability in a competitive landscape. According to insights from Putra and Putri (2020), corporate culture is a potent force, either propelling or constraining employee performance and contentment. Consequently, a well-cultivated organizational culture correlates with heightened performance levels and enhanced employee satisfaction within a company.
In light of dynamic developments, corporate governance (CG) and organizational culture enhancements are imperative. A robust risk management framework becomes essential to mitigate the impacts of evolving risks, prompting companies to continuously refine and bolster their capacity to identify and respond to emerging risks effectively. To this end, adopting a comprehensive risk management framework like the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Enterprise Risk Management (ERM) is advocated (Institute of Internal Auditor, 2022). COSO ERM facilitates the establishment of robust corporate governance by embracing an integrated approach to identify, evaluate, manage, and monitor risks comprehensively (Febrianti & Novita, 2021; Hardjomidjojo et al., 2022).
Integration of COSO ERM empowers companies to infuse
risk management into all operational dimensions, ensuring that management decisions are well-informed and aligned (Febrianti & Novita, 2021; Hardjomidjojo et al., 2022). A profound comprehension of risks and their interplay enables companies to allocate resources judiciously, enhance operational efficiency, and achieve strategic objectives more effectively (Karanja, 2017; Wahyuni & Novita, 2021).
In implementing COSO ERM, the roles of the Board of directors, senior management, and internal auditors are crucial and interconnected. COSO ERM is a framework organizations use to manage risks comprehensively and integratedly in achieving their goals (Musallam, 2023; Nasal & Gani, 2023). The Board of directors is responsible for providing strategic guidance, overseeing the implementation of COSO ERM, and assessing its effectiveness in achieving the company’s objectives. They are accountable for setting risk tolerance and ensuring that an appropriate risk management structure has been implemented (Ricardianto et al., 2023). Through diligent oversight, the Board of directors can help ensure that the organization effectively manages risks while remaining focused on long-term goal attainment.
Meanwhile, senior management plays a pivotal role in supporting the implementation of COSO ERM by ensuring that appropriate policies and procedures are in place, adequate resources are available to manage risks, and effective communication occurs throughout the organization (Kalia & Gill, 2023). Senior management is also responsible for ensuring that information provided to the Board of directors and other relevant parties regarding risk management is accurate and timely (Alazzabi et al., 2023).
The involvement of the Board of directors, senior management, and internal auditors collectively form a strong foundation for the implementation of COSO ERM. Through their collaboration, organizations can build a culture that values risk management as an integral part of daily operations and strategy (Attaf & Bensbahou, 2023; Karsono, 2023). Thus, implementing COSO ERM becomes the responsibility of one entity, and practices are applied throughout the organization to achieve long-term success and maintain resilience against risks.
Internal auditors play a highly strategic role in the overall risk management framework. They hold an independent and objective position, enabling them to provide assurance and consultation to add value and enhance organizational operations (The Institute of Internal Auditors, 2017). Internal auditors are also responsible for ensuring management has effectively implemented COSO ERM to achieve optimal governance and company objectives (Hassan et al., 2022). Thus, through their evaluation and recommendations, internal auditors help strengthen the risk management process and enhance the organization’s ability to address challenges and achieve long-term success. This discussion of CG and culture is a qualitative case study at PT. Agro. PT. Agro is a developing company in the city of Surabaya which operates in the plantation and trading sectors. The previous explanation discusses the importance of implementing governance and culture components based on COSO ERM at PT. Agro.
Based on the analysis of the description contained in the background above, the aim of this research focuses on providing solutions for companies in the following ways:
1. This paper investigates the Board of Directors and management of PT—Agro regarding the implementation of COSO ERM governance and culture components. 2. It analyzes the implementation of good corporate governance established at PT. Agro. 3. Analyzing the application of company culture and values applied to PT. Agro.
The scope of this research is the operational activities of PT. Agro, especially the Board of directors, determines governance policies, company culture, and values.
LITERATURE REVIEW
Corporate Governance
CG constitutes the framework of principles and organizational structures essential for the effective functioning of a business, designed to balance the often divergent interests of stakeholders (du Plessis et al., 2018). CG encompasses a wide array of aspects within a company, encompassing the set of procedures and regulations to ensure adherence to specific codes and the mechanisms through which direction and control are exercised (Scherer et al., 2016). Thus, CG within a company encompasses all the protocols and procedures governing decision-making processes, charting the course towards attaining the company’s objectives and providing guidelines for measuring achieved results.
Traditionally, CG has been conceptualized as a model to safeguard shareholder investments from opportunistic management practices (Roberts & Van den Steen, 2000). Nevertheless, in recent years, the scope of governance has expanded to encompass broader oversight of corporate activities, extending to their societal and environmental impacts. Additional considerations related to corporate sustainability frequently arise in response to stakeholder demands. Sustainability is progressively becoming a central and defining element of the strategies pursued by companies (Iansiti & Levien, 2004).
The notion of sustainability has undergone significant evolution. Previously, there was a prevailing notion that environmental considerations fell within corporate social responsibility, with implications that were predominantly legal, ethical, or moral while remaining somewhat detached from the company’s core business model and market expectations. However, various factors have prompted companies to reassess their approaches and ramp up investments in sustainability initiatives. These factors include a heightened awareness of the company’s sustainability objectives, the imperative to adapt to evolving regulations, and the drive to enhance product quality. Additionally, investing in sustainability curtails production costs and enhances the company’s image and reputation among consumers, who are increasingly attuned to environmental shifts while simultaneously opening up new market avenues (Poddar et al., 2019). Consequently, companies have recognised the growing correlation between green practices and overall success (Fernando et al., 2019). As a result, sustainability has broadened its scope from merely addressing environmental concerns to encompassing the very fabric of a company’s business model.
