Risk Issues for the Board

Presented By:

Dr. Cesar G. Saldaña, Ph. D.Founding Fellow, ICD

Rising Risks: New Challenges and Trends

Turbulence is certainly not unique to corporations, it increases the need for risk management and the board’s risk oversight.

The board to oversee the impact of change on the company arising from such sources as :

Technology, including the Internet and mass media Globalization The threat of terrorism

The Importance of Oversight by the Board

Risk oversight – “the systematic process of managing an organization’s risk exposures to achieve its objectives in a manner consistent with public interest , human safety, environmental factors and the laws”

To ensure adequate risk oversight by the board, directors must:

understand the specific risks facing the company ensure that there is a process in place to alert them to

the occurrence of those risks

Legal and Regulatory Incentives for Oversight

Directors should require assurance of reasonably designed corporate information and reporting systems for monitoring risks.

New U.S. SEC regulations (as a reference point of “international best practice”):

Increase the responsibilities of the audit committee Require closer management review of internal

controls Mandate an enhanced board review of financial

disclosures

Legal and Regulatory Incentives for Oversight

A new SEC rule implemented beginning in 2003 required CEOs of listed companies with sales of $1.2 billion or more to certify the accuracy of their companies’ financial statements.

The New York Stock Exchange (NYSE) and Nasdaq issued new requirements:

Audit committee members should discuss policies with respect to risk assessment and risk management

The board should hold meetings without management present.

Identifying Specific Uncertainties and Risks

Directors need to ensure that management has identified the specific material risks the company faces.

Material risk – “risks of a magnitude that a reasonably prudent person would consider important in the context of the company’s business”.

Risk may be immediate or long-term: Short-term – includes financial market fluctuations,

sudden emergence of a brand-new technology, changes in suppliers’ price structures, etc.

Long-term – based on gradual trends such as demographic shifts or the gradual loss of an innovative culture within company

Identifying Specific Uncertainties and Risks

Furthermore, short- and long-term risks may either be internal or external:

Internal risk – stems from events occurring inside the company including employee crimes, accidents within the company and unexpected turnover

External risk – stems from events occurring outside the company such as act of war or terrorism and natural events

Long-term Internal (e.g., gradual loss of innovative culture, increasing cost of

labor)

Long-term Extrinsic (e.g., a demographic

shift, increasing dominance of China)

Short-term Internal (e.g., loss of a key

executive, labor strike)

Short-term Extrinsic (e.g., a terrorist act,

natural disaster)

A Risk Grid

Long-term

Internal

Short-term

External

“Code Red”: Risks that Can Lead to a Crisis

In monitoring risks, directors need to anticipate material risks that can lead to a crisis

Crisis – the occurrence of a surprising and calamitous event.

These are “Code Red” risks that can lead to:

Loss of control by management. Lack of real-time information available to decision

makers. A siege by persons harmed by the event and the

media covering the event.

The “Spiral Factor”

Directors and management should discuss plans for addressing Code Red risks and how to mitigate their impact.

The board should have a plan for minimizing the “spiral factor” of crisis.

The board should help identify the links in the crisis chain and sever them before they cause or deepen a crisis

Ensure that management creates policies and procedures to deal with trouble as it evolves.

The Value of Board Oversight

The board can help curb the impact of the crisis at each step.

The board can prevent management from taking the risks (e.g., in the case of Bankers Trust, what would have happened if the board knew the risks the bank was taking, questioned management, and pushed management to disclose those risks to public?).

In some cases, management hides the risk from higher management and the board -- the “rouge trader” in Barings. They show the importance of internal information and control systems.

Some risks are outside the control of management. The board should take control.

Reference:

Director’s Handbook, Sections 1-5, National Association of Company Directors (NACD), U.S.A.

Dr. James Darazdi and Prof. Robert Stobaugh, Director’s Handbook Series, 2003.