00:00:05
Fundamentally what we're looking at is whether board oversight of risk management actually makes any difference
00:00:10
at all. I mean, there's been big push for risk management given the financial
00:00:13
crisis and many other things including the economy now. And so uh institutional investor companies uh
00:00:21
regulators have been pushing boards to do more board oversight of risk management. The question is is it real
00:00:26
or is it just window dressing? Do you just see companies putting this in because this is what everybody wants? So
00:00:32
what we're looking at, does it really make a difference how board does risk oversight? Does it have an impact on the
00:00:37
risk management practices of the companies? And ultimately does it pay off? Do firms have lower risks when they
00:00:42
have more board oversight and higher stock returns? Well, one important thing is it really
00:00:51
matters who is responsible on the board for risk management. There's a lot of controversy
00:00:56
right now in terms of should it be the board as a whole? Should you have a committee like the audit committee
00:01:00
responsible for this? Should you set up a separate risk management committee? And various uh regulators groups have
00:01:07
taken different stances on this. If you're a member of the New York Stock Exchange, your audit committee is
00:01:12
required to do board risk oversight. The Australian Stock Exchange is completely different. They say the
00:01:18
entire board should be responsible for board oversight. And the financial institutions, a lot of them are required
00:01:23
to have a separate risk committee. So one big issue was, okay, does it really matter where you put this? And it turns
00:01:29
out it matters a lot. You better have the entire board responsible instead of delegating this to something like an
00:01:35
audit or a risk committee. And something really interesting was even if you have
00:01:39
a separate risk committee, seemed to have zero impact overall in terms of what the company does in terms of risk
00:01:45
management practices and performance. So there is an instance where it does look
00:01:49
like it may be window dressing. Boards are putting this in, they're setting up separate risk committees to
00:01:53
look like you know, we're paying a lot of attention to enterprise risk management, but in truth it really does
00:01:58
not look like it makes all that much difference if you do that as opposed to using existing board structures.
00:02:08
I guess some of it was just pure descriptive statistics cuz we did this this was a survey of companies that we
00:02:12
did in conjunction with Aon, the big insurance broker. And one of one of the interesting things
00:02:18
was how informal a lot of the discussions between the board and the top management are in
00:02:23
terms of risk management. You would think these days companies would make these much more formal and tame in terms
00:02:28
of things like risk appetite. How much risk are we really willing to take on? Cuz the idea of risk management is not
00:02:33
get rid of risk. Do it within your risk appetite. And risk tolerance, how much variability am I willing to take on
00:02:40
this? And you just look at the survey responses. These are people admitting that well, if we do it, it's very
00:02:46
informal. And we found this very surprising given the atmosphere now that you would think boards would much more
00:02:51
formal in trying to figure out what is the risk appetite we want to go after and what kind of tolerances, how much
00:02:56
variability are we willing to accept once we've done this. But it's very very
00:03:00
informal. Again, one of the big things is who is going to be responsible. You really have
00:03:08
to set in your charter having the whole board responsible. Now you may decide that certain types of risks are handled
00:03:13
by different committees. So obviously financial risks are generally audit committee. But you might have other risk
00:03:19
go to other committees where the expertise is, but overall the board has to be responsible. This is not something
00:03:24
you can delegate. The other thing is you have to have much better communication between the board
00:03:29
and your senior management. Because what we found out is if the only time that you actually talk to senior management
00:03:34
about risk practices is during the annual or quarterly board meetings, it's very detrimental. You really have to
00:03:40
have these discussions outside the board meetings and an ongoing review of what is our risk appetite and what is our
00:03:46
risk tolerance. You need to hire risk expert. Somebody who's an expertise. Once you've
00:03:55
identified here are our key risks, you need to have somebody on the board. And this is part of the problem with
00:04:00
delegating it to a committee. Right, the audit committee, which is generally the committee that's
00:04:04
responsible, their expertise at financial risks. Credit risk, market risks, you know, we're going to use
00:04:10
derivatives or not use derivatives. They know almost nothing about cybersecurity.
00:04:14
And that's where you're seeing the big push that once the board kind of spends
00:04:17
time figuring out where our issues are, maybe that's when you need expertise
00:04:22
there. That you can't expect to just take existing board members to know much
00:04:26
about this stuff. If nothing else, get have them figure out who is the risk expert
00:04:30
they're going to hire within the firm and enhance the communications that go
00:04:34
on even if you don't have somebody on the board specifically who has that expertise.
00:04:42
I think one of the big issues is risk is a responsibility of the audit committee.
00:04:47
And and it's all an issue of that's where traditionally risk is. We've
00:04:50
always thought of financial risks in the