Enterprise risk management (ERM) and firm value: The mediating role of investment decisions

Abstract The purpose of this study is to examine the mediating effect of investment decisions on the relationship between Enterprise Risk Management (ERM) and firm value. Two hundred and twenty-four companies listed on the Indonesia Stock Exchange for period 2017–2018 were selected as sample by applying Slovin’s formula. We used path analysis and Sobel test to check the mediating effect of investment decisions. Our results show that the implementation of ERM in Indonesia public listed companies is still in the initial stage. In addition, the regression tests show that ERM and investment decisions have a positive effect on firm value. The path analysis and Sobel’s test results show that investment decisions act as partial mediation on the relationship between ERM and firm value. The study suggests that ERM contributes in improving the effectiveness of investment decisions and firm performance. Therefore, the significant role of stakeholders in increasing the maturity level of ERM is very essential, especially in Indonesia, where the level of risk maturity is still at the initial level. Studies that test the influence of risk management maturity on firm value are still rare, especially in developing country. While, Farrell and Gallagher (2019) have tested the relationship between ERM maturity and firm value, nevertheless they have not considered the role of investment decision in the intermediating the relationship between ERM maturity and firm value.


Introduction
In recent decades, public companies worldwide have intensively started considering the importance of Enterprise Risk Management (ERM) (Al-Amri & Davydov, 2016;Bailey, 2019;Bohnert et al., 2018;Bromiley et al., 2015;Farrell & Gallagher, 2015). The emergence of great attention to ERM is driven by the appearance of the various issues such as economic vulnerabilities, geopolitical tensions, societal and political strains, environmental fragilities and technological instabilities that has affected business performance of the company either directly or indirectly (Callahan & Soileau, 2017;World Economic Forum, 2020). At the early development of ERM, the motivation of company to implement ERM aims to purchase insurance and/or to comply with the regulations (Nocco & Stulz, 2006). Currently, these paradigms have shifted, the implementation of ERM has become a corporate strategy for creating value for the company's stakeholders (Baxter et al., 2013;McShane, 2018). With this paradigm change, it is not surprising that some countries have issued regulations relating to the implementation of ERM. For instance, Section 404 of the Sarbanes-Oxley Act of 2002 requires a top-down risk assessment, which includes the identification of material risks on financial statements. In 2004, the New York Stock Exchange (NYSE) implemented new corporate governance rules requiring audit committees of listed firms to be more involved in risk oversight (McShane et al., 2011). In Singapore, the Council on Corporate Disclosure and Governance (CCDG) has set financial reporting standards, encouraging companies to provide detailed information about their operational risks and the risks associated with financial instruments. These standards must be adhered to primarily focused on financial risks (Low et al., 2013).
Along the lines of NYSE regulations, the Indonesia Stock Exchange (IDX) also requires listed companies to report risk information in annual reports. The regulation of risk information reporting is dictated in Statement of Financial Accounting Standard 60 (revised 2014)/PSAK 60. In addition, the Indonesia Financial Services Authority/Otoritas Jasa Keuangan (OJK) has launched risk management regulations, namely, Regulation Number 17/2014, Number 1/2015, and Number 18/2016. These regulations require that companies running their business activities in financial services, financial conglomerations, commercial banking, and nonbanking are required to implement the regulations. While the regulations related to ERM implementation are demanded by the regulators, nonetheless, ERM reporting practice by public companies is still relatively low (Achmad et al., 2017). The findings are supported by the results of the National Survey on the implementation of risk management in Indonesian companies that show that on average, the level of ERM maturity is still at the third level or weak category (AON Risk Solution, 2017).
Ideally, an effective ERM implementation can help companies to achieve their competitive advantages while creating value for the stakeholders (Farrell & Gallagher, 2019). However, whether an ERM implementation can provide added value and create value for stakeholders is still a debate among academicians (see, Bohnert et al., 2018;Lechner & Gatzert, 2017;Pagach & Warr, 2011). Some previous studies have investigated the relationship between ERM and firm performance, majority of these studies were conducted in developed countries (see, Baxter et al., 2013;Callahan & Soileau, 2017;Florio & Leoni, 2017;Gordon et al., 2009;Hoyt & Liebenberg, 2011;Malik et al., 2020), but it is still rare in developing countries (see, Chang et al., 2015;Iswajuni et al., 2018). Although previous studies have examined the relationship between ERM implementation and firm performance, few studies have considered the role of investment decisions in influencing the association. The implementation of ERM may provide greater benefits to the creation firm value if company is able to integrate it into important business processes, such as strategic management, strategic planning, financial decisions, including investment decisions (Sprčić et al., 2015). This is because companies that implement ERM properly have the ability to identify potential risks while being able to choose the most profitable investment opportunities (Hoyt & Liebenberg, 2011).
This study addresses the issues above by investigating the role of investment decisions in affecting the relationship between ERM and firm value in the context of emerging country, Indonesia. The findings of this study offer both theoretical and practical insights into the relationship between ERM, investment decisions and their impact on firm value. First, most previous studies have focused on the relationship between risk disclosure and firm value. Studies that test the influence of risk management maturity on firm value are still rare, especially in developing country. Farrell and Gallagher (2019) examined the maturity relationship of risk management implementation and firm performance. This study adds Farrell and Gallagher (2019) by retesting the influence of the ERM maturity on firm value. Second, while, Farrell and Gallagher (2019) have tested the relationship between ERM maturity and firm value, nevertheless they have not considered the role of investment decisions in the intermediating the relationship between ERM maturity and firm value. Investment decisions are expected to be a reliable factor because companies that have mature ERM will be able to increase the value of the company through rational and quality investment decisions with optimum capital allocation (Khalfaoui & Derbali, 2021b;Vuković & Mijić, 2011). The research questions are: First, do ERM and investment decisions influence the value of the firm? Second, does investments decisions mediate the relationship between ERM and firm value?

