“The likelihood value of residual risk estimation in the management of enterprise risk”

A model for estimating the likelihood value of residual risk (Y) is introduced. The mod- el consists of three independent variables: the likelihood value of risk before risk treatment (X1), the quality of risk treatment (X2), and the appropriateness of risk treatment (X3). An experimental research design with a multiple linear regression analysis was used in the estimation. All independent variables, the likelihood value of risk before treatment, the quality of risk treatment, and the appropriateness of risk treatment, can be significantly used to estimate the likelihood value of residual risk. Since no model of estimating residual risk of likelihood had been introduced yet, the findings of this study provide significant contribution to firms or organizations that need to assess the likelihood value of residual risks.


INTRODUCTION
The practices of risk management in corporations had changed from mainly purchase insurance or hedging of interest rate and exchange rate exposure to integrated holistic risk management (Nocco & Stulz, 2006; Anton, Lackes, & Siepermann, 2015). This integrated holistic risk management is called Enterprise Risk Management (ERM). ERM seeks to link risk management with business strategy and goal setting (Arena, Arnaboldi, & Azzone, 2010). ERM has become a new paradigm in risk mangement that integrates all of the risks faced by an enterprise (Bharathy & McShane, 2014). Studies show that ERM has a significant positive impact on corporate value and performance (Gatzert & Martin, 2015;Farrell & Gallagher, 2015).
The Committee of Sponsoring Organizations (COSO), an organization dedicated to improve organizational performance and governance, introduced the COSO ERM framework in 2004 and updated it in 2016 (Everson & Chesley, 2016). Those who did not embrace COSO's ERM framework made use of ISO 31000 Risk Mangement Standard that was introduced in 2009 ( Gjerdrum & Peter, 2011). The risk management process has several stages that involve risk identification, risk measurement, and risk control (Norrman & Jansson, 2004;Gjerdrum & Peter, 2011;Colombini, 2015;Kountur, 2016 (Williamson, 2007). There is no real consensus about the principal components of ERM. This leads to misidentification and measurements of risk that are inconsistent (Lundqvist, 2014).

LITERATURE REVIEW
Several methods of identifying risk have been introduced, such as the Business Process Model (Lambert, Jennings, & Joshi, 2006), and the Business Process Analysis (Salmela, 2008). These models were then extended with step-by-step processes for identifying risk called Risk-Extended Process Model by Cope, Kuster, Etzweiler, Deleris, and Ray (2010). This model gives comprehensive information that was useful in identifying operational risks. The use of business processes in risk management has been the subject of active research in the past few years (Suriadi et al., 2014). Unfortunately, few studies have been done in measuring inherent and particularly residual risks. The most recent available literature on measuring residual risk was by Tolbert (2005).
The measurement of Frequency, Likelihood, and Severity was still based on judgments that were expressed in a scale from one to five as 'one' indicated the lowest and 'five' indicated the highest. This approach was the common traditional model of risk measurement in ERM that was still based on judgment, which is unable to measure risk objectively (Hakizabera & Ohsato, 2010). Besides, this method does not separate the residual risk of likelihood and the residual risk of impact, which were important in risk mapping that was used in the integrated ERM system.
Measuring the impact value of residual risk was quite straightforward. For example, a car that has a value of USD 25 thousand faces a 30 percent likelihood of being stolen. To reduce the like-lihood of being stolen and to reduce the impact if it was stolen, the owner installed a car alarm and insured it for USD 20 thousand. The impact value of residual risk will be USD 5 thousand that was the remaining value after receiving payment from the insurance company. However, it will get complicated when measuring the likelihood value residual risk. What will be the residual risk of likelihood after installing car alarm? No model of predicting residual risk of likelihood after control that was used in ERM has been introduced yet, therefore, research needs to be conducted. The main purpose of this study was to know whether the likelihood value of risk before risk treatment (X 1 ), the quality of risk treatment (X 2 ), and the appropriateness of risk treatment (X 3 ) can be used to estimate the likelihood value of residual risk (Y). The researcher hypothesized that these independent variables significantly estimate the likelihood value of residual risk. Further, to determine the coefficients X 1 , X 2 , and X 3 in order to develop the estimation model, this residual risk of likelihood value estimation model may be used by ERM practitioners in calculating the likelihood value of residual risk, which has been the gap so far. Residual risk of likelihood and residual risk of impact are important elements in ERM system, particularly as they are needed in developing a risk map and in determining the risk status.