The gradual evolution of CG and sustainability concepts has been a focal point of previous literature, which has extensively examined the key aspects where these two domains intersect. However, existing studies often lack cohesiveness, and there is a notable absence of a comprehensive overarching framework that delineates common theoretical underpinnings, elucidates interrelations among various components, and offers insights into potential avenues for future research. Thus, the primary objective of this paper is to shed light on the evolution of corporate governance literature within the context of sustainability and to propose a theoretical framework that can serve as a foundational framework for future investigations in this realm.
Thus, corporate governance is vital in directing how management assesses and manages risks. The Board of Directors must ensure that management has an effective process for identifying, prioritizing, caring, and monitoring critical risks and has a precise mechanism for informing the Board when necessary. The Board is also responsible for ensuring that these processes are continually reviewed and updated as the business environment changes. To effectively carry out risk oversight and monitoring functions, the Board of Directors needs to establish clear protocols and procedures; boards of directors are increasingly forming risk management committees tasked with supervising and monitoring the company’s overall risk management activities. This includes reviewing policies, procedures, and practices related to business, market, and operational risks.
Additionally, many board directors have appointed a Chief Risk Officer (CRO) whose activities are overseen by the Board of Directors’ risk management committee. Risk management committees are not required or defined by the United States Securities and Exchange Commission (SEC), so there are no formal requirements for risk management committee members. However, risk management committee members are recommended to be non-employee directors (i.e., not part of the company’s management), and at least one must have proven risk management qualifications (Hock et al., 2019).
Enterprise risk management enhances the function of corporate governance and, indirectly, risk management. This can provide critical assistance to boards of directors, risk management committees, and CROs because the focus is squarely on the entity level, meaning ERM examines the company. ERM can help companies identify corporate objectives at risk and ways to address even the most minor problems before they escalate into disasters that affect the entire company (Institute of Internal Auditor, 2022).
Organization Culture
Organizational culture relates to how employees perceive the
characteristics of an organization, not simply whether they like or dislike the culture. In other words, culture describes how things run withinan organization. This is a shared perception held by all members of the organization. According to organizational culture, Isensee et al. (2020) include the norms and values that guide the behaviour of corporate members. Each member of an organization endeavours to adhere to the prevailing culture to gain acceptance. Moreover, organizational culture is described as a consistent approach to addressing challenges arising from both internal and external environments, which is subsequently transmitted to new members as the appropriate method for comprehending, reasoning, and addressing pertinent issues (Dhyana Putra & Asri Dwija Putri, 2020). Organizational culture can also be understood as a system comprising values, norms, assumptions, or regulations that have been entrenched, collectively agreed upon, and adhered to by members of the organization as a guiding framework for behaviour and navigating organizational challenges.
Risk Management
Risk management constitutes a set of protocols undertaken by a company to identify, assess, mitigate, and oversee potential risks, to minimize adverse effects and ensure the company’s ability to attain its stated objectives (Hock et al., 2019; Zain, 2022) As per the COSO ERM framework, risk management integrates cultural elements, capabilities, and practices about corporate strategy and execution to effectively manage risk and enhance, sustain, or augment company value (Zain, 2022). Risk management offers numerous advantages that contributing to a company’s overall success and sustainability. By minimizing potential losses and maximizing opportunities, it enhances shareholder value and supports the achievement of organizational objectives. Through effective risk management, companies can mitigate the likelihood of unexpected events that could disrupt operations or result in financial setbacks, thereby reducing the possibility of unpleasant surprises.
Moreover, it enables better cost control and resource allocation, ensuring that resources are utilized efficiently and directed to the most needed areas. By considering potential risks in strategic planning, companies can make informed decisions and adapt more effectively to changing circumstances. Proactive risk management also reduces disruptions to operational activities and enhances the company’s resilience in facing challenges. Additionally, by promoting transparency and sound risk management practices, companies can build trust and credibility with employees, stakeholders, and regulatory bodies, fostering positive relationships and enhancing the company’s reputation.
Adopting the COSO ERM framework requires companies to
integrate risk management with strategy and the results they want to achieve. This is done so that risk management can be carried out comprehensively in all areas of the company, remembering that each department has risks that have the potential to influence the strategy and work results of the department itself, as well as impact the company’s performance in general (The Institute of Internal Auditors, 2017). Five main elements in COSO ERM are interconnected and interact, which can be illustrated in Figure 1.
1.2The initial
Determining component
strategies encompasses
and objectives (strategy andgovernance andis culture,
objective setting) the second component,
entailing
where the establishment
the organization must align riskofmanagement
a robust organizational framework
with strategic plans. This includes determining
risk
andcapacity, appetite, ethical
cultivating and tolerance
values and and
shaping how the organization
anticipated conductidentifies,
within assesses, and
responds to risks (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022).
the organization (Gleim Publications, 2021; Hock et al., 2019;
This process ensures the risks align with the organization's direction and goals.
3. Institute
The performanceof Internal
component Auditor,
centres on the2022). The Board
identification of Directors
and evaluation of risks that have the
has a tovital
potential role
impede thein overseeing
realization the strategies
of strategic goals. These implemented by based on
risks are then prioritized
severity and compared
management andwith the established
ensuring company risk appetite.
values are Management must consider the entire
maintained.
risk portfolio and determine appropriate responses, with all this information reported to the Board
2. Determining strategies and objectives (strategy and objective
of directors (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022).
4. setting)
The is the
review and second
revision component,
process is the next step,where
where the organization
the organization must evaluates the
periodically
align riskof management
effectiveness risk management with strategic
and makes necessaryplans. This This
adjustments. includes
component involves
determining
identifying riskchanges
significant capacity, appetite,
affecting business and tolerance
strategy and shaping
and objectives and adapting the risk
management
how the organization identifies, assesses, and responds 2019;
approach accordingly (Gleim Publications, 2021; Hock et al., to Institute of
Internal Auditor, 2022).
