Risk governance as a line of defense: Systematic review of hotspots for future research

Abstract

To forestall future financial crises, risk governance has been embraced as a line of defense. Therefore, this paper seeks to synthesize the risk governance literature, identifying gaps, and suggesting direction for future research, through a systematic literature review (SLR). Analyzing 151 papers from the Scopus and Web of Science databases, this paper finds a steady increase in academic work on risk governance. Using the theory, context, characteristics, and methodology (TCCM) framework, the study emphasizes the importance of chief risk officers, geographical context coverage, and effectiveness and regulation of risk governance. Methodologically, endogeneity issues are a major concern for researchers, agency theory (AT) being the most popular theory used. Finally, moderating and mediating variables that affect risk governance are identified as important but under-explored. While providing practitioners and policymakers with a framework, empirical testing is encouraged. The study contributes to SDG Goal 8, Target 10 of strengthening financial institutions and promoting a resilient financial system.

Keywords:

• Risk governance
• risk committee
• chief risk officer
• enterprise risk management
• risk taking
• TCCM framework

PUBLIC INTEREST STATEMENT

Risk governance has been sanctioned as a line of defense to safeguard against cyclical global financial crisis or bank run. This research employs a systematic review to show the structure of knowledge on risk governance, trends and major themes. Relevant articles extracted from SCOPUS and web of science spanning 1960-2021 were evaluated. The findings show that the chief risk officer role, and risk governance’s moderating and mediating relationship are under-explored. To guide policymaking, empirical testing, and future studies, a conceptual framework and direction for future research are provided.

1. Introduction

Risk Governance is a key pillar of Sustainable Development Goal (SDG) 8 target 10 of strengthening financial institutions’ capacity. To forestall future global financial crises, financial system regulators have sanctioned a three-tier risk governance line of defense. Management control serves as the first line of defense followed by a second line anchored on compliance oversight and risk control, whereas independent assurances oversight provided by the board and audit is the third and last line of defense (IFC, 2012; IIA, 2013; Lim et al., 2017). Stein and Wiedemann (2016) suggest that risk governance should be approached as a dynamic capability that enables businesses to adapt their policies to changing competitive environments and improve the alignment between a firm’s strategy, structure, processes, and environment in relation to risk. Erin and Aribaba (2021) note that risk governance allows firms to be actively involved in the risk process, risk implementation, risk reporting, and disclosure. Evidence suggests that banks with a Chief Risk Officer (CRO) and an experienced risk committee were less risky during the 2008 financial crisis (Srivastav & Hagendorff, 2016). Similarly, the absence of an independent CRO and/or risk committee in most banks during the crisis has emphasized the need for risk governance in banks (Himaj, 2014). A board’s capacity to provide effective risk supervision is also dependent on accurate risk assessment and timely disclosure by the risk committee (Srivastav & Hagendorff, 2016). Hence, the most advocated policy response, particularly in the aftermath of the 2008 global financial crisis, is to strengthen risk governance (Himaj, 2014).

Risk governance has been widely studied, including literature reviews (Bufarwa et al., 2020; Elamer et al., 2018; 2019; Lu et al., 2022; Nguyen et al., 2020; W. N. Abdullah & Said, 2019). It has been analyzed in corporate governance (Himaj, 2014; Nguyen et al., 2020; Srivastav & Hagendorff, 2016), risk disclosure (Elamer et al., 2021; Ibrahim et al., 2022), and board committee literature (Alhossini et al., 2021; Kolev et al., 2019; Sassen et al., 2018), with one study embracing risk meta-analysis (Sassen et al., 2018). The review of all board subcommittees dominates board committee reviews, with Alhossini et al. (2021) and Kolev et al. (2019) addressing audit committee, compensation committee, nomination committee and other committees, whereas Sassen et al. (2018) carried out meta-analysis on board committee overlap. As these studies focus on all board sub-committees, the risk committee does not receive adequate attention. This is considered a specialist committee (Alhossini et al., 2021) and according to Kolev et al. (2019) the board’s ability to tackle complex issues is enhanced by its use of the risk committee. Although studies addressing single board committees, such as technology committee (Harrast & Swaney, 2019) and audit committee (Alhossini et al., 2021) are known, studies focusing solely on board risk committee are rare.

From the above, as the risk committee literature is normally embedded within risk governance, this paper bridges this research gap by mapping/disclosing the structure of knowledge on risk governance and offers a framework to explain the risk governance dimensions, relationships and outcomes, regarding the risk committee specifically. The following specific research questions guide this systematic literature review (SLR):

RQ1:

What is the trend in risk governance publications?

RQ2:

What are the methodological and theoretical choices of risk governance scholars?

RQ3:

In what contexts has risk governance been studied?

RQ4:

Which risk governance perspectives merit further exploration?

In order to accomplish these goals, and to advance a comprehensive overview of the risk governance—risk committee research field, an SLR was carried out using both the Web of Science (WoS) and SCOPUS databases. After screening 229,519 articles, our seven-step screening protocol yielded 151 acceptable papers for the study. Applying the theory, context, characteristics, and methodology (TCCM) framework, to organize the findings (Paul & Rosado-Serrano, 2019; Paul et al., 2023), our review found: a steady increase in academic work on risk governance; agency theory (AT) as the most popular theory in discussions of risk governance; that regression analysis was employed in over 85% of the studies; that while the economies of the United States, Malaysia, Australia, and Nigeria have attracted most attention, studies that compare and contrast multiple countries are rare and even fewer studies take a truly global perspective; that research spanning multiple sectors, not just in the banking sector, are encouraged; that scholars should explore mixed methods as opposed to over-reliance on annual reports for risk governance studies. Moreover, we identify moderating and mediating variables that affect risk governance, which are important but under-explored. Finally, delving deeply into risk governance dimensions, our review identifies several under-explored areas within each dimension, suggesting future strands that could advance knowledge of risk governance.

This study makes several contributions to the literature on risk governance. Firstly, it provides a comprehensive overview of the research in this field and proposes a framework for understanding the relationship between risk governance dimensions and financial outcomes, which can stimulate further discussion and research. Secondly, we examine risk governance mechanisms that go beyond financial institutions, which are required by regulators to maintain a risk committee, to other sectors that choose to maintain a risk committee voluntarily. Thirdly, we address the gap in the literature by sourcing data from both the Web of Science and Scopus databases, rather than relying on a single database as previous reviews have done (Galletta et al., 2021; Karyani et al., 2021; Kolev et al., 2019; Pandey et al., 2023). Fourthly, our review adds to the corporate governance literature by highlighting the significance of risk committees as specialized board sub-committees (Kolev et al., 2019). Finally, our study contributes to achieving United Nations Sustainable Development Goal 8, target 10, which aims to strengthen financial institutions’ capacity and promote a resilient financial system.

The rest of the study is organized as follows. After this introduction, the methodology is described in section 1, followed by presentation of the results in section 2. Section 3 presents the discussion. Finally, section 4 concludes the study, indicating a direction for future research and conceptual framework.