Baseline Risk Index Subsequent Risk Index Residual Risk Reduction
Baseline Risk Index .

Subsequent Risk Index
Frequency Likelihood Severity of risk after controls = ⋅⋅ ∑

METHOD
This was an experimental research, where data were gathered through a questionnaire. The respondents of this study were undergraduate senior business administration (BA) students and masters of business administration (MBA) students. They were grouped in cluster by classes. The classes were taken randomly from the list of BA classes that were offered in that semester and from the list of MBA classes that were offered in that semester. This was an evening MBA class that was composed of working students, students who worked while studying.
Most of them were in supervisory level that represent adult mature professional respondents. All students in the selected classes were taken for the study.
The respondents were given written risk management scenarios followed by seven questions. The answers to the questions were based on their responses to the scenarios.
The first question was about the likelihood of existing risk that was risk exposure before any risk treatment was given. In each of the scenarios, two different risk treatments were given. The purpose of providing more than one different risk treatment for each scenario was to increase the external validity of the study. Besides, the consistency of the answer can be measured.
The second question was about the 'first' residual risk of likelihood that was risk exposure after risk treatment was performed. The third question asked about the quality of the 'first' risk treatment. The respondent was given four choices and had to select one that was the most qualified in regard to the risk treatment provided. Each choice was given a value; the first choice had the highest value (four) and the last choice was the lowest value (one) (see Table 1).
The fourth question asked about the appropriateness of the 'first' treatment. There were four choices referring to the appropriateness of treatment from 'very appropriate' to 'inappropriate'. Each choices was given a value from four to one (see Table 2).  The fifth question is about the 'second' residual risk of likelihood. When providing different ways of treating risk, how much likelihood will remain? The sixth question asked about the quality of the 'second' risk treatment. It was the same as the third question and had the same choices of answers as shown in Table 1. The only difference was the risk treatment provided. And the seventh question -the last question -asked about the appropriateness of the 'second' risk treatment. This was the same as the fourth question and had the same choices as shown in Table 2.
Three questionnaires were designed. Each questionnaire had two different risk management scenarios with the same questions. The purpose of having more than one scenario was to reduce the treatment bias and increase the external validity of the study. Each respondent exposed to one scenario with two different risk treatments. In total, this study exposed three scenarios with six different risk treatments.
The first scenario was about the risk of sound system failure at a music show. This questionnaire was given to the first cluster of 19 BA students. Four students did not fill out the questionnaire completely and were removed from the study, which left 15 students from the first cluster.
The second scenario was about the risk of electrical appliances being destroyed due to a power outage. This second questionnaire was given to the second cluster of 23 BA students. Only one student did not answer the questionnaire completely and was removed from the study, which left 22 respondents.
The third scenario was about the risk of a car accident to a driver without a driving license. This third questionnaire was given to the third cluster of 20 MBA students. There was one student who did not return the questionnaire, which left 19 respondents.
There were 56 complete questionnaires collected in total. Since each respondent was required to answer two different scenarios, in total, there were 108 scenarios being analyzed. There was 68.32 percent consistency in answering the questionnaire as measured by the correlation between residual risk of likelihood of the first and second controls.
Multiple linear regression analysis was used in analyzing the data with a significance level of 5 percent or 95 percent level of confidence. The assumptions of normality, linearity, collinearity, and scedasticity were tested. Since the sample size was relatively small, regression assumptions must be strictly followed. The sample size would not be an issue if the regression assumptions were fulfilled.