5.
risks (Gleim Publications, 2021; Hock et al., 2019; Institute
The ultimate component, information, communication, and reporting, underscores the
organisation's need to convey pertinent information concerning risk and risk management
proficiently. This includes using appropriate information systems, clear communication 315 about risks
and risk management strategies, and transparent reporting on risk management, culture, and
performance (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022).
of Internal Auditor, 2022). This process ensures the risks align with the organization’s direction and goals. 3. The performance component centres on the identification and evaluation of risks that have the potential to impede the realization of strategic goals. These risks are then prioritized based on severity and compared with the established risk appetite. Management must consider the entire risk portfolio and determine appropriate responses, with all this information reported to the Board of directors (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). 4. The review and revision process is the next step, where the organization periodically evaluates the effectiveness of risk management and makes necessary adjustments. This component involves identifying significant changes affecting business strategy and objectives and adapting the risk management approach accordingly (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). 5. The ultimate component, information, communication, and reporting, underscores the organisation’s need to convey pertinent information concerning risk and risk management proficiently. This includes using appropriate information systems, clear communication about risks and risk management strategies, and transparent reporting on risk management, culture, and performance (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022).
Thus, implementing COSO ERM is not just about following a series of steps or checklists; it is about creating an environment where risk management becomes an integral part of every aspect of an organization’s operations, from the highest levels of management to day-to-day activities.
Principles of Governance and Culture
Effective governance and a solid organizational culture are essential to effective risk management. Good governance provides a framework for organizations to identify, assess, and manage risks, while a strong culture supports responsible and ethical decision-making.
1Exercise Board Risk Oversight
The Board of directors plays a critical role in risk management oversight. This includes reviewing and challenging significant strategic and operational decisions, ensuring that management has an appropriate risk appetite and that the organization’s strategy is aligned with its mission and core values (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). The Board must have sufficient expertise to understand the organization’s risks and work independently of management to ensure adequate and effective risk management practices. 2. Determination of Operational Structure (Established Operating Structure) The operational structure of the organization must support effective risk management. This includes establishing clear reporting lines, assigning responsibilities, and efficient communication mechanisms (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). This structure should reflect the size and complexity of the organization and enable appropriate reporting and rapid decision-making in response to risks. 3. Defines Desired Culture The desired organizational culture should support risk management by encouraging responsible and ethical behaviour. This includes promoting transparency, integrity, and honesty (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). The culture should allow employees to report problems without fear of retribution and encourage open discussion of risks and opportunities. 4. Demonstrates Commitment to Core Values An organization’s core values must be clear and understood throughout the organization. This should be reflected in all aspects of operations, from decision-making to daily interactions between staff. Commitment to these values must be reinforced through policies, procedures, and reward systems that demonstrate the importance of these values to organizational success (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). 5. Attracts, Develops, and Retains Capable Individuals Organizations must be committed to developing and retaining a competent workforce. This includes investment in training and development and creating clear career paths that allow employees to grow and develop (Gleim Publications, 2021; Hock et al., 2019; Institute of Internal Auditor, 2022). Management must set clear expectations and provide constructive feedback to help employees understand how their role contributes to the organization’s risk management.
In applying these principles, organizations must consider factors such as the size and complexity of operations, the legal and regulatory environment, and the expectations of stakeholders (Rikaz et al., 2022). This process should involve ongoing evaluation and adjustment to ensure that risk management practices remain relevant and effective in changing market conditions and business challenges. Additionally, effective communication is critical to ensuring that all organization members understand the importance of risk management and their role in supporting this practice. This includes regular reporting to the Board of Directors, management, and other stakeholders on the status of the organization’s risks and how those risks are being managed (Handoko et al., 2019). By applying these principles consistently and comprehensively, organizations can build a robust risk management framework that supports achieving strategic and operational objectives while maintaining long-term reputation and integrity (Arisandy et al., 2022).
METHODOLOGY
A General Description of the Company
PT. Agro is a company operating in the plantation and trading sectors established in 2012. PT. Agro is located in the West Surabaya industrial area with the address Sukomanunggal Village, Sukomanunggal District, East Java, postal code 60188. PT. Agro has essential oil products, which are the company’s leading commodity. These products have benefits for health products (such as rubbing oil and aromatherapy), beauty (perfume, lotion, skin protection, etc.), and daily needs (such as bath soap). Types of essential oils traded by PT. Agro, such as eucalyptus oil, citronella oil, patchouli oil, clove leaf oil, clove bud oil, lavender oil, and others. The trading process involves looking for goods/raw materials from farmers, small traders, and intermediaries. Then, the oil can be reprocessed or sold directly to potential traders by considering the selling price of essential oils at that time to make a profit.
Research Method
Utilizing a qualitative approach with a case study method, researchers conducted an in-depth analysis of the subject matter; this research focuses on assessing the capabilities of the Board of Directors at PT—
Agro, specifically in implementing COSO ERM within the governance and culture components. Effective risk management relies on robust governance and a solid organizational culture.
1. Exercising Board Risk Oversight: The Board of directors oversees risk management. This involves scrutinizing significant strategic and operational decisions, ensuring an appropriate risk appetite, and aligning the organization’s strategy with its mission and core values. The Board should possess adequate expertise, work independently of management, and verify the adequacy and effectiveness of risk management practices. 2. Establishing Operating Structure: The organization’s operational structure must facilitate effective risk management. This includes setting clear reporting lines, assigning responsibilities, and fostering efficient communication. The structure should be tailored to the organization’s size and complexity, enabling timely decision-making in response to risks. 3. Defining Desired Culture: The organizational culture should promote responsible and ethical behaviour, emphasizing transparency, integrity, and honesty. Encouraging employees to report issues without fear of reprisal and fostering open discussions about risks and opportunities are integral to this culture. 4. Demonstrating Commitment to Core Values: Clear and well-understood core values should permeate all aspects of operations, from decision-making to daily interactions. Commitment to these values should be reinforced through policies, procedures, and reward systems that underscore their importance to organizational success. 5. Attracting, Developing, and Retaining Capable Individuals: Organizations must invest in developing and retaining a skilled workforce. This involves training, creating clear career paths, and setting expectations. Management should provide constructive feedback to help employees understand how their roles contribute to organizational risk management.