2. Method

We used an SLR method to achieve our research objectives. The SLR is a valuable approach because it uses a transparent and reproducible methodology to source and synthesize knowledge (Karyani et al., 2020). It also provides a comprehensive view of the existing literature. The SLR technique was used because it aids in mitigating bias and increases the likelihood of reproducibility. Our SLR follows the PSALSAR(Protocol, Search, Appraisal, Synthesis, Analysis and Report) integrated approach (Mengist et al., 2020; Paul et al., 2023; Yeboah, 2023). The PSALSAR six-step approach to SLR involves Protocol (specifying the research scope), Search (establishing the search string and database(s)), Appraisal (predefining inclusion and exclusion, and quality assessment criteria), Synthesis (exploring, extracting and categorizing the data), Analysis (summarizing the result and conclusion), and Reporting (communicating the methodology and result). The PSALSAR methodological approach ensures exhaustiveness, systematization, methodological accuracy and replicability (Mengist et al., 2020). Table 1 and Figure 1 summarize our PSALSAR protocols. We followed this step-by-step approach to synthesize the risk governance research field, in line with the recommendations of previous studies (Aebi et al., 2012; Karyani et al., 2020).

Figure 1. Article selection Process.

Table 1. Search Protocol

Search Protocol	Narrations
Keywords	“Risk Governance” OR “Risk committee” OR “Risk management committee” OR “chief risk officer” OR “Board risk oversight” OR “CRO” OR “Enterprise risk management” OR “Board risk committee” OR “Risk governance structure” OR “Voluntary risk management committee”
Time Span	1960–2021
Data Search date	December, 2021
Databases	Web of Science (WOS) and Scopus
Research Categories/Subject Area	WOS dataset limit to Business, Business Finance, Economics and management SCOPUS Subject Area was restricted to Business, Management and Accounting; and Economics, Econometrics and Finance

2.1. Search strategy

In order to find studies that were pertinent, we selected the search strings. As stated by Rowley and Slack (2004), search strings have to be precise. In order to finalize our keyword search, we did some preliminary study to familiarize ourselves with the prevailing literature on risk governance issues. Our search terms were broadened enabling us to capture literature with a variety of taxonomies. After trying different combinations of search terms, we settled the search keywords, as shown in Table 1.

2.2. Data sources

We applied our keywords on the Web of Science (WoS) and SCOPUS databases on 31 December 2021. The use of both WoS and SCOPUS for SLR has been advocated as these are the largest databases that index the most extensive peer-reviewed scientific research across multiple disciplines and subjects (Galletta et al., 2021; Y. F. Kuo et al., 2021).

2.3. Inclusion and exclusion criteria

Inclusion, exclusion and quality assessment criteria, following prior research, helped us to focus on the most relevant studies for our research objectives (Alhossini et al., 2021; Khan et al., 2022; Yeboah, 2023), as described in Table 2.

Table 2. Summary of Inclusion, Exclusion and Quality Assessment Criteria

Inclusion
WOS and Scopus screening	All English-language peer-reviewed journal articles from January 1960 to December 2021 in business, finance, accounting, economics and management with search terms in their title, abstract, or keywords were included.
Quality assessment	Journals with an annual impact factor of at least 1.0 (Paul & Rosado-Serrano, 2019; Paul et al., 2023)
Exclusion Criteria
Exclusion criteria (1)	Conceptual articles, editorials, book chapters, conference papers, and commentaries were not considered.
Exclusion criteria (2)	Papers that examine the board of directors in general without investigating risk committees were excluded.
Exclusion criteria (3)	Papers published in journals with a lower impact factor or in journals without an impact factor were excluded.
Exclusion criteria (4)	Duplicated papers on both databases were excluded

We also followed the screening and eligibility protocols adopted by previous SLR studies (Gulati, 2021; Kafidipe et al., 2021; Mengist et al., 2020). After following the SLR protocols recommended by previous studies and the steps outlined in Table 1 and Figure 1, we identified 151 articles suitable for the study. Finally, we used content analysis to identify trends, hotspots, gaps, and a future research agenda in the field of risk governance. All co-authors conducted three rounds of coding independently, and the final coding results were reviewed by all to reach consensus on the themes. Our multi-stage coding and results validation approach has been widely used in previous SLR studies (Chen et al., 2021, 2021).

2.4. Theoretical framework for review analysis

There are several theoretical framework-based SLRs. Paul et al. (2023) summarized framework-based SLRs to include TCCM (theories-contexts-characteristics-methods), ADO (antecedents-decisions-outcomes), 5W+H (who, when, where, what, why, how), IMO (input-mediator-outcome), SPAR-4-SLR and PRISMA. This study applied TCCM because of its comprehensibility, versatility and wide usability as a framework for SLR (Paul et al., 2023).

The 151 articles were scrutinized following an interpretative synthesis, as followed by Jones et al. (2011) and Moreira et al. (2023). The main themes covered were inductively derived as a result of the main arguments, theories, concepts, contexts, characteristics, ideas and methods covered in the 151 manuscripts. A content and thematic analysis was carried out to capture the explanatory core perspective and the main methods used in order to address the TCCM approach referred to above.

3. Results

3.1. Defining risk governance

Risk Governance has been defined by industry players (BCBS, 2015; FSB, 2013; IFC, 2012; IRGC, 2008; SRA, 2018) and scholars (Ames et al., 2018; Jankensgård, 2019; Lundqvist, 2015; Renn & Katherine, 2008). Most industry players largely define risk governance as identification, assessment, management and communication of risk (IFC, 2012; IRGC, 2008; SRA, 2018). Financial service regulators emphasize the role of the board, CRO and management assurances in the definition of risk governance (BCBS, 2015; FSB, 2013). Definitions offered in the scientific field are also aligned with the industry definition. Early scholars’ risk governance definitions focused on risk identification and management (Lundqvist, 2015; Nahar, Jubb, et al., 2016; Renn & Katherine, 2008; Stein & Wiedemann, 2016). Recent studies define risk governance and assign risk governance responsibility to the board, risk committee, CRO and management assurances (Ames et al., 2018; Jankensgård, 2019). Notably, Jankensgård’s (2019) definition highlights the importance of linking the firm risk management decision to the firm objectives. In this study, we define risk governance as risk defensive mechanism, stakeholder risk ownership and leadership that enable firms to identify, evaluate, control and communicate risk for shareholder maximization. Additionally, for this research, risk governance encompasses risk governance mechanisms including risk committee, enterprise risk management, board risk oversight and the role of CRO fashioned to contain risk. Table 3 includes a variety of risk governance definitions from both practical and academic sources.