Indonesian regulation of enterprise risk management
The Indonesian Government is concerned with the aspect of organizational risk management, especially for public-listed companies. This is supported by the issuance of several regulations related to ERM. For instance, the Indonesia Financial Services Authority/Otoritas Jasa Keuangan (OJK) has launched risk management regulations, namely, Peraturan OJK (POJK) No. 17/2014 concerning integrated risk management for financial conglomerates; POJK No. 1/2015 concerning the implementation of risk management for non-bank financial services institutions; POJK No. 18/2016 concerning the implementation of risk management for commercial banks specified that bank is obliged to implement risk management effectively, either for the bank individually as well as for the bank in consolidation with the subsidiaries. In addition, at the ministerial level, some ministries have published ministerial regulations regarding risk management, such as the minister of finance regulation No. 191/PMK.09/2008 concerning implementation of risk management in the ministry of finance; the minister of law and human rights No. 5/2018 concerning risk management implementation. In the banking sector, Bank Indonesia has issued various regulations related to risk management, such as Bank Indonesia Regulation No. 11/25/PBI/2009; 11/23/PBI/2011 concerning implementation of risk management for commercial bank and sharia bank. Although various risk management regulations have been initiated by the Government, the practice of risk management in Indonesia is still low (CRMS Indonesia, 2017). Further, the national risk management surveys conducted in 2019 showed that the implementation of ERM in Indonesia is still facing issues such as the lack of roadmap of risk management in corporate strategy (33%), lack of adequate resources such as technology, resources, human beings, and budgets (31%) (CRMS Indonesia, 2019).