Upon completing these processes, the company can evaluate whether it has successfully implemented COSO ERM for the governance and culture components.
Research Approach
This research adopts a naturalist paradigm approach, focusing on understanding human behaviour within its frame of reference. We conducted exclusively at PT. Agro, the study acknowledges that the company’s policies, including culture and governance, are rooted in the experience and knowledge of PT. Agro’s management, making it inapplicable to other companies.
Discussion Method
This paper digs deeper into risk management practices by applying qualitative methodology through case study analysis at PT—Agro, focusing on the vital role of top management. The successful implementation of risk management is highly dependent on the commitment and direction of the Board of directors, which is crucial in instilling the principles of good governance. In this context, the adopted framework originates from the principles formulated by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in their Enterprise Risk Management (ERM) model. This research highlights how PT. Agro implements the ‘governance and culture’ component of COSO ERM, where the Board of directors and management establish the governance framework, shape the company culture, and instil corporate values that support achieving the company’s strategic goals. The discussion in this paper has subjects (informants) at the director level. The selection of these subjects is based on the consideration that the directors determine the company’s vision, mission, strategic goals, culture, and values that will be adhered to by the company. The types and criteria of informants can be seen in Table 1.
| Position | Criteria |
|---|---|
| President Director | Leading the organization as a whole |
| Responsible for the company's strategic plans | |
| Act as a strategic decision-maker | |
| Director of Finance | Responsible for company finances |
| Act as a strategic decision-maker | |
| Carry out internal supervision. | |
| Carry out strategic financial analysis and planning for the company. | |
| Director of Operations | Oversee the daily operations of the company. Implement strategic policies to increase productivity. Ensure that company operations comply with all applicable laws and regulations. Can make decisions according to their capacity |
| Governance And Culture Setting Process | A list of questions | Answer Research Objective (RO) |
|---|---|---|
| Exercise Board Risk Oversight Principle | Does the board structure at PT? Agro is by the principles of good governance. | RO No. 1 |
| How do you assess whether the activities in the company are by the established strategy? | RO No. 1 | |
| How does management effectively establish performance evaluations for employees? | RO No. 2 | |
| Does management prioritize the internal control process, and what is its established approach? | RO No. 2 | |
| Establishing Operating Structure | How does management establish the operational structure effectively? Provide one example to support the previously mentioned internal control. | RO No. 1 |
| Do you fully understand the process of establishing such a structure? | RO No. 1 | |
| How do you monitor whether the established structure is functioning effectively? | RO No. 2 | |
| Defines Desired Culture | Does the management have a culture implemented in the company? If so, please specify what culture it is. | RO No. 1 and 3 |
| Demonstrating Commitment to Core Value | Does the management have a value implemented in the company? If so, please specify what value it is. | RO No. 1 and 3 |
| Application of the Principles of Attracts, Develops, and Retains Capable Individuals | Does the company highly value employees with competencies? How does the company express appreciation for such competent employees? | RO No. 1 and 2 |
1Internal Validity: Achieved through:
Triangulation: Employing source triangulation by seeking information from various sources, including interviews with key figures like the President Director, Finance Director, and Operation Director at PT. Agro. This ensures accuracy and validity through diverse perspectives. Validity: The validation process of interview results involves a meticulous comparison between the information gathered through interviews and the observations made by the researcher. For example, when examining the formulation of company strategies or articulating its mission and vision, the researcher cross-references the data obtained from interviews with tangible sources such as banners, meeting minutes, or newsletters sourced from the company’s email archives.
This comparative analysis helps ensure the accuracy and reliability of the interview findings by corroborating them with documented evidence and observable aspects of the company’s operations. It allows the researcher to verify the consistency and alignment between the verbal accounts provided during interviews and the tangible manifestations of the company’s strategic direction and organizational objectives as reflected in official communications and records.
This comparative analysis helps ensure the accuracy and reliability of the interview findings by corroborating them with documented evidence and observable aspects of the company's operations. It allows the researcher to verify the consistency and alignment between the verbal accounts Journal providedofduring Business Management interviews and theand Accounting, tangible Vol. 14,ofNumber manifestations 2 (July) the company's 2024, 307-338 strategic direction and organizational objectives as reflected in official communications and records.
DISCUSSION
standardized procedures to achieve confidence in replicability.
The research
Implementation of the Exercisefollows
Board Riskthorough data collection procedures,
Oversight Principle
applies triangulation, and conducts data analysis to minimize
The process of ensuring that the formation of governance and culture is running effectively, so what
needs to beerrors
done is and bias.
to identify theThe results
governance are a components
and culture foundation for ERM,
in COSO furtherwhoseresearch
principle
on COSO ERM implementation across various company
is to exercise board risk oversight. This principle explains that the Board of directors is responsible for
overseeing risk management, vetting critical decisions, and ensuring appropriate risk management
divisions.