Table 3. Risk Governance scientific definitions

Author(s)	Definition(s)
Part A: Risk Governance scientific definitions
Renn & Katherine D. Walker (2008, p. 9)	..involves the “translation” of the substance and core principles of governance to the context of risk and risk-related decision-making
Lundqvist (2015, p. 442)	..the marriage of corporate governance and risk management, and it is the identifying component of an enterprise risk management system
Nahar, Jubb, et al. (2016, p. 250)	..relates to the rules, processes and procedures that help to identify the risk(s) and take corrective actions accordingly.
Stein and Wiedemann (2016, p. 828)	..a regulative system at a higher-order level, designing risk regulation models for risk management, determining model risks, performing research and development in risk issues.
Ames et al. (2018, p. 131)	..risk management-related corporate governance mechanisms, such as chief risk officers and board risk committees.
Jankensgård (2019, p. 574)	.. a set of mechanisms by which the Board of Directors ensures that managers, at all levels of a decentralized organization, undertake the risk management decision that are in the best interests of the firm.
Part B: Risk Governance definition by financial a regulators, industry
IRGC (2008, p. 3)	..identification, framing, assessment, management and communication of risks in a broad context.
IFC (2012, p. 7)	..the principles of good governance, applied to the identification, assessment, management and communication of risk. It incorporates the principles of accountability, participation, and transparency in establishing policies and structures to make and implement risk-related decisions.
FSB (2013, p. 6)	..the role and responsibilities of the board, the firm-wide CRO and risk management function, and the independent assessment of the risk governance framework
BCBS (2015, p. 2)	..overall framework through which the board and management establish and make decisions about the bank’s strategy and risk approach; articulate and monitor adherence to risk appetite and risk limits vis-à-vis the bank’s strategy; and identify, measure, manage and control risks
SRA (2018, p. 8)	..The application of governance principles to the identification, assessment, management and communication of risk

3.2. Annual scientific publication

Figure 2 shows the trend in the production of scientific articles in the field of risk governance research over the years, in response to research question 1 (RQ1). As can be seen, there has been a steady increase in the number of academic studies on risk governance published annually since 2005. Early studies in this field tended to focus on defining concepts, which can be attributed to the aftermath of the 2008 financial crisis. However, the field gained more proponents starting in 2015 with a surge in risk governance research since then, with a peak of 37 articles in 2021. On average, 11 articles were published annually between 2005 and 2021. The list of 151 research studies, organized chronologically and coded by year of publication, can be found in Table A.1 in the appendix. The data in Figure 2 and the direction of future research suggest that this field will continue to grow.

Figure 2. Annual Scientific Publication.

3.3. Theoretical choices

Several theories have been employed to support the theoretical foundation for empirical examination of risk governance. Scholars aligned their studies using theories from disciplines including psychology, sociology, organizational behavior, finance and management. Agency theory (AT) was the most widely used theory, with 79 articles using it in explaining risk governance. According to AT, risk is prevalent due to the rent-seeking and opportunistic behavior of managers. Zhang, Li, and Ortiz (2021) identified three areas in which AT is relevant to risk governance research: the operationalization of risk management by the board to control risk appetite; identification, monitoring, and management of risk by an empowered risk committee; and active management and reporting of risk by an empowered Chief Risk Officer directly to the board.

Resource Dependence Theory (RDT), which was used in 22 studies, has proven to be beneficial in risk governance research. Through the lens of RDT, firms are responsible for facilitating access to critical resources, reducing external shocks, and promoting sustainability (Jia, 2019; Wu et al., 2016). Signaling theory (ST) is another theory that supports 17 risk governance studies. ST posits that effective risk management signals to the market that a firm has good corporate governance practices (M. B. U. Bhuiyan et al., 2020; Sekome & Lemma, 2014; Yahaya et al., 2020). Our analysis also shows that stakeholder theory and legitimacy theory each had 13 observations in the risk governance literature. While stakeholder theory focuses on prioritizing the collective interests of stakeholders in risk management (Chairani & Siregar, 2021; Ghazieh & Chebana, 2021), legitimacy theory encourages firms to engage in desirable activities to protect long-term sustainability (Chairani & Siregar, 2021; Erin, Adebola, et al., 2020).

Stewardship theory and resource-based view theory were mentioned eight times each, while Institutional Theory was referenced by 11 publications. Contingency theory was examined four times. Additionally, Audit Pricing Theory, Proprietary Cost Theory, and Upper Echelons Theory were each referenced three times. Finally, Table 4 contains the rest of the theories in risk governance research, namely portfolio theory, decision usefulness theory, deep pocket theory, deposit money bank loan theory, helping hand theory and busyness theory. Few papers applied co-evolution theory, litigation theory, managerial hegemony theory, neo-institutional theory, option theory, grabbing hand theory, social mirror theory and value maximization theory.

Table 4. Theories applied to explain risk governance

No.	Theory†	Usage† Freq.	Exemplary Articles codes
1	Agency Theory	79	[21],[33],[41],[54],[74],[83],[103],[112],[127],[130]
2	Resource Dependence Theory	22	[8],[27],[57],[117],[120],[125][136],[138],[146],[147],
3	Signaling Theory	17	[10],[15],[28],[66],[98],[114],[128],[136],[139],[143]
4	Stakeholder Theory	13	[13],[26],[32],[34],[59],[70],[84],[94],[133],[142],[146]
5	Institutional Theory	11	[15],[20],[22],[24], [25],[55],[75],[78],[90],[113],[149]
6	Legitimacy Theory	13	[34],[59],[64],[80],[85],[101],[111],[126],[139],[142]
7	Stewardship Theory	8	[26],[62][94],[95],[97],[116],[150],[116]
8	Resource-Based View Theory	8	[34],[59],[64],[97],[110],[124],[136],[142]
9	Contingency Theory	4	[2], [101],[115],[119]
10	Audit Pricing Theory	3	[132],[134], [135]
11	Proprietary Cost Theory	3	[32],[113], [133]
12	Upper Echelons Theory	3	[51],[138],[150]
13	Portfolio Theory	2	[5], [91]
14	Decision Usefulness Theory	1	[30]
15	Deep Pocket Theory	1	[47]
16	Deposit Money Bank Loan Theory	1	[140]
17	Helping Hand Theory	1	[110]
18	Busyness Theory	1	[62]
19	Co-Evolution Theory	1	[141]
20	Litigation Theory	1	[32]
21	Managerial Hegemony Theory	1	[96]
22	Neo-Institutional Theory	1	[37]
23	Option Theory	1	[78]
24	Grabbing Hand Theory	1	[110]
25	Social Mirror Theory	1	[132]
26	Value Maximization Theory	1	[35]

†Note: some articles applied multiple theoretical perspectives. Moreover, we summarized theories as reported in the articles.

Our findings also show that researchers merely refer to theories without delving into them in depth or drawing on them when formulating hypotheses (see Battaglia & Gallo, 2015; Galletta et al., 2021; Larasati et al., 2019; M. B. U. Bhuiyan et al., 2020; Mardessi & Ben Arab, 2018). Other studies did not even indicate the theoretical framework used (e.g., Chavarín, 2020; Hoque et al., 2013; Magee, Schilling, et al., 2019; Raouf & Ahmed, 2020). These findings provide an answer to RQ2 on the theoretical choices of risk governance scholars.

3.4. Methodological choices

Table 5 shows that the majority (85%) of studies, in response to research question 2 (RQ2), utilized a quantitative approach, with regression analysis being the most common method employed. OLS regression was the most popular, with 40 studies, followed by panel regression, which was used in 19 studies. GMM and logistic regression were utilized in 15 and 12 studies, respectively. 11 studies conducted 2SLS regression analysis, while multivariate regression was applied in 10 studies. Probit regression was used in 8 studies, but three recent studies have explored hierarchical regressions (Erin & Aribaba, 2021; Erin, Adebola, et al., 2020; Farhan et al., 2020). In a novel study, Nahar and Jahan (2021) justified the use of 3SLS regressions when they tested the moderating effect of a risk committee in 160 banks in 45 countries.

