Toward an Integrated Theory of Enterprise Risk Management: A Multi-Theoretical Conceptual Framework

Abstract

This paper critically synthesizes the fragmented theoretical literature on enterprise risk management (ERM) and proposes an integrated, multi-theoretical conceptual framework explaining the antecedents, mechanisms, and boundary conditions of ERM effectiveness, addressing a persistent gap: although partial theoretical integrations exist in the ERM literature, none brings all five of these traditions together within a single, variable-level model. A critical narrative review was conducted of literature published between 2020 and 2026, indexed in Scopus, Web of Science, PubMed, and Semantic Scholar, supplemented by a small number of seminal pre-2020 theoretical sources retained only where indispensable. Rather than treating the five theories as competing paradigms, the review synthesizes them as complementary explanations operating at different levels of analysis and translates them into a framework specified at the construct level. The review identifies five theory-grounded antecedents of ERM effectiveness, three mediating mechanisms, three moderating boundary conditions, and four control variables, and finds that ERM scholarship’s single-theory orientation plausibly explains the inconsistent findings reported across the ERM–performance literature, with an under-examined adoption–effectiveness gap recurring across otherwise unconnected studies. The framework offers boards, chief risk officers, and regulators a diagnostic basis for distinguishing substantive from symbolic ERM adoption. This paper is among the first to integrate five major organizational theories into a single, empirically testable conceptual model of ERM effectiveness, structured for direct use in future structural equation modeling research.