DISCUSSION
Implementation of the Exercise Board Risk Oversight Principle
The process of ensuring that the formation of governance and culture is running effectively, so what needs to be done is to identify the governance and culture components in COSO ERM, whose principle is to exercise board risk oversight. This principle explains that the Board of directors is responsible for overseeing risk management, vetting critical decisions, and ensuring appropriate risk management strategies align with the organization’s values. The Board must be independent and competent in understanding risks and ensuring effective risk management practices at PT. Agro, the principal director, requires every activity to be carried out in the company based on good sound management. The risk identification process is carried out at PT. Agro uses the brainstorming method. Brainstorming is defined as an unstructured group discussion session in which participants from various backgrounds contribute to identifying potential risks (Tang & Karim, 2019). Led by the facilitator, these sessions encourage the free expression of ideas to capture the various risks a project or organization may face. All ideas are recorded during the session and grouped to find common themes. These risks are evaluated based on their likelihood and impact, followed by determining priorities and developing follow-up plans. These results and plans are documented for reference and subsequent action, ensuring the team understands the risks and management strategies (Hock et al., 2019). Apart from implementing brainstorming to ensure risk management has been carried out, the directors of PT. Agro also implements several things to ensure that the management supervision process runs effectively, as follows:
1. Forming an internal control and risk management (ICRM) division, where this division monitors and evaluates internal processes, identifies potential risks, and develops controls for mitigation. The ICRM Division also assures the integrity of financial and operational information and protects assets from misuse. By working across departments, this division supports the achievement of the company’s strategic goals through comprehensive risk analysis, process improvement recommendations, and the provision of risk management training. The ICRM Division also develops and implements new systems and procedures to strengthen governance and internal controls. 2. Integration with strategic planning: Integrating risk analysis into strategic planning will benefit the Board of directors by informing and adjusting the company’s strategic direction based on a comprehensive understanding of risk. By utilizing this information, directors will make more informed decisions about where and how to invest company resources. These decisions include adjusting long-term goals, allocating capital, developing policies to manage identified risks, and making strategic decisions that consider the potential impact of risks on the company’s operations and finances. This process ensures the company prepares for existing risks and positions itself to take advantage of opportunities emerging from the dynamic business environment. 3. In establishing Key Performance Indicators (KPIs) for risk management, the Board of directors ensures that the KPIs align with the company’s strategic objectives and risk tolerance. They establish metrics to measure the effectiveness of risk management and regularly monitor the company’s performance against these KPIs. This process involves adjusting KPIs according to changing business and environmental conditions, ensuring the company proactively identifies and addresses risks.
By implementing this, it can be said that PT. Agro has done quite well.
Application of the Principles of Establishing Operating Structure
The following principle establishes an Operating Structure, emphasizing the importance of a clear organizational structure to support risk management. An organization must define how tasks and responsibilities are divided, how business units interact, and who is responsible for certain decisions. The goal is to ensure that everyone in the company understands their role in managing risk and that there is good coordination between different parts of the organization. With a solid operating structure, organizations can more effectively identify, manage, and communicate risks and monitor how those risks are collected over time. One implemented by PT. Agro is a three-line model (TLM) that helps organizations organize and understand their responsibilities in managing risk (Sekar, 2022).
The results of implementing TLM at PT. Agro can be seen in Figure 4 below.
Figure Figure44
Three Lines Method PT. Agro Three Lines Method PT. Agro
In the picture, it can be seen that PT. Agro applied the TLM method. PT. Agro has been running quite effectively; it is just that for the function of the Internal Control & Risk Management division, there needs to be a clear separation between the internal audit and risk management functions even though
In the picture, it can be seen that PT. Agro applied the TLM method. PT. Agro has been running quite effectively; it is just that for the function of the Internal Control & Risk Management division, there needs to be a clear separation between the internal audit and risk management functions even though the division has been separated into the Internal Audit sub-division and the risk management sub- division so that there are no problems arising from side of internal audit independence. However, this has been anticipated by creating an Audit Charter, which explains the function, authorization, and responsibilities of internal audit and risk management.
The TLM model offers a framework that allows management to verify the implementation of corporate governance by COSO ERM principles. Using this method, responsibility for risk management becomes more defined and systematic, allowing risks throughout the company to be managed efficiently. This aims to ensure that the organization is on the right track to achieve the targets and objectives that have been determined. Thus PT. Agro has implemented the Established Operating Structure principle effectively; this can be seen by executing the TLM method well, although there is still a need for improvement in the internal control and risk management division.
Application of the Defines Desired Culture Principle
Furthermore, the company also determines the organizational culture by the following principle: Defining the Desired Culture. Two cultures, namely family culture and BISA culture, have been selected by management. A family culture can be achieved by creating a sense of togetherness, trust, and support between employees, similar to the bonds usually in a family. In a culture like this, relationships between employees are professional, attentive, and caring, focusing on mutual well-being and collective success. The second culture of BISA is employees at PT. Agro is expected to have an attitude that always accepts change, is not afraid of change, is not scared of problems, and is willing to try first to solve the problem until the employee can solve the problem. With a BISA culture, it is hoped that all employees at PT. Agro can better respond to risks faced in daily operational activities, be more sensitive to existing risks, and provide solutions to risks being or will be met. The management methods to socialize this culture through various methods, including:
1. Include company attributes such as company uniforms, calendars, banners, etc.
2. Introduce new employees to the company culture through comprehensive orientation and training sessions. This may include presentations, reading materials, and discussions about company values, vision, mission, and behavioural expectations. 3. Send newsletters via company email. 4. Directors and senior management are examples of corporate culture. Employees often take cues from their superiors’ behaviour, so leaders need to practice what they promote. 5. Integrate cultural values into official company policies and procedures, such as codes of conduct, employee guides, and performance appraisal processes.
However, what PT. Agro is currently a monitoring and feedback process. The process will be done through employee satisfaction surveys, exit interviews, or regular feedback sessions.