Table 5. Analysis Technique Employed

No.	Analysis technique†	Articles Freq.	Article (%)	Exemplary Articles Codes
1	OLS regression	40	26.49	[7],[9],[13],[22],[42],[50],[54],[58],[69],[77],[120],[131]
2	Panel regression	19	12.58	[26],[29],[35],[51],[66],[91],[99],[119],[142],[139],[140],
3	GMM Regression	15	9.93	[14],[90][93],[103],[101],[109],[126][130],[129],[148],
4	2SLS regression	11	7.28	[33],[12],[34],[37],[47],[64],[86],[87][110],[127],[132]
5	3SLS regression	1	0.66	[136]
6	Regressions	10	6.62	[5],[21],[40],[55],[79][85][100],[101],[145],[146]
7	Regressions (Multivariate)	10	6.62	[18],[19],[39],[43],[59][61],[96],[98],[117],[118]
8	Hierarchical regressions	3	1.99	[111], [115][128]
9	Logistic regression	12	7.95	[1],[3],[4],[15],[16],[52],[71],[74][83],[105][112],[149]
10	Probit regression	8	5.30	[10],[20],[24],[28],[89],[123][143]
11	Propensity score model	7	4.64	[20],[2],[84],[105],[151],[134],[147]
12	Data envelopment analysis	5	3.31	[31],[45],[63][106],[122]
13	SEM	2	1.32	[57],[114],
14	Factor analysis	2	1.32	[23],[138]
15	ANOVA	1	0.66	[113]
16	Mann—Whitney U-test	1	0.66	[44]
17	T-test	2	1.32	[44],[124],
18	Chi-square	1	0.66	[60]
19	Meta-analysis	1	0.66	[62]
		151	100

†Note: some studies applied multiple methods. We summarized techniques applied in the studies under review.

Seven studies were found to be based on the propensity score model, while five studies applied data envelopment analysis (DEA). Factor analysis and Structural Equation Modeling (SEM) were used independently in two studies. Furthermore, few studies perform mean deferential analysis including ANOVA; Mann—Whitney U-test; T-test and Chi-square. Finally, Sassen et al. (2018) survey risk governance intellectual structure with meta-analysis.

3.5. Geographical coverage

To answer RQ3, Table 6 shows that single country studies dominate the research field, with 80% of the papers (120 studies) being single country studies. The financial systems of the United States, Malaysia, Australia, and Nigeria have received most attention, although risk governance is a global issue. The United States was the most studied country with 24 studies, while Brazil and Mexico were studied for the Latin America and Caribbean continent with only two studies each. In Europe, Italy, Spain, and the United Kingdom had two studies each, while Romania and Turkey had one study each. Asia was the most studied continent, led by Malaysia (20 studies), followed by Australia (15 studies) and Indonesia (8 studies). Other Asian countries studied include India, Bangladesh, China, Palestine, Saudi Arabia, Iran, Japan, Kuwait, Qatar, and Taiwan. In Africa, Nigeria led with 15 studies, followed by Tunisia, Ghana, Ethiopia, and South Africa.

Table 6. Geographic coverage

Continent	Country	RC	Alone RC	CRO	ERM	RC&CRO&ERM	RC& CRO	RC& ERM	CRO& ERM	Total
World	G8	1								1
	OECD						1			1
	Cross Continent	2					1		1	4
America	USA	5	2		7	3	4	2	1	24
Europe	Italy	1				1				2
	Span				1	1				2
	UK	1						1		2
	Romania				1					1
	Turkey	1								1
	Cross EU	2			1		2			5
	EU-15	1					1			2
	Nordic				1					1
Africa	Nigeria	5			4	3		3		15
	Tunisia	3							1	4
	Ethiopia	1								1
	Ghana					1		1		2
	South Africa		1							1
	SSA	1								1
Asia	Malaysia	12	6		1		1			20
	Australia	8	6		1					15
	Indonesia	2	3					3		8
	India	3					2			5
	Bangladesh	3								3
	China					1	2			3
	Palestine	2								2
	Saudi Arabia	2								2
	Iran				1					1
	Japan				1					1
	Kuwait		1							1
	Qatar	1								1
	Taiwan				1					1
	Cross Asia	3		1			2			6
	GCC	3	1				1			5
	ASEAN-5	1				1	2			4
	MENA						1			1
Latin America& Caribbean	Brazil				1					1
	Mexican						1			1
	Total	64	20	1	21	11	21	10	3	151

RC=Risk Committee; CRO=Chief Risk Officer; ERM=Enterprise Risk Management

Only a few studies have a global outlook (Hossain & Farooque, 2019; Ittner & Oyon, 2020; Magee, Schilling, et al., 2019; Mollah et al., 2019; Nahar & Jahan, 2021; Y. Yeh et al., 2011). Cross-country studies are sparse. Both Asia and Europe documented limited cross-country studies. Whereas 16 cross-country studies were reported in Asia, Europe exhibited eight cross-country studies. A Sub-Saharan study conducted by Yahaya et al. (2020) is the only cross country study in Africa. Latin America and the Caribbean are the least studied region, with no cross-country studies. Table 6 shows the distribution of articles across geographical regions.

3.6. Industry focus of risk governance studies

Also related with RQ3, risk governance studies span industries, with a wide range of industries being studied besides financial institutions. Universal banks are the most studied, with 46 reported studies, as they are required by regulation to maintain a board-level risk committee. A broad range of financial institutions were also studied, with 17 reported studies. In addition, specialized financial services, including insurance, dual banking, Islamic banking, and private banking, have attracted the attention of scholars.

It is noteworthy that a significant 34 studies have been conducted using multi-industry samples drawn from both financial and non-financial industries. Non-financial firms were the focus of 28 studies, while Arsad et al. (2021) conducted a study among Islamic non-financial firms. The manufacturing industry was also included, with studies of manufacturing firms and fast-moving consumer-goods (FMCG) firms (Rimin et al., 2020). The frequency of studies by industry is summarized in Table 7.

Table 7. Industry context of Risk Governance studies

Industry classification of Firms†	RC	Alone RC	CRO	ERM	RC&CRO &ERM	RC& CRO	RC& ERM	CRO& ERM	No. of Studies	%
Universal Banks	19	1		6	2	15	3		46	30.46
Financial And Non-Financial	12	8		6	3		3	2	34	22.52
Non-Financial Firm	14	7		5	2				28	18.54
Financial Institution	7	2			4	2	1	1	17	11.26
Insurance	4	1		4		1	3		13	8.61
Dual Banking	1					3			4	2.65
Islamic Banks	3		1						4	2.65
Private Bank	2								2	1.32
Islamic Non-Financial Firm	1								1	0.66
Fast-Moving-Consumer-Goods (FMCG)		1							1	0.66
Manufacturing Firms	1								1	0.66
Total	64	20	1	21	11	21	10	3	151	100

†Note: We are referring to industries as reported in the articles

RC=Risk Committee; CRO=Chief Risk Officer; ERM=Enterprise Risk Management

3.7. Risk governance dimension

Finally, to complete the answer to RQ3, we document research on risk governance dimensions. We observe in Tables 6 and 7 that 106 studies, representing 70.2% of the research in the field, study a single dimension of risk governance, while the remaining 45 studies, accounting for 29.8%, consider multi-dimensional risk governance. However, concerns have been raised about the use of a unitary measurement of risk governance. These concerns have led scholars to construct a risk governance index (RGI) (Aljughaiman & Salama, 2019; Zhang, Li, & Ortiz, 2021).