ERM and firm value
ERM is defined as a process influenced by the Board of Directors, management, and other personnel of the entity, applied to the establishment of a strategy and on all parts of the company, designed to identify potential events that could affect the entity, and manage risks aligned with entity risk appetite, to provide reasonable assurance towards achieving the objectives of the entity (COSO, 2017). Meanwhile, ISO 31000 defines the risk management process as "coordinated activities to direct and control an organization with regard to risk". It also provides a definition of the risk management framework as "set of components that provide the foundations and organizational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organization (ISO, 2018). Information on risk management is non-financial information that is strictly necessary for investors. The lack of non-financial risk information may mislead investors in their investment decision-making process (Abdullah et al., 2015). Therefore, higher quality of ERM is required to help identify opportunities that the company can use to efficiently allocate capital and increase return. Thus, if the implementation of ERM has higher quality it will be weighed well by financial market while increasing company performance (Baxter et al., 2013).
According to resource-based view (RBV) theory, the ability of resources in risk management may be able to contribute positively to the company (Penrose, 1959). Therefore, company will use its best resources in the form of implementing ERM to achieve the best business process to create the value of the company (Andersen, 2008;Bailey, 2019). Efforts to maximize the value of the company are completed in a variety of ways, including managing the risks that may occur. This is because the company's performance is influenced by specific factors of the company, such as environmental uncertainty, competition inter and intra industry, company scale, and the existence of the Board of Directors (Florio & Leoni, 2017;Gordon et al., 2009).
Many previous studies have suggested that ERM is positively related to market value (Bohnert et al., 2018;Chen et al., 2020;Farrell & Gallagher, 2015;Lechner & Gatzert, 2017;Malik et al., 2020;McShane et al., 2011;Silva et al., 2018). Danisman and Demirel (2018) reveals that ERM is a management process that allows companies to manage a wide range of risks in a top-down manner. Chen et al. (2020) found that company implementing ERM is able to gain additional benefits of 5.73% in the form of an increase in revenues compared to non-users. The additional benefits are gained as company is able to streamline the operating costs by 16.34%. Besides, ERM is a type of non-financial information required by outside parties in conducting assessments (Connelly et al., 2011). This is because company's risk information can help investors in making their investment portfolio decisions (Abdullah et al., 2015). Therefore, the better the company implements ERM, the more minimal influence of the various risks that the company will face, so it is able to achieve the company's business goals that increase the value of the company. The first hypothesis is: H1: ERM positively affect firm value

ERM and investment decisions
Investment decisions are the value of the firm that depends on management expenditure in the future. Therefore, it is expected that investment options will provide higher return (Gaver & Gaver, 1993). Product decisions, working capital management or merger/acquisition are some of examples of investment decisions. In addition, investment decisions are also important in determining the level of future cash flows that will be generated from investment activities (Dobbins, 1993). There are many factors that influence the investment decision made by the manager. Corporate risk management is one of critical factors (Li & Wu, 2009). Investment managers should know well the risk level of a tolerable investment, if it is accomplished by under managing risk, then it will negatively impact on the expected level of investment returns (Jankensgård, 2019). Hoyt and Liebenberg (2011) argued that entities implementing ERM and have a variety of investment opportunities may choose investments accurately based on level of risk adjustment than the entity using the traditional risk management approach. Khalfaoui and Derbali (2021a) explained that political risk and corporate governance can affect a country's investment climate. Thus, the entity with an effective ERM will increase investment in a feasible project (Andersen, 2008) and with efficient capital allocation and result in enhancing firm value (Myers & Read, 2001). Based on the arguments above, it is expected that the higher level of ERM maturity the better company's ability to recognize, manage and mitigate the potential risks that will be faced as a result of investment decisions.
H2: ERM positively affect investment decisions

The mediating effect of investment decisions on the relationship between ERM and firm value
Companies compete on the basis of their resources and ability to create competitive advantage (Peteraf & Bergen, 2003). The better the resources a company has, the better the business process they run, including in managing the risks it faces. Companies that implement ERM well, can choose investment alternatives based on a more accurate level of risk adjustment (Meulbroek, 2002). Moreover, companies that have a high level of risk maturity can encourage managers to behave more carefully and be more accountable for the investment decisions they make (Boyle et al., 2018). Gordon et al. (2009) argued that the relationship between the ERM and the company's performance is influenced by contingency factors such as environmental uncertainty and the level of competition. Higher level of investment decision accuracy will be obtained by the company with the highest ERM maturity level. Having a risk-based investment decision will reduce the level of uncertainty over the return that the company will obtain. For example, the risk of volatility in stock returns can affect foreign investment (Derbali & Lamouchi, 2020). The right investment decision will be a source of a company's competitive advantage. Thus, investment decisions can be a mediator over the effectiveness of ERM implementation in enhancing the company's performance.
H3: Investment decisions mediate the relationship between ERM and firm value

Sample and data collection
The research samples were all public companies listed on the Indonesia Stock Exchange (IDX) during the period from 2017 to 2018. Data were collected from companies' annual reports and the Bloomberg database. Determination of sample proportions using Slovin's formula approach. Based on the formula, the number of sample is as follows (Slovin, 1960): where: n = number of samples N = population size e = margin of error Table 1 presents the sample selection per industry. After the calculation of sample members and obtained sample members from each sector, the next is to withdraw samples for each sector using proportional random sampling approach. Samples for each sector are taken proportionally according to n based on the Slovin formula. For example, the financial sector with a total population is 82 companies. From 82 financial sector companies were randomly withdrawn using the help of Microsoft excel (randbetween) to selected 38 financial sector companies. If in the process of withdrawal in determining 38 companies appear the same company name, then a random withdrawal is made. Based on the Table, it can be seen that majority of the companies come from the trade, services and investment industry (46), followed by finance industry (38), basic industry and chemicals (28), property, real estate and building constructions (24), infrastructure, utilities, and transportation (23) and the least sector is agriculture (9).