Application of the Principle of Demonstrating Commitment to Core Value
The following principle in COSO ERM applied to companies is to Demonstrate Commitment to Core Values. This principle refers to an organization’s concrete actions to ensure that its core values are understood, implemented, and integrated into every aspect of its business operations. These values are used for decision-making, employee behaviour, and overall company strategy. There are four values applied by management to the company, namely IACE, with the following explanation:
1. Integrity. Integrity in corporate values is about adhering to the principles of honesty, transparency, and justice, not only in complying with the law but also in upholding ethics and morality. This means that in every action and decision, the company demonstrates unwavering honesty, consistency in its values, full responsibility for its actions, and openness to information that allows stakeholders to make informed decisions. Integrity is a strong foundation of trust between a company and its employees, customers, investors, and communities. It is essential to building strong relationships and a solid reputation, both critical to long-term success. By implementing the value of integrity, it is hoped that PT. Agro employees can respond to risks that exist in the company with the principle of transparency, not covering up existing risks but rather informing about these risks so that discussions can be held to mitigate these risks immediately. 2. Agility. The value of agility in a company refers to the organization’s ability to move and adapt quickly and efficiently in the face of market changes or internal challenges. This means the company is quick to make decisions, implement new strategies effectively, and always ready to learn and improve. Companies that emphasize agility often encourage innovation and are not afraid to experiment or take calculated risks. Agility value has the hope that PT. Agro employees. Has an agile attitude and can adapt to changes in existing risks. There is no such thing as refusing risk, but we must face these risks appropriately. 3. Collaboration. The value of partnership in a company highlights the importance of teamwork and synergy between employees to achieve common goals. This includes sharing knowledge, supporting each other, and combining expertise to produce better results. Good collaboration leads to more inclusive decision- making and can increase innovation and efficiency. Applying this value is carried out by discussing existing risks at every regular meeting, whether operational, financial, or strategic. It is hoped that by implementing this value, all employees of PT. Agro can be ready to face company risks together. 4. Excellence. The value of excellence in a company refers to a commitment to achieving the highest standards in all operations and work results. This means striving for exceptional quality, not just meeting expectations but exceeding them, and constantly looking for ways to improve. Companies prioritizing excellence focus on developing the best products or services, superior customer experiences, and continuous improvement in internal processes.
Application of the Principles of Attracts, Develops, and Retains Capable Individuals
The final principle in COSO ERM is applied to PT. Agro Attracts, Develops, and Retains Capable Individuals. The principles emphasize the importance of having the right people with the appropriate skills, knowledge, and experience to help the organization achieve its goals. This means organizations must effectively recruit quality talent, provide training and development to enhance their abilities and retain these employees through incentives, a supportive work culture, and clear career paths. The goal is to ensure the organization has robust human resources to manage risks and exploit opportunities effectively. To realize the principle of attracting, developing, and retaining competent individuals, a company must first position itself as an employer of choice that offers more than just competitive salaries. This includes building a strong employer brand that emphasizes an inclusive company culture, opportunities for professional growth, and a commitment to employee well-being. By highlighting these values in recruiting and marketing strategies, companies can attract candidates with the necessary skills and share the company’s vision and values.
After the right talent is obtained, the process is carried out by PT. Agro ensures they have the resources and opportunities to develop their capabilities. This can be done through development programs ranging from formal training to mentorship initiatives and opportunities to engage in challenging projects and expand their skills. In this section, the company offers risk management training to PT. Agro employees are competent and given responsibility for developing risk management in the company. This development must be supported by a performance management system that provides meaningful feedback, recognizes achievements, and sets clear, achievable goals aligned with employee career aspirations and the company’s strategic objectives. The company has implemented the principle of attracting, developing, and retaining capable individuals very well; this can be seen by providing risk management training to employees who are competent and play an essential role in forming the company’s risk management.
All three research objectives have been successfully achieved based on the discussion. Firstly, the research effectively evaluated the Board of directors and management of PT Agro regarding the implementation of COSO ERM governance components and culture. This implementation included steps such as establishing the ICRM division, integrating risk analysis into strategic planning, and defining KPIs for risk management. Secondly, an analysis of the implementation of good corporate governance has been conducted by integrating risk analysis into strategic planning. This step assists the Board of directors make more informed decisions and allocate company resources more effectively. Thirdly, the application of company culture and values at PT Agro has also been analyzed. Management has defined family and BISA (Brave, Innovative, Spirit, Adaptive) cultures as primary focuses, and steps have been taken to socialize and reinforce these cultures throughout the organization. Thus, the overall research has successfully achieved its objectives to evaluate, analyze, and examine the implementation of COSO ERM, corporate governance, and the culture and values of the company at PT Agro. PT Agro has successfully strengthened its governance system, integrated risk management into daily practices, and fostered a corporate culture aligned with the desired values through these initiatives.
CONCLUSIONS AND RECOMMENDATIONS
Conclusion
PT. Agro, which operates in the plantation and essential oil trading sectors, has demonstrated a solid commitment to implementing effective risk management based on the COSO ERM framework. With strong leadership from the Board of directors, this company has successfully integrated risk management practices into its business structure and strategy.
The company’s directors play an essential role in monitoring and implementing risk management, ensuring that every decision taken aligns with the company’s values and strategic objectives. The brainstorming method is used in risk identification, allowing cross- departmental participation to gather various risk perspectives. Furthermore, forming the Internal Control & Risk Management (ICRM) division emphasizes the company’s efforts to monitor, evaluate and control risks internally. Integrating risk management and strategic planning has provided valuable insight to directors in adjusting the company’s strategic direction and decisions. Establishing and monitoring Key Performance Indicators (KPIs) for risk management ensures company objectives align with acceptable risk limits. By carrying out these steps, the principle of Exercise Board Risk Oversight in COSO ERM is the directors and management of PT. Agro has implemented it effectively.
In terms of organizational structure, PT. Agro has implemented the Three Lines Model (TLM), which facilitates the division of responsibilities in risk management and ensures effective coordination between operational, risk monitoring, and internal control functions. Thus, according to the principle of Establishing Operating Structure PT. Agro has implemented this principle well—management of PT. Agro has implemented the two principles of exercising board risk oversight and established an operating structure, meaning that the management of PT. Agro has succeeded in implementing corporate governance quite well. Then, the principle of defining the desired culture was carried out by PT. Agro, where there are two organizational cultures implemented at PT. Agro, which consists of a family culture and a BISA culture, has been instilled through various communication and learning initiatives. However, the company recognizes the need for further development in monitoring and providing feedback on organizational culture. However, because there has not been a continuous monitoring process, PT. Agro has not implemented it fully (partially implemented)—the core values upheld by PT. Agro, represented by the acronym IACE (Integrity, Agility, Collaboration, Excellence), has become fundamental in every aspect of operations and has been integrated into employee behaviour and decision-making processes. The principle of demonstrating commitment to core values has also not been implemented optimally (partially implemented) because the monitoring process has not been carried out routinely or periodically. With the formation of culture and values adhered to at PT. Agro, then PT. Agro has implemented culture and values in its operational activities.