RGI has been developed based on risk governance guidelines issued by the Basel Committee for Banking Supervision (BCBS) in 2015 and the International Financial Council (IFC) in 2012, and its development can be traced back to the work of Ellul and Yerramilli (2013). There have been a number of different versions of the RGI constructed, including ones with five indicators (Prakash et al., 2021), 17 items (Karyani et al., 2020, 2021), 19 elements (Raouf & Ahmed, 2021), and 22 items (Fakhfakh & Jarboui, 2020). The RGI has also been applied to different types of financial institutions, including insurance firms and banks in the dual banking system.

The effects of the RGI on financial institutions have been mixed. Some research has found that financial institutions with a stronger RGI are less vulnerable to the sovereign debt crisis (Dupire et al., 2021) and have a lower predicted default frequency for insurance firms (Magee, Schilling, et al., 2019). The RGI has also been found to contribute to enhancing financial stability in a dual banking setting (Raouf & Ahmed, 2021). In terms of risk-taking behavior, a higher RGI has been found to lower tail risk and increase return on assets (Ellul & Yerramilli, 2013), and to influence the risk-taking of banks (Zhang, Li, & Ortiz, 2021). However, other research has found a negative association between the RGI and risk-taking (Aljughaiman & Salama, 2019), and no effect of the RGI on the profitability of Asian banks (Karyani et al., 2020).

To delineate and encompass diverse aspects of risk governance, research in the field reports two or more risk governance dimensions. As shown in Tables 6 and 7, two dimensions dominate multi-dimension risk governance studies.

Our review shows that 21 studies focused on the role of RC and CRO. There is mixed evidence on the impact of the risk committee and CRO on risk and performance outcomes. Some studies have found that the presence of a risk committee or CRO can influence risk-taking (Aljughaiman & Salama, 2019; Hines & Peters, 2015), while others have found that they tend to make banks less risky (Lee et al., 2020). The presence of powerful owners has also been found to limit the presence of both the risk committee and CRO (Dupire & Slagmulder, 2019). In terms of the relationship between the risk committee, CRO, and Enterprise Risk Management (ERM), some studies have found that the risk committee can significantly impact ERM disclosures (Farida et al., 2019) and promote better ERM practices and financial and market performance (Horvey & Ankamah, 2020). The presence of a CRO has also been found to be positively correlated with a higher degree of ERM implementation (Mardessi & Ben Arab, 2018) and ERM sophistication (Ittner & Oyon, 2020). However, other research has found that while ERM adoption is not necessarily associated with changes in firm performance, the presence of a CRO can actually reduce performance (Otero González et al., 2020). In more comprehensive studies considering the interplay of the risk committee, CRO, and ERM, the risk committee and ERM have been found to have a positive and significant effect on reducing cybercrime, while all three factors have been found to significantly and positively impact firms’ financial performance (Erin, Bamigboye, et al., 2020).

3.8. Risk governance gender diversity

There is a debate in the literature about the value of gender diversity in risk governance. Some studies have suggested that having women on the risk committee sends a positive signal to external stakeholders (M. F. Malik et al., 2021), but others have raised concerns that including women on the committee may be seen as tokenism rather than genuine diversity (M. F. Malik et al., 2021). In support of this view, M.Malik et al. (2021) found that the presence of women on the risk committee had a significantly negative effect on stock market value, suggesting that female members were treated as representations rather than fully utilized.

Despite these concerns, other research has highlighted the potential benefits of gender diversity in risk governance. M. Malik and Shafie (2021) argued that the presence and participation of women on the risk committee can enhance productivity and efficiency. Aldhamari et al. (2020) found that women members of the risk committee devoted more time to risk management functions and performed better as monitors of risk. Jia (2019) found that having more women than men on the risk committee who have financial expertise was more effective in reducing financial distress. Aldhamari et al. (2020) also reported that higher representation of women on the risk committee was associated with stronger ERM and financial performance, and Aldhamari et al. (2020) found that the gender composition of the risk committee was positively and strongly linked to accounting performance. On the other hand, M. Malik and Shafie (2021) were unable to find evidence that the presence of female members on the risk committee had a significant impact on audit fees, and among US-listed firms, the presence of female directors on the risk committee was found to be negatively and significantly related to financial constraints risk (M. Malik & Shafie, 2021). There has been relatively little research on the diversity of the CRO or the chair of the risk committee.

3.9. Conceptual framework

Figure 3 presents a conceptual model that integrates all aspects of risk governance to provide a holistic understanding of the topic. This framework can be used to guide future research and improve understanding of risk governance. The model suggests that risk governance should be conceptualized as a multidimensional concept, comprising risk committee (Alhajri, 2017), ERM (Callahan & Soileau, 2017), the CRO (Amoozegar et al., 2017), and board level risk oversight (M. Beasley et al., 2021). The interaction of these broader dimensions helps to effectively cover risk. Board level risk oversight is a critical layer in strengthening risk governance. Our review also highlights the under-researched role of the CRO and the lack of exploration of mediation and moderation relationships in the field of risk governance.

Figure 3. Risk Governance Framework.

4. Discussion and future research direction

Our review maps the intellectual structure of risk governance research to identify trends, hotspots, and gaps in the field (to answer RQ4). Previous research has examined various dimensions of risk governance, with a significant focus on risk committees and reliance on annual reports for empirical studies. The role of the CRO has received limited attention. There is also a lack of research on gender diversity in risk governance, particularly with regard to CRO gender, the gender of risk committee chairs, and the presence of female experts on risk committees. Our review also reveals that few studies have a global perspective and cross-country research is scarce. Additionally, only a few studies have explored the mediation and moderation relationships in risk governance. Based on our review, we employed the TCCM framework of Paul and Rosado-Serrano (2019) to suggest areas for future research to advance understanding of risk governance.