Variable measurement
The ERM index calculation is conducted by calculating the total score reported by the company, which is then divided by 25 competency drivers. Then, determine the ERM rating into 5 categories based on the percentage. The ERM variable is measured based on maturity levels. The attributes of maturity level is obtained through the Risk Maturity Model (RMM) which is accessed through https://www.rims.org/resources/strategic-enterprises-risk-center/risk-maturitymodel. By following Farrell and Gallagher (2019)'study, the maturity level attributes is measured by seven attributes, namely: (1) ERM-based approach (2) uncovering risks (3) ERM process management (4) riskappetite management (5) root cause discipline (6) business resiliency and sustainability, and (7) performance management. These seven attributes further were categorized into 25 indicators. Then, the level of ERM (1-5) is categorized as follows: Level 1 if the ERM index between 1% and 20%; level 2 (21-40%), level 3 (41-60%), level 4 (61-80%), and level (81-100%). Table 2 presents the measurement of variables.

Econometrics equations
This study employed multivariate regression analysis, which is used to examine the influence of independent variables on a dependent variable. This analysis also measures the strength of a relationship between these variables, and it shows the direction of the relationship. The regression equations to test the hypothesis 1 and 2 are: FV = α + β 1 ERM + β 2 FIRMSIZE + β 3 BoDSIZE + e(2) ID = α + β 1 ERM + β 2 FIRMSIZE + β 3 BoDSIZE + e(3) Finally, to test the mediating effect of ID in the relationship between ERM and FV, path analysis and Sobel test were used. Path analysis was used to investigate patterns of effect within a system of variables. By using the path analysis, the effect of multiple predictors (ERM and ID) on a criterion variable (firm value) can be assessed. In addition, the Sobel test was also used to test the significance of a mediating effect. In mediation, the relationship between the independent variable and the dependent variable is hypothesized to be an indirect effect that exists due to the influence of a third variable (the mediator). As a result, when the mediator is included in a regression analysis model with the independent variable, the effect of the independent variable is reduced and the effect of the mediator remains significant. The Sobel test is a method of determining whether the reduction in the effect of the independent variable after including the mediator in the model is a significant reduction and, as a result, whether the mediation effect is statistically significant. To test the mediation effect of investment decisions (ID) in the relationship between ERM and FV, the regression equation is: ID = α + p 2 ERM + e 1 (4) FV = α + p 1 ERM + p 3 ID + e 2 (5)   Table 3 presents the descriptive statistics of continuous variables. Based on Table 3, it can be concluded that the mean of firm value of sample companies is low (1.516). In addition, the ratio of CAPEX to Net PPE is also relatively low (0.107). Related to ERM variables, the results showed that the mean of ERM maturity is 26.40%, the mean indicates that the maturity level of public companies in Indonesia is still at the level 2 or initial stage.

Descriptive statistics
Based on Table 4, it can be seen that the majority (43.95%) of ERM maturity level of companies is at the level 2 (initial) with a mean of 26.40. This finding suggested that the implementation of ERM in Indonesia public listed companies is still in the initial stage. However, the findings are also interesting to note that the financial industry outperforms other sectors in terms of maturity level of the ERM, which is 47.79. The high level of maturity of the ERM in the financial sector is likely due to government regulations, namely Regulation Number 17/2014, Number 1/2015, and Number 18/ 2016. These regulations require that companies running their business activities in financial services, financial conglomerations, commercial banking, and nonbanking are required to implement the regulations, also Bank Indonesia Regulation No. 11/25/PBI/2009; 11/23/PBI/2011 concerning implementation of risk management for commercial bank and sharia bank. This finding is consistent with the results of a national survey conducted by CRSMS Indonesia in 2017, which concluded that sectors that have particular regulations in the implementation of ERM, namely the financial and insurance sectors have a higher level of maturity than other sectors that do not have regulation (CRMS Indonesia, 2017). With respect to descriptive statistics for control variables, the company size variable (FIRMSIZE) shows that on average the companies sampled are among medium-sized companies. Furthermore, for the board size variable (BoDSIZE), it shows that the average company has a board of five directors.