RESULTS
In the assessment of risk, can inherent risk of likelihood, quality of risk control, and appropriateness of risk treatment be used to estimate the residual risk of likelihood? A multiple linear regression analysis was calculated to estimate the residual risk of likelihood of risk after being treated based on the existing risk of likelihood, the quality of risk treatment, and the appropriateness of risk treatment. The use of multiple linear regression required that the data were normally distributed, linearly related, no collinearity, and no heteroscedasticity. The data were normally distributed, since the residuals plots are along the line of normal P-P plots graph as shown in Figure 1.
The assumption of normality, linearity, and scedasticity can also be examined through the use of scatterplot between regression standardized predictive value and regression standardized residual. The data were again confirmed to be normally distributed, since the regression standardized residual has a horizontal-line relationship with standardized predicted scores (Tabachnick & Fidell, 2013), as shown in Figure 2. Linearity of relationship was also assumed, since the overall shape of the scatterplot tended towards rectangular (see Figure 2). Its shape was curved when nonlinearity was present. No heteroscedasticity was also found, since the distribution of regression standardized Figure 1. Normal P-P plot: residual probability residual and standardized predictive scores of independent variables was random (Tabachnick & Fidell, 2013) as shown in Figure 2. Further, no collinearity existed among independent variables, since collinearity statistics of Tolerance and Variance Inflation Factor (VIF) were close to one (Tabachnick & Fidell, 2013) (see Table 3).
where Y -residual risk of likelihood, 1 X -risk of likelihood before control, 2 X -quality of risk control, 3 X -effectiveness of risk control.
The likelihood of residual risk and the risk before treatment were expressed in percentages. Quality of risk control was expressed in scores from 1 to 4, where one indicated the worst ways of handling the likelihood of occurrence as compared to other ways, while four indicated the best way of handing the likelihood of occurrence and there was no other better ways available (see Table 1). Effectiveness of risk control was expressed in scores from 1 to 4 too. 'One' indicated ineffective that the control seemed unable to reduce the likelihood of occurrence, while 'four' indicated very effective that the control can strongly reduce the probability of occurrence (see Table 2). The likelihood of risk before control (p = .00), quality of risk control (p = .00), and effectiveness of risk control (p = .00), all as predictor variables, were significantly estimators of residual risk of likelihood.

DISCUSSION
Risk that existed in any event may be reduced by implementing some risk treatments. There were two elements of risks, likelihood and impact. Some risk treatments were intended to reduce the likelihood of loss event and some risk treatments were intended to reduce the impact or the loss of that event. The likelihood and the impact before risk treatment was known as the existing risk, while the likelihood and impact after the risk treatment was known as the residual risk. Measuring residu- The researcher found that quality of risk treatment was a significant predictor of the likelihood value of residual risk, which was consistent with studies by Sheeney, Soutar, and Johnson (1999), and Abdelrafe and Connor (2006) who found that perceived quality led to reduced perceived risk. The study also found that appropriate use of equipment reduced the risk of loss (Mitchell, Bauknecht, & Connor, 2006 A predictive model of estimating the residual risk of likelihood of risk event (Y) was introduced in this study. The likelihood of risk before treatment (X 1 ), quality of risk treatment (X 2 ), and appropriateness of risk treatment (X 3 ) were the predictors of likelihood value of residual risk. A previous study by Tolbert (2005) had introduced a model of measuring residual risk; however, it differed in two aspects. First, no differences were made between residual risk of likelihood and residual impact in that study, second, it did not consider the quality and appropriateness of risk treatment.

CONCLUSION
A model of predicting residual risk of likelihood value in the management of enterprise risk is very much needed, since it is used in developing risk map and no such model has been introduced yet. The predictive model in estimating likelihood value as residual risk introduced in this study has significant implications to those companies that implement ERM, and to risk management professionals.
This study was not without limitations. The sample size of 108 was still considered medium which suggests further study with a larger sample size. Though it was acceptable, the 52 percent R 2 was unsatisfactory. That might be due to the few predictor variables that were included in this predictive model. More variables may be added in the model as predictors for further study to improve the R 2 .