4.1. Theoretical (T) advancement

Risk Governance studies rely on various theories, thus highlighting the need for an expanded theoretical foundation. As shown in Table 4, Agency theory predominates over the other 25 theories. This finding is in line with that documented by Alhossini et al. (2021) for corporate board committees and by Lu et al. (2022) for the board of directors’ attributes. Furthermore, it was noticed that theoretical application was rare, with few studies connecting their results to a preconceived theoretical framework. Researchers may improve understanding of risk governance by emphasizing theoretical contributions and how their findings apply to established theoretical frameworks. Hence, future studies should prioritize and explicitly connect a theoretical framework with their hypothesis and empirical results as demonstrated by a handful of studies (Aldhamari et al., 2020; Nahar, Jubb, et al., 2016). Our findings also show that the management and strategy fields are the origin of all the applied theories. As a result, existing theories on risk governance need to be complemented by new, integrated, and multi-theoretical perspectives leading to richer insights and a holistic perspective. This is also supported in the findings of Nguyen et al. (2020). For example, cultural theories, which may affect RC behavior, are rarely used in this discipline. Schwartz’s (1992) theory of values could be used to explain RC transparency culture, RC organizational culture, and risk culture (Gontarek & Belghitar, 2018; Zhang, Li, & Ortiz, 2021)

4.2. New context (C) coverage

It would be beneficial to conduct research on the following unexplored contexts:

4.2.1. Geographical and industry Context Studies

There are only a few multi-country and cross-country studies, and Latin America and the Caribbean have received least attention. It is important for researchers to prioritize multi-country studies covering the EU-13, the Americas, Africa, North and Central Asia, Latin America, and the Caribbean. This result is comparable with the findings of Alhossini et al. (2021) and Lu et al. (2022) on the cross-country studies scarcity. Additionally, most studies have focused on large and listed firms, neglecting small private firms (Jia & Bradbury, 2020), leaving room for further research in this area. Our results are also in line with the reported by Ibrahim et al. (2022) on the limited number of studies focusing on developing countries, private institutions, and non-profit organizations. Risk governance studies are also needed in various sectors, such as Islamic banking (takaful and mudaraba), dual banking, insurance, mutual funds, private banking, state banks, foreign banks, fintech, microfinance, and pension funds (Aslam & Haron, 2020; Kakanda et al., 2017b).

4.2.2. Chief Risk Officer Traction

The role of the CRO in risk governance has received relatively little attention in the literature. However, some studies found that having a CRO can improve firms’ financial health (Otero González et al., 2020) and reduce the likelihood of shareholder class action litigation (Amoozegar et al., 2017). Other research has shown that banks with CROs who report directly to the board have higher stock returns (Aebi et al., 2012). Researchers have also examined the appointment, importance, and presence of CROs, as well as their level of reporting responsibility and their role in the board of directors or executive management team. In addition, the qualifications, experience, and expertise of CROs have been studied, as well as their compensation packages and their rank among the highest paid executives. Finally, researchers have looked at various characteristics of CROs, including their tenure, independence, gender, and nationality, as well as their centrality within the organization and any dual-hatting or cross-directorship roles they may have. The centrality of CROs is not well represented in the literature (Florio & Leoni, 2017), which opens the door for new research streams. Financial service regulators have promoted CRO dual-hatting (BCBS, 2015; FSB, 2013), but only Dupire and Slagmulder (2019) and Raouf and Ahmed (2021) have attempted to examine this empirically. Therefore, more research on CRO dual-hatting is encouraged. There is also increasing interest in CRO centrality and CRO pay structure, particularly the prevalence of CROs among the five highest-paid executives (Ellul & Yerramilli, 2013; Florio & Leoni, 2017). In light of this, additional empirical evidence is needed to deepen our understanding of these issues (Florio & Leoni, 2017).

4.2.3. Risk Governance Quadratic Relationship

There is considerable scope for future studies to examine causality relationships in risk governance, as most current studies only test associations (Cosma et al., 2021; M. Beasley et al., 2021). Moreover, our review shows that only 11 studies have examined the quadratic relationship between risk committee (RC), enterprise risk management (ERM) and chief risk officer (CRO). Further research should be directed towards understanding the consequences of the relationship between RC, ERM, and CRO.

4.3. Characteristics (C) for new relationship testing

Our review examined construct relationships, including units of analysis and explanatory factors. Future risk governance scholars can investigate these characteristics.

4.3.1. Risk Governance Overlapping

In most cases, risk committee members and chief risk officers (CROs) serve on multiple committees. Studies show that about 79.6% of risk committee (RC) members are overlapping directors (Aldhamari et al., 2020), which has raised concerns about the busyness and effectiveness of RC members with overlapping committee membership (Aldhamari et al., 2020). However, firms can also use overlapping directors to their advantage (Sassen et al., 2018), as RC members can utilize skills and knowledge gained from other committee memberships to mitigate risks and improve firm performance (Aldhamari et al., 2020; Nahar et al., 2020). While there has been an increase in the number of overlapping directors in recent years, there have been relatively few empirical studies on the implications of this phenomenon, and the results of these studies are contested (Sassen et al., 2018). Therefore, more research is needed to clarify these uncertainties in the literature. Future studies can conduct in-depth analyses to understand how RC overlapping influences corporate disclosures (Shahar et al., 2020) and the monitoring effectiveness of RC members who are chairpersons of other committees (Sassen et al., 2018).

4.3.2. Effectiveness and Regulation of Risk Governance

Risk governance studies have moved beyond their initial focus on satisfying regulatory requirements or voluntary establishment for better corporate governance practices. Abid et al. (2021) argue that risk governance effectiveness mitigates bank risk-taking, and the work of Malik et al. (2020) also supports the idea that ERM effectiveness significantly and positively affects firm performance. However, there is still a need for more studies on ERM effectiveness (M. S. Beasley et al., 2005; Mardessi & Ben Arab, 2018). Similarly, studies on the effectiveness of risk governance are scarce (Ghazieh & Chebana, 2021; Nahar, Jubb, et al., 2016). Researchers are encouraged to examine how well risk governance mechanisms mitigate information asymmetry (Nahar et al., 2020), as well as the quality and effectiveness of risk committees (Chen et al., 2021; Galletta et al., 2021; Sekome & Lemma, 2014). Future studies should also consider the impact of risk governance expertise on risk governance effectiveness and the impact of risk governance effectiveness on firm performance (Hoque et al., 2013; M. F. Malik et al., 2021; Nahar et al., 2020). Additionally, exploring the extent/degree of risk governance effectiveness represents a fruitful area for future research (Chen et al., 2021; Galletta et al., 2021; Ghazieh & Chebana, 2021). New insights are also needed to understand the cost-benefit analysis associated with implementing and maintaining risk committees (Al-Hadi et al., 2018; Bailey et al., 2018; Callahan & Soileau, 2017; M. B. U. Bhuiyan et al., 2020) as well as evidence on risk governance before and after formation (Mohammadi & Mardini, 2016; Musallam, 2018). On the regulatory front, more studies should examine the level of risk governance compliance (Kafidipe et al., 2021). To what extent do firms meet risk governance regulatory best practices (Dupire & Slagmulder, 2019; Jia & Bradbury, 2021)? Research addressing how regulation complexity affects risk governance are encouraged.

4.4. Methodological (M) improvement

The methodological rigor of risk governance research would be improved by future studies in the following direction:

4.4.1. Risk Governance Moderation and Mediation Relationship

There have been calls in the field of risk governance for more research on the moderating and mediating relationships between different variables (Hossain & Farooque, 2019; Musallam, 2020). To date, only one study has examined the moderation-mediation relationship between audit certification, earnings management, and risk governance (Fakhfakh & Jarboui, 2020).

In terms of moderating relationships, Jia (2019) found that risk committee gender diversity helped to moderate the negative association between risk and the likelihood of experiencing financial distress. Tao and Hutchinson (2013) also found that the presence of a risk committee helped to moderate the negative relationship between risk and performance outcomes in Australian financial firms. Nahar and Jahan (2021) found that the composition of the risk committee acted as a moderating factor in the link between risk disclosure and the performance of banks, and Prabhawa and Nasih (2021) demonstrated that the risk committee moderated audit costs. However, Hossain and Farooque (2019) found no evidence of a moderating effect.