Regression analysis results
Under the first hypothesis, it is stated that the level of ERM maturity positively affect the firm value. Table 5 presents the results of the results of regression analysis. Based on these results, it can be seen that ERM has a direct effect on FV (Panel A). Therefore, the first hypothesis is accepted. The positive effect of ERM and FV is consistent with the finding of prior studies that companies with more mature ERM processes perform better than companies with lower ERM levels (Callahan & Soileau, 2017), ERM adoption significantly helps a company improve its revenue and cost efficiencies (Chen et al., 2020), firms with advanced levels of ERM implementation present higher  (2019)'study, the maturity level attributes is measured by seven attributes, namely: (1) ERM-based approach (2) uncovering risks (3) ERM process management (4) risk-appetite management (5) root cause discipline (6) business resiliency and sustainability, and (7)  Notes: The industry is classified into 9 sectors according to the provision of the Indonesia Stock Exchange (IDX).
performance, firms with advanced levels of ERM implementation present higher performance, both as financial performance and market evaluation (Florio & Leoni, 2017). However, the regression findings also showed that there was a negative relationship between the size of the firm and the firm value. In addition, the size of the board of directors has no significant influence on the value of the firm either.
For the second hypothesis, the results of the regression tests (Panel B) show that ERM, FIRMSIZE and BoDSIZE have a positive impact on ID. These results support previous findings that concluded that companies that effectively implement ERM will benefit from investment in sustainable projects (Andersen, 2008). In addition, a robust ERM can lead to greater accountability by financial professionals to senior management, but apparently without stifling normal risk-taking (Boyle et al., 2018). Finally, Li et al. (2019) argue that the more risk information is disclosed, the less obvious the impact on under-investment will be, and the investment behaviour and efficiency will be Notes: FV, firm value measured by Price to Book Value ratio = market price per share divided by book value per share; ID, investment decisions measured by capital expenditure to net plant, property & equipment ratio; ERM, enterprise risk management measured by ERM index: total score indicators disclosed divide by 25 indicators; FIRMSIZE, firm size measured by total assets; BoDSIZE, board of director size measured by number of board of directors. All the regression assumptions have been met, no multicollinearity, heteroscedasticity, and auto-correlation problems. ** statistically significant at 0.01; * statistically significant at 0.05. improved. These findings also suggest that the size of the company and the size of the board of directors play a positive role in making better investment decisions.
The test results of the mediation effect are presented in the Table 6. Based on the path analysis result, it can be shown that ERM has a direct effect on FV and also has an indirect effect via ID. Therefore, the hypothesis 3 accepted. To test the consistency of the path analysis results, we also run the Sobel tests. The result of path analysis is consistent with the Sobel tests provided in the Table 7. Figure 1 portrays the coefficient of the path analysis. The total effect of the relationship can be calculated as follows: The coefficient of direct effect (p 1 ) is 0.391 and the coefficient of indirect effect (p 2 × p 3 ) is 0.043 (.027 × 1.608) and the total effect (p 1 + (p 2 × p 3 )) is 0.434 where the value of t-statistics (3.216) > t-table (1.965). Therefore, it can be concluded that ID acts as a mediating variable. Table 7 presents the result of Sobel tests. Based on the Sobel tests, the coefficient of the direct effect of ERM on FV is .434 (p-value < 0.001). Regarding the mediated effect of ERM on ID and ERM on FV is significant with the coefficient .027 and 1.607 with p-value < 0.001. Finally, the coefficient  of indirect effect of ERM on FV is .043 and significant. Moreover, Sobel test result (Panel A) showed that the coefficient of mediation effect (1.607) was higher than the direct effect coefficient (0.434). Also, for the coefficient of determination of mediation effect (Panel B, column B) is higher than the direct effect (column A). Overall, the results demonstrate that the relationship between ERM, ID, and FV are consistent with the prediction. The magnitude of mediating effect of ID on the relationship between ERM and FV is moderate (.310).

