Integrating resilience principles into enterprise risk management practices: A resilience-focused enterprise risk management model

Today's business world is increasingly shaped by conditions of uncertainty, complexity, and unpredictability. In this dynamic environment, black swan events can overwhelm organizations' capacity for control and render even the most robust scenarios obsolete. Examples such as the COVID-19 pandemic, the Russia-Ukraine war, global supply chain disruptions, cyberattacks, and natural disasters clearly demonstrate that organizations must be prepared not only for calculable risks but also for unforeseen threats and uncertainties. Such developments reveal that traditional Enterprise Risk Management (ERM) and Resilience Management (RM) approaches alone are insufficient. While ERM, with its focus on measurable and calculable risks, provides significant contributions to organizations, it has limited impact in the face of sudden shocks, chain reactions, and systemic vulnerabilities. Similarly, RM is mostly limited to post-crisis recovery processes and does not sufficiently incorporate a strategic perspective that considers the risk-return balance. Therefore, the independent use of both approaches produces fragmented solutions to adverse situations; it does not provide organizations with the capacity to create comprehensive and strategic value. This situation necessitates the integration of KRY and DY under a single framework and the holistic management of adverse situations in their pre-event, during-event, and post-event phases. The aim of this study is to develop a Resilience-Focused Enterprise Risk Management (RFERM) Model that synthesizes the systematic and measurable risk management framework of ERM with the prevention, protection, adaptation, and recovery capacities of DRM. The research adopts a qualitative and conceptual approach, progressing through literature review, content analysis, and conceptual synthesis methods. In this context, international standards and academic literature were examined. As a result of the analyses, the limitations of both approaches, their complementary dimensions, and opportunities for integration were identified, and the main components of the DOKRY model were defined. The proposed model has a cyclical structure that includes situation analysis, classification of risks, threats, and uncertainties, strategy selection, management of event phases (pre-event, during event, post-event), implementation, monitoring, and feedback. This structure promotes organizational learning, effective use of resources, and capacity development in each cycle, thereby raising the level of organizational maturity. Thus, organizations are supported not only by preventive and protective mechanisms but also by adaptable and innovative strategies. The theoretical contribution of the study is that it offers a unique and integrated framework that overcomes the limitations of ERM and RM when considered separately. In terms of application, the study proposes a comprehensive roadmap that enables organizations to gain the capacity for proactive situation management, effective intervention during crises, and emerging stronger after crises. However, as the study aims to develop a conceptual model, empirical testing of the proposed model is beyond the scope of this research. The applicability and effectiveness of the model across different sectors should be tested in future field studies. In conclusion, the proposed Resilience-Focused ERM Model aims to provide organizations with sustainability, strategic flexibility, and competitive advantage by enabling the integrated management of risks, threats, and uncertainties. In this respect, the study contributes at both the theoretical and practical levels to today's business environment, which is dominated by uncertainties and unforeseen adverse situations.