Concerning mediation, Musallam (2018) found that risk governance acted as a mediator in the relationship between audit committee meetings and corporate social responsibility (CSR) disclosure, but did not mediate the relationship between audit committee size and independence. Karyani and Dewo (2019) found that risk disclosure quality mediated the relationship between bank performance.

Only a few scholars have attempted to evaluate mediation-moderation relationships in risk governance, so more studies should focus on this aspect (Fakhfakh & Jarboui, 2020; Hossain & Farooque, 2019; Musallam, 2020). In particular, researchers can explore how risk governance mediates moral suasion (Dupire et al., 2021). Future studies can also increase our understanding of how the moderating effects of ownership type, CEO duality, firm size, board size, gender, independent directors, profitability, and firm age impact risk governance outcomes (Sassen et al., 2018).

4.4.2. Endogeneity Concerns

Studies of boards suffer from endogeneity because the variables of interest are typically endogenous. Because board and sub-committee membership selection is not random, endogenous associations between members’ characteristics and outcomes (firm and board outcomes) are more likely (Kolev et al., 2019). Therefore, not accounting for risk committee formation self-selection bias raises endogeneity concerns. Only 5% of the review studies address endogeneity concerns (Al-Hadi et al., 2016; Dupire & Slagmulder, 2019; Erin & Bamigboye, 2020; Hoque et al., 2013; Jia, 2019; Johnston & Soileau, 2020; Magee, Sheedy, et al., 2019). It is recommended that future study should utilize dynamic/simultaneous-equation models with instrumental variables, propensity score analysis, or Heckman two/three-step approaches to mitigate endogeneity issues.

4.4.3. Overreliance of Annual Report: Call for Mixed Method Studies

It is worth noting that the vast majority of research in this field has utilized annual report financial data. Subramaniam and McManus (2009) argue that annual reports contain limited information about firms’ risk management structures, a limitation also recognized by Ghazieh and Chebana (2021). Therefore, there is a need for mixed-method studies (Florio & Leoni, 2017). This result is in line with that documented by Nguyen et al. (2020), Alhossini et al. (2021) and Lu et al. (2022) on methodological limitations. However, data from other forms of firm communication, such as websites, prospectuses, interim reports, and press releases, have not been adequately explored (Nahar & Jahan, 2021; Shahar et al., 2020), providing an opportunity for future research. In particular, studies using risk management disclosures on social media are desirable (Jia et al., 2019). Additionally, research using primary data sources, such as in-depth interviews with risk committee members and risk officers (Tao & Hutchinson, 2013), should be prioritized. The implementation of risk governance directives also offers the chance to conduct interviews with financial regulators to determine whether organizations are following best practices (Jia & Bradbury, 2021). Inadequate or non-disclosure of risk governance in annual reports does not necessarily mean that risk governance is absent, making it valuable to conduct case studies to examine the actual risk management techniques employed by firms beyond what is disclosed in annual reports (M. F. Malik et al., 2021).

5. Conclusions and implications

The main goal of this study is to map out the knowledge structure of risk governance and provide a framework to explain the dimensions, relationships, and outcomes of risk governance. We conducted an SLR using both the Web of Science (WoS) and SCOPUS databases. Our seven-step article screening protocol, shown in Figure 1, resulted in 151 suitable articles for the study after screening 229,519 articles. Our review shows a significant increase in risk governance studies. Agency theory was the dominant theoretical framework. Most risk governance studies were empirical and quantitative, and the majority (85%) used data from annual reports. A large number (80%) of the studies were single-country studies, with a focus on the financial systems of the United States, Malaysia, Australia, and Nigeria. CRO, as a single dimension of risk governance, was the least studied. While risk governance is a multi-dimensional phenomenon, 70.2% of the research in the field studied a single dimension. Additionally, few studies test moderation and mediation relationships in risk governance. While we used WoS and SCOPUS, the largest databases that index the most comprehensive peer-reviewed scientific research across multiple disciplines and subjects, we may have missed additional studies that were outside the scope of these databases. However, our SLR protocol was robust to ensure accurate coverage of the study area. One important contribution of our research is that it maps out the intellectual structure of risk governance in order to identify gaps in the existing body of literature and open up new research opportunities. We also developed a risk governance conceptual framework.

Our paper contributes to the intellectual structure of risk governance in the following ways. First, we provide an up-to-date and exhaustive SLR that covers the existing research on risk governance. Secondly, we bridge the research gap by using data from both WoS and SCOPUS (Abid et al., 2021; M. Beasley et al., 2021) in our review, rather than just one database (Kolev et al., 2019). Additionally, we analyze risk governance mechanisms that extend beyond financial institutions, whose regulators oblige them to have a risk committee, to other sectors that voluntarily maintain a risk committee. This study supports financial regulators’ call for prioritizing three-tier risk governance to foster a resilient financial system.

Our study contributes to a deeper understanding of risk governance and to the corporate governance literature by highlighting the importance of the risk committee as a specialized board subcommittee (Kolev et al., 2019). Our analysis provides evidence to support agency theory as the dominant theory to explain risk governance. This is the first study to delve deeply into risk governance dimensions, identify several under-explored areas within each dimension, and suggest future strands that could advance knowledge of risk governance. We identify important but under-explored moderating and mediating variables that affect risk governance.

Our review provides insights for researchers and scholars regarding the research gaps and emerging themes in risk governance. We argue that scholars should explore mixed methods beyond the over-reliance on annual reports for risk governance studies. Additionally, several future research avenues have been established in this field and should encourage more research to advance risk governance studies from a multi-disciplinary perspective. Managers and financial system regulators should prioritize three-tier risk governance by efficiently maintaining risk committees at both the board and executive management level. Evidence shows that CROs do not always report to the board, so risk committees and CROs should be adequately empowered. Firm boards should maintain risk committees as specialized committees and appoint highly qualified, independent directors to serve on them, rather than just board members who also serve on other sub-committees, in order to promote risk governance effectiveness. Investors and funding providers could tie their funding to high levels of disclosure and strict compliance with risk governance. This study suggests that governments, society, and stakeholders in the global financial architecture should adopt a stricter precautionary stance to prevent future financial crises due to excessive risk-taking behavior. Additionally, our study contributes to achieving the United Nations’ Sustainable Development Goal 8 target 10 of strengthening financial institutions’ capacity while promoting a resilient financial system.

This study has the following limitations. It focuses on research indexed in SCOPUS and WoS, the richest and most reliable sources. Therefore, studies from other journals not indexed in these databases may have been ignored. Additionally, conference papers, book chapters, and non-English articles were also excluded based on our methodology protocol outlined in Figure 1. Future research may expand the databases and publication types. Our study applied inclusion and exclusion criteria such as keyword combinations and restrictions to specific research categories/subject areas. For example, risk governance in the context of projects, engineering, mining, and natural disasters was excluded. Future research may consider risk governance in these contexts and consider using different or extended keywords for other perspectives.

Acknowledgments

This work was financially supported by the Research Unit on Governance, Competitiveness and Public Policies (UIDB/04058/2020), funded by national funds through FCT – Fundação para a Ciência e a Tecnologia.