Conclusion
This study investigates the relationship between ERM and firm value, specifically examining the mediation effect of investment decisions on the relationship between the two. We found that ERM and investment decisions positively influence firm value. We also found that investment decisions play a mediation role in the relationship between ERM and firm value. The findings can be enlightened as follows: First, in line with RBV, the implementation of quality ERM is recognized to help companies to use more effective resources in production processes and supply chains. Active ERM may also avoid risks that result in lower performance, such as the quality of earnings and stocks price volatility (Andersen, 2008;AON Risk Solution, 2017). With the company's ability to balance existing threats and opportunities can have an impact on cost reductions through optimization of risk assessment integration and management functions. These cost reductions will provide additional benefits such as efficiency in business operations thus improving capital efficiency and return on equity (Hoyt & Liebenberg, 2011). In addition, the existence of ERM can also help companies in aligning risk appetite with the company's strategy (Nocco & Stulz, 2006). This is because ERM is able to increase the company's knowledge of risks, improve internal communication and reduce asymmetry information. Thus, the company is able to manage financial and operational risks, such as financial risk strategies, capital strategy, investment strategy, pricing and mix products. Obviously, with the company's ability to combine financial tools and operational risk modeling tools in a process defined by the ERM framework, companies will be able to achieve their goal of increasing the value of the company.
Second, linked the RBV, implementation of quality ERM may encourage companies to use more effective resources actively to avoid adverse events, leading to a decline in accounting and market value. When the risks of an event are managed thoroughly, the company may choose to invest in assets whose level of risk and return is going to be incurred and gain according to the risk appetite (Baxter et al., 2013). As explained before that ERM involves identifying risks, predicting how probable they are and how serious they might become, deciding what to do about them and implementing these decisions (COSO, 2017). For example, if equity is considered as risk capital then investors bear a higher degree of risk than other lenders. Equity ranks the lowest in terms of its claim on the assets of the project. The debt-equity ratio assigned to an investment is a measure of the risk in that investment. The more important the equity issue, the higher the perceived risk. By classifying and categorizing risk within these levels it is possible to drill down or roll up to any level of the organizational structure. Overall, companies implementing ERM with a variety of existing investment opportunities will benefit more from being able to choose investments based on the level of more accurate risk adjustments than those using a traditional risk management (Andersen, 2008). With the efficient capital allocation, they tend to invest in more valuable projects to improve the company's performance. Companies capable of taking significant risks greater, proven to be able to anticipate risks better than its competitors, allowing the company to outperform its competitors and increase the value of the company.
Finally, ERM can offer benefits if the company is able to integrate it into business processes, such as strategic management, strategic planning, as well as in financial and investment decisions. In RBV perspective, effective risk management provides incentives for essential stakeholders to invest in assets and competencies that are specific to the firm, which holds the key to develop responsive business opportunities and gain sustainable competitive advantage (Andersen, 2008). Accordingly, companies that are able to manage their risks well are proven to be able to choose investments based on an accurate level of risk adjustment, at the same time it can improve investment decisions. Investment decisions made accurately will certainly contribute positively to the value of the company.
Our study contributes in several ways. The results of this research contribute to enriching literature related to the implementation of ERM in a developing country. Theoretically, these findings also strengthen support for RBV, suggesting that ERM as a better resource may contribute to the company's competitive advantage. The practical implications of these findings suggest that ERM has a remarkably prominent role in improving the quality of investment decisions which successively may increase the value of the company. Policymakers can use these findings to propose to regulators on the benefits of ERM in improving the quality of investment decisions. Regulators can also continuously encourage companies from industries that do not have regulations related to the implementation of ERM to initiate ERM for their investment and operational activities.
As is commonly a research, this study is also having limitations that should be considered in generalizing the results of this study. First, the study likely contained a degree of subjectivity providing an ERM score. This subjectivity could have led to differences in scoring among researchers. Further analysis may also consider other ERM measurements such as ERM ratings to validate the consistency of the current study findings. Second, the results of this study found that the mediating effect of investment decisions on the relationship between ERM and firm value is partial, which means that there are other intervening variables that may affect the relationship between ERM and firm value. Further research may examine other variables that can affect the relationship between ERM and firm value such as the existence of financial professionals, board governance, and internal control quality.