Enterprise risk management and organizational performance: a bibliometric-thematic review and integrative conceptual framework

Purpose This study examines how the literature has explained the relationship between enterprise risk management (ERM) and organizational performance (OP), seeking to understand not only whether ERM is associated with performance, but also how and under what conditions this association emerges. Design/methodology/approach Combining bibliometric and thematic analyses, this study examines 216 peer-reviewed articles published between 1999 and 2025 and indexed in Scopus and Web of Science. The bibliometric analysis maps scientific production, intellectual structure, and thematic evolution, whereas the thematic analysis examines quantitative studies that tested mediating and moderating effects in the relationship between ERM and OP. Findings The findings show a marked increase in the number of publications after 2017 and a shift in focus from firm value and financial performance toward governance, organizational culture, sustainability, emerging markets, capabilities, and measurement. The thematic analysis suggests that ERM tends to be associated with performance when risk information is converted into knowledge, governance routines, organizational capabilities, and strategic decisions. The relationship also depends on organizational, sectoral, institutional, and methodological contingencies. Research limitations/implications Reliance on Scopus and Web of Science, the exclusive use of English-language search terms, and the restriction of the thematic analysis to quantitative studies constitute the main limitations. Future research may broaden database and language coverage and incorporate additional methods, particularly qualitative and longitudinal designs. Practical implications The simplistic logic that “more ERM is better” does not appear to hold, since similar practices may be associated with different outcomes depending on available resources and capabilities, as well as organizational conditions. For policymakers and regulators, evidence from different institutional environments suggests that the formal adoption of ERM should not, by itself, be interpreted as evidence of its effective integration into the organization, particularly in settings characterized by greater institutional and resource constraints. Originality/value The article integrates bibliometric and thematic evidence within a multi-stage framework that conceptualizes ERM as a contingent and integrative organizational capability rather than simply as a formal risk management practice.