Boards are under increasing pressure to oversee risks and perform an outstanding job in risk governance. Many boards are scratching their heads and trying to figure out which approach to an effective risk oversight and risk governance works well. Executives and Management are ultimately responsible for exercising prudent care to keep the risks at bay. However, the Board of Directors is responsible to make sure that proper controls, rules, procedures, policies, and monitoring tasks are in place.
The key questions are: What are boards doing about it?
How can boards become "Risk Smart"?
More and more boards have established a board-level risk committee. You'll find those risk committees more often in large public corporations. However, the trend of establishing a risk committee can now be found in mid-size and privately held companies. This trend is now gaining momentum in other, less regulated industries. In just a few years from now, I would bet that you'll find a risk committee in the majority of companies and organizations – regardless of its size and market.
Why is this trend noteworthy? Why is this so important to the readers of this newsletter? Why should board members and executives look into this trend deeper? The answer is rather simple: Boards are charged with the responsibility of overseeing the various risks as effectively as possible. The difficulty and intricacy to properly oversee the various risks are growing constantly and have never been greater. How can the board become "Risk Smart"?
Based on my experience and observations at various boards, there are six distinctive actions and tasks that can increase the "Risk Smartness" and the prudent governance approach:
- Clearly define the board's role for overseeing the company's risk
The most important elements of the board's risk oversight role:
- Formation and configuration of the risk governance
- Oversight and observe the risk management process
- Partnership and cooperation with the CEO and executive team to clearly understand everyone's roles and responsibilities of certain critical risks
2. Create and cultivate a "Risk Smart" culture
The most important components of a "Risk Smart" culture:
- Clearly identify and assign accountability and responsibilities
- Policies and procedures are in place that clearly describe what risk factors need to be communicated and reported to the appropriate people
- Let the employees question or challenge the organization whenever they have a legitimate concern risks
- The organization has a specific set of rules that support the values and conviction of the organization, and all employees clearly identify themselves with and follow those rules
- The organization continuously educates and trains its employees with an appropriate set of skills, know-how, and risk aptitude
3. Recognize the risk appetite of the organization and create a tailored approval process
The important parts of a risk appetite and approval process are:
- Determine how much of a risk the organization is willing and able to take
- Differentiate if a risk is quantitative or more qualitative
- Only the board can approve a major risk – it is a board's decision and beyond the CEO's authority
- It is important for the board to connect the risk factors to the company's strategy
- Once a risk is approved by the board, the executive team communicates that decision throughout the company
- The executive team should continuously keep an eye on any company's exposure. The executive team can make certain adjustments and changes to some policies and procedures but must report those modifications to the board
- Depending on the culture and nature of the business, some companies are risk takers while others are risk adverse
4. The board assist and aids the executive team to incorporate risk thinking into their strategy
One of the most important tasks of the board is to advice the executive team about the alignment of the strategy with the company's mission, vision, specific milestones, and risk factors
- The board provides essential leadership in the strategic planning process
- The board can bring significant value to the table by providing an expanded perspective and experience on certain strategic risk factors – actual losses as well as faded away opportunities
- The board can challenge the executive team's overly optimistic views of the future
- The board can sometimes "peek around the corner" by clearly grasping any potential disruptions or newly created risks which the executive team may have overlooked
5. Evaluate the development and advancement of the risk governance method
Regular assessment can help boards determine whether it is receiving the quality and the quantity of information to carry out its role. What is the secret key for an effective assessment? Asking the right questions and compare if the current risk governance is still working properly. For instance:
- Has the executive team passed on certain risk issues to the risk committee?
- Is the entire board informed about certain risk issues – whether new issues or ongoing issues?
- Does the executive team clearly identify certain risks, accompanying assumptions, and alternative solutions – and discuss those steps with the risk committee and / or with the entire board?
- Is the board being informed on a timely fashion when risks arise?
- How does the executive team monitor and recognize new upcoming and developing risks?
- Is there an agreement with the board when the executive team should take action?
6. Make certain that the company discloses all noteworthy risks to its stakeholders
The organization should do more than just satisfy the boilerplate requirements as set by the SEC disclosure rules. The higher the quality of information published and how the company drives risk monitoring in all important decisions, the better.
- Since there is no specific rule set by the SEC of how the process of good governance is supposed to work, the company has an opportunity to being more attractive to shareholders by clearly communicating what type of risk management and risk oversight is in place.
- The board has an opportunity to grow its risk-related oversight tasks by distributing the risk-related responsibilities among various committees, not only the newly established risk-committee.
- The creation of a risk management team can certainly enhance the work of the newly established risk-committee.
- The board can provide much more than boilerplate and "legalese". The board can add value by providing thoughtful descriptions and some specific quantitative analysis.
- The board can provide visibility of how the risk management and risk oversight actually function at the company along with a short presentation of the board processes.
- Gain credibility and trust in the eyes of shareholders and prospective investors by disclosing how well the board and executive team has kept many risks at bay and even reduced certain risks.
The trend of continuously rising risks can have a serious effect on any organization. That's why the role of the risk smart board is extremely important and valuable. By having a strong and also a forward-thinking base in place – risk oversight, risk smart culture, risk appetite, alignment of strategy and risks, continuously evaluating the risk oversight process, and disclosure to the investors - boards can help make the company more attractive to shareholders.
I hope that these insights can be useful to your board and company as a guide toward a "Risk Smart" organization. For any comments or questions, please contact me.
Erich Stolz
18 years Board Experience at various companies and industries.
Served on Audit, Compensation, Governance, and Strategy Committees.
I can be reached at 832-372-5419 or
Erich.Stolz@BoardDirector.net
No comments:
Post a Comment