Finally, COSO ERM principles relating to employee recruitment, development, and retention have been adopted by PT. Agro. The company strives to be an attractive employer by offering a supportive work environment, career development opportunities, and recognition of employee contributions. By implementing these five principles, it can be concluded that the process of implementing governance and culture components based on COSO ERM at PT. Agro. It has been carried out quite effectively.
The research was conducted using qualitative methods and relied on primary data obtained from interviews. Limitations of this study include the subjectivity inherent in the president director, finance, and operational director, who determine the company’s governance, strategic plans, and their implementation in daily operational activities. The formulation of these policies is based on personal experiences and benchmarks. Thus, the decisions made by the Board of Directors cannot be considered standardized. Another limitation is that the research was only conducted on PT. Agro, where all operational and financial activities only occur within that company; therefore, the data analysis process and improvement suggestions can only be applied to PT. Agro and cannot be generalized to other companies.
Recommendations
A comprehensive risk management evaluation was conducted on PT. Agro has provided valuable insights, leading to detailed and practical recommendations to enhance the company’s operations. First and foremost, there is a strategic imperative to refine COSO ERM principles, particularly those that still need to be optimally implemented. A focused effort should be directed toward evaluating the embodiment of company culture and values. This evaluative process could involve conducting a meticulous governance audit, including distributing comprehensive questionnaires to a diverse cross-section of company employees. These questionnaires are a tool to gauge employee perceptions and responses to the current implementation of company culture and values. Subsequently, a thorough re-evaluation of the obtained data would identify specific areas for improvement and inform a strategic roadmap for enhancing the assimilation of these principles within the organizational framework.
Furthermore, it is imperative for the management of PT. Agro to foster a culture of periodic evaluation regarding corporate governance and culture implementation. This ongoing assessment should extend beyond the upper echelons of the organizational hierarchy, cascading down to the lowest operational lines, notably the first line. Recognizing that daily operational challenges are inevitable, integrating risk management practices into day-to-day operations is pivotal for effective mitigation. In addition to the aspects mentioned above, a holistic approach to risk management necessitates meticulously examining other crucial COSO ERM components. Strategic objective setting, performance review, revision, information, communication, and monitoring all warrant comprehensive evaluations. Rrigrigal scrutiny of these components will fortify the company’s risk management framework and foster a resilient organizational structure capable of adapting to dynamic business environments.
In essence, by heeding these nuanced recommendations and
implementing them judiciously, PT. Agro stands to fortify its risk management protocols, augmenting its overall organizational resilience and sustainability in the face of diverse challenges and uncertainties.
ACKNOWLEDGMENT
This research received no specific grant from any funding agency in the public, commercial, or not-for profit sectors.
References
- Alazzabi, W. Y. E., Mustafa, H., & Karage, A. I. (2023). Risk management, top management support, internal audit activities and fraud mitigation. Journal of Financial Crime, 30(2), 569–582. https://doi.org/10.1108/JFC-11-2019-0147
- Arisandy, F. N., Wardayati, S. M., Sayekti, Y., Arif, A., Warsito, Prita, S., & Wahyuni, N. E. (2022). Kajian teoritis tentang ukuran perusahaan dan jumlah dewan direksi terhadap kinerja keuangan perusahaan melalui penerapan model COSO Enterprise Risk Management. Jurnal Akuntansi Dan Pajak, 23(1), 1-11. https://doi.org/10.29040/jap.v23i1.5317
- Attaf, W. F., & Bensbahou, A. (2023). Governance of internal audit and its role in adding value A field study at Al-Watania Cement Company (Aden) in the context of improving its environmental management. E3S Web of Conferences, 412, 01080. https://doi.org/10.1051/e3sconf/202341201080
- Clarke, T. (2010). Recurring Crises in Anglo-American Corporate Governance. Contributions to Political Economy, 29(1), 9–32. https://doi.org/10.1093/cpe/bzq002
- Conyon, M., Judge, W. Q., & Useem, M. (2011). Corporate governance and the 2008-09 financial crisis. Corporate Governance: An International Review, 19(5), 399–404. https://doi.org/10.1111/ j.1467-8683.2011.00879.x
- Dhyana Putra, I. G., & Asri Dwija Putri, I. G. A. M. (2020). Pengaruh penerapan prinsip-prinsip good governance dan budaya organisasi terhadap kinerja keuangan. E-Jurnal Akuntansi, 30(8), 2078. https://doi.org/10.24843/EJA.2020.v30.i08.p14 du Plessis, J. J., Hargovan, A., & Harris, J. (2018). Principles of Contemporary Corporate Governance. Cambridge University Press. https://doi.org/10.1017/9781108329453
- Febrianti, I., & Novita, N. (2021). COSO’s Enterprise Risk Management framework in agriculture startup to support the achievement of SDGs pillars. TIJAB (The International Journal of Applied Business), 5(1), 18. https://doi.org/10.20473/tijab. V5.I1.2021.18-36
- Fernando, Y., Chiappetta Jabbour, C. J., & Wah, W.-X. (2019). Pursuing green growth in technology firms through the connections between environmental innovation and sustainable business performance: Does service capability matter? Resources, Conservation and Recycling, 141, 8–20. https://doi.org/10.1016/j.resconrec.2018.09.031
- Gleim Publications. (2021). Study Unit Four Risk Management.