Disclosure statement

No potential conflict of interest was reported by the authors.

Additional information

Funding

The work was supported by the Fundação para a Ciência e a Tecnologia [UIDB/04058/2020].

Notes on contributors

John Agyekum Addae

John Agyekum Addae is a Ph.D. researcher in Economic and Business Sciences (Finance Option) at University of Aveiro, Portugal. John holds an MSc in Development Finance from the University of Ghana and an MSc in Microfinance from the University of Cape Coast. He is a lecturer in Banking and Finance at Ghana Communication Technology University.

Jorge Mota

Jorge Humberto Mota holds a Ph.D. in Management, specialization in Finance at the Faculty of Economics of Oporto University. Jorge is a researcher at the GOVCOPP research unit at the University of Aveiro, and an associate researcher at CICEE - Research Center in Business and Economics, UAL. He is an Assistant Professor at DEGEIT, University of Aveiro.

António C. Moreira

António Carrizo Moreira is an Associate Professor with Habilitation at DEGEIT, University of Aveiro, Portugal. António holds an MBA from Porto Business School. He holds a Ph.D. from the University of Manchester, England.

 

Appendix: Table A.1: List of Risk Governance Selected Article

Table

Code numbers for Selected Articles
[1](M. S. Beasley et al., 2005) [2](Gordon et al., 2009) [3](Subramaniam & McManus, 2009) [4](Yatim, 2010) [5](McShane et al., 2011) [6](Okafor & Ibadin, 2011) [7](Y. Yeh et al., 2011) [8](Ng et al., 2012) [9](Aebi et al., 2012) [10](Tao & Hutchinson, 2013) [11](Ellul & Yerramilli, 2013) [12](Baxter et al., 2013) [13](McNulty et al., 2013) [14](Hoque et al., 2013) [15](Sekome & Lemma, 2014) [16](Ling et al., 2014) [17](Battaglia et al., 2014) [18](Kallamu & Saat, 2014) [19](Grace et al., 2015) [20](Hines et al., 2015) [21](Buckby et al., 2015) [22](Battaglia & Gallo, 2015) [23](Lundqvist, 2015) [24](M. Beasley et al., 2015) [25](Hines & Peters, 2015) [26](Sakilu & Kibret, 2015) [27](S. N. Abdullah, 2016) [28](Al-Yahyaee & Al-Hadi, 2016) [29](El-Masry et al., 2016) [30](Mohammadi & Mardini, 2016) [31](Wu et al., 2016) [32](Jia et al., 2016) [33](Nahar, Azim, et al., 2016) [34](Al-Hadi et al., 2016) [35](Li et al., 2016) [36](Ahmed & Che-Ahmad, 2016) [37](Nahar, Jubb, et al., 2016) [38](Kakanda et al., 2017b) [39](Florio & Leoni, 2017) [40](Callahan & Soileau, 2017)	[41](Alhajri, 2017) [42](T. M. Yeh, 2017) [43](Andries & Brown, 2017) [44](Kakanda et al., 2017a) [45](K. C. Kuo et al., 2017) [46](A. Soliman & Adam, 2017) [47](Amoozegar et al., 2017) [48](M. Abdullah et al., 2017) [49](M. Abdullah & Shukor, 2017) [50](Lundqvist & Vilhelmsson, 2018) [51](Gontarek & Belghitar, 2018) [52](Bailey et al., 2018) [53](Anton, 2018) [54](Ben Saada, 2018) [55](Mardessi & Ben Arab, 2018) [56](Scordis, 2018) [57](Musallam, 2018) [58](Ames et al., 2018) [59](Krishnamurti & Velayutham, 2018) [60](A. M. Soliman et al., 2018) [61](Erin et al., 2018) [62](Sassen et al., 2018) [63](Kweh & Lu, 2018) [64](Al-Hadi et al., 2018) [65](Najwa et al., 2019) [66](Amrin, 2019) [67](Ali et al., 2019) [68](Aliyu, 2019) [69](Silva et al., 2019) [70](Farida et al., 2019) [71](Bohnert et al., 2019) [72](Magee, Schilling, et al., 2019) [73](Larasati et al., 2019) [74](Pérez-Cornejo et al., 2019) [75](Hossain & Farooque, 2019) [76](Saha & Kabra, 2019) [77](Dupire & Slagmulder, 2019) [78](Aljughaiman & Salama, 2019) [79](Husaini & Saiful, 2019) [80](Olayinka et al., 2019)	[81](Mollah et al., 2019) [82](Nasr et al., 2019) [83](W. N. Abdullah & Said, 2019) [84](Jia, 2019) [85](Hassan et al., 2019) [86](Karyani & Dewo, 2019) [87](Jia et al., 2019) [88](Agnese & Capuano, 2020) [89](Johnston & Soileau, 2020) [90](Yahaya et al., 2020) [91](Horvey & Ankamah, 2020) [92](Rimin et al., 2020) [93](Djebali & Zaghdoudi, 2020) [94](Shahar et al., 2020) [95](Musallam, 2020) [96](Karyani et al., 2020) [97](Aslam & Haron, 2020) [98](M. B. U. Bhuiyan et al., 2020) [99](Otero González et al., 2020) [100](Jia & Bradbury, 2020) [101](Erin & Bamigboye, 2020) [102](Ittner & Oyon, 2020) [103](Lee et al., 2020) [104](Farhan et al., 2020) [105](Iselin, 2020) [106](Gulati et al., 2020) [107](Omer et al., 2020) [108](Erin, Bamigboye, et al., 2020) [109](Chavarín, 2020) [110](Aldhamari et al., 2020) [111](Erin, Adebola, et al., 2020) [112](Jiraporn et al., 2020) [113](Nahar et al., 2020) [114](Fakhfakh & Jarboui, 2020) [115](Erin & Aribaba, 2021) [116](Rimin et al., 2021) [117](M. Malik & Shafie, 2021) [118](Dupire et al., 2021) [119](Almasri, 2021) [120](Arsad et al., 2021)	[121](Abbas et al., 2021) [122](Prakash et al., 2021) [123](Gulati, 2021) [124](Oyewo, 2021) [125](Saha & Kabra, 2021) [126](Zhang, Li, & Ortiz, 2021) [127](Y. F. Kuo et al., 2021) [128](M. F. Malik et al., 2021) [129](Abid et al., 2021) [130](Galletta et al., 2021) [131](Eastman & Xu, 2021) [132](Harymawan et al., 2021) [133](Karyani et al., 2021) [134](Prabhawa & Nasih, 2021) [135](Rahayu et al., 2021) [136](Nahar & Jahan, 2021) [137](M. S. M. Beasley et al., 2021) [138](Cosma et al., 2021) [139](Jaffar et al., 2021) [140](Kafidipe et al., 2021) [141](Zhang, Li, Xu, et al., 2021) [142](Chairani & Siregar, 2021) [143](Jia & Bradbury, 2021) [144](Chen et al., 2021) [145](Adam et al., 2021) [146](Ghazieh & Chebana, 2021) [147](de Villiers et al., 2021) [148](Raouf & Ahmed, 2021) [149](M. Beasley et al., 2021) [150](M. M. F. Malik et al., 2021) [151](B. U. Bhuiyan et al., 2021)