Internal control and risk management: From compliance to strategy[Contrôle interne et management des risques : de la compliance à la stratégie]

Over the last two decades, all the systems intended to anticipate and prevent economic and financial risks have developed considerably. In this context, various risk management guidelines and methods have emerged, embodying the hope of gaining greater control of the hazards of the economic world, both at the level of companies themselves and at the level of society. One of the most common systems, internal control, is mainly geared toward assuring the reliability of financial reporting and compliance with laws and regulations. Gradually, the need to broaden risk management to other dimensions has emerged, from a perspective that is not only technical but also strategic. Enterprise risk management (ERM), which embodies this need, has given rise to numerous academic works. However, these studies do not address the concrete ways in which ERM is implemented and operates, nor its links with other systems, in particular internal control. This research work is based on the case study of an insurance company that has been implementing risk mapping for the past twenty years, responding to both compliance concerns and needs related to its strategic thinking. The observation of this company allows for an in-depth description of an ERM system and a better understanding of how it works, as well as its interaction with the internal control function.