- Handoko, B. L., Septianto, D., & Alyssa, A. (2019). Aplikasi penggunaan enterprise risk management (ERM) integrated framework Coso untuk mendeteksi risiko kecurangan pada transaksi tidak biasa unit bisnis Pt. Doremi Pizza Indonesia [Application of integrated enterprise risk management (ERM) COSO framework to detect fraud risk in unusual transactions at PT. Doremi Pizza, Indonesia]. DeReMa (Development Research of Management): Jurnal Manajemen, 14(1), 134. https://doi.org/10.19166/derema.v14i1.1181
- Hardjomidjojo, H., Pranata, C., & Baigorria, G. (2022). Rapid assessment model on risk management based on ISO 31000:2018. IOP Conference Series: Earth and Environmental Science, 1063(1), 012043. https://doi.org/10.1088/1755-1315/1063/1/012043
- Hassan, M. K., Abdulkarim, M. E., & Ismael, H. R. (2022). Risk governance: Exploring the role of organisational culture. Journal of Accounting & Organizational Change, 18(1), 77–99. https://doi.org/10.1108/JAOC-01-2021-0003
- Hock, B., Burch, C., Hock, K., & Kaluhiokalani, K. (2019). CIA Part I Essentials of Internal Auditing.
- Iansiti, M., & Levien, R. (2004). Strategy as Ecology. Harvard Business Review, 82(3), 68-78.
- Institute of Internal Auditor. (2022). The IIA’s CIA Learning System Part 1. Insitute Internal Auditor.
- Isensee, C., Teuteberg, F., Griese, K.-M., & Topi, C. (2020). The relationship between organizational culture, sustainability, and digitalization in SMEs: A systematic review. Journal of Cleaner Production, 275, 122944. https://doi.org/10.1016/j. jclepro.2020.122944
- Kalia, A., & Gill, S. (2023). Corporate governance and risk management: A systematic review and synthesis for future research. Journal of Advances in Management Research, 20(3), 409–461. https://doi.org/10.1108/JAMR-07-2022-0151
- Karanja, E. (2017). Does the hiring of chief risk officers align with the COSO/ISO enterprise risk management frameworks? International Journal of Accounting & Information Management, 25(3), 274–295. https://doi.org/10.1108/ IJAIM-04-2016-0037
- Karsono, B. (2023). Good Corporate Governance: Transparency, accountability, responsibility, independency dan fairness (literature review). Dinasti International Journal of Management Science, 4(5), 811–821. https://doi.org/10.31933/ dijms.v4i5.1860
- Musallam, S. R. M. (2023). Board of directors and financial performance: The role of risk management in Palestinian-listed companies. Management & Sustainability: An Arab Review. https://doi.org/10.1108/MSAR-06-2023-0030
- Nasal, T., & Gani, L. (2023). Evaluation of internal audit role as a governance, risk and compliance partner, trusted advisor and value driver to implement strategy. Jurnal Ilmiah Akuntansi, 7(2), 346–362. https://doi.org/10.23887/jia.v7i2.47931
- Poddar, A., Narula, S. A., & Zutshi, A. (2019). A study of corporate social responsibility practices of the top Bombay Stock Exchange 500 companies in India and their alignment with the Sustainable Development Goals. Corporate Social Responsibility and Environmental Management, 26(6), 1184–1205. https://doi.org/10.1002/csr.1741
- Rajab, B., & Schachler, M. H. (2009). Corporate risk disclosure by UK firms: Trends and determinants. World Review of Entrepreneurship, Management and Sustainable Development, 5(3), 224. https://doi.org/10.1504/WREMSD.2009.026801
- Ricardianto, P., Lembang, A. T., Tatiana, Y., Ruminda, M., Kholdun, A. I., Kusuma, I. G. N. A. G. E. T., Sembiring, H. F. A., Sudewo, G. C., Suryani, D., & Endri, E. (2023). Enterprise risk management and business strategy on firm performance: The role of mediating competitive advantage. Uncertain Supply Chain Management, 11(1), 249–260. https://doi.org/10.5267/j. uscm.2022.10.002
- Rikaz, S., Ulhaq, A. D., Mulyono, R. H., & Cahyaningtyas, R. (2022). Perancangan COSO Enterprise Risk Management Pada Perusahaan Penerbit Dan Percetakan (Studi Kasus Pada CV.Gema Insani Press). 3rd National Conference on Accounting and Fraud Auditing, 1.
- Roberts, J. J., & Van den Steen, E. (2000). Shareholder interests, human capital investment and corporate governance. SSRN Electronic Journal. https://doi.org/10.2139/ssrn.230019
- Scherer, A. G., Rasche, A., Palazzo, G., & Spicer, A. (2016). Managing for political corporate social responsibility: New challenges and directions for PCSR 2.0. Journal of Management Studies, 53(3), 273–298. https://doi.org/10.1111/joms.12203
- Sekar, M. (2022). Three lines of defense. In Machine Learning for Auditors (pp. 3–12). Apress. https://doi.org/10.1007/978-1-4842-8051-5_1
- Sugiyono. (2010). Metode Penelitian Pendidikan Pendekatan Kuantitatif, Kualitatif, dan R&D. Alfabeta.
- Sun, W., Stewart, J., & Pollard, D. (Eds.). (2011). Corporate Governance and the Global Financial Crisis. Cambridge University Press. https://doi.org/10.1017/CBO9780511736599
- Tang, J., & Karim, K. E. (2019). Financial fraud detection and big data analytics – implications on auditors’ use of fraud brainstorming session. Managerial Auditing Journal, 34(3), 324–337. https://doi.org/10.1108/MAJ-01-2018-1767
- The Institute of Internal Auditors. (2017). International Professional Practices Framework (IPPF). The IIA Research Foundation.
- Wahyuni, R. S., & Novita, N. (2021). COSO ERM Framework as the Basis of Strategic Planning in Islamic Banking. Jurnal Keuangan Dan Perbankan, 25(1). https://doi.org/10.26905/ jkdp.v25i1.5123
- Yeoh, P. (2010). Causes of the global financial crisis: Learning from the competing insights. International Journal of Disclosure and Governance, 7(1), 42–69. https://doi.org/10.1057/jdg.2009.18
- Zain, M. (2022). Study Book CIA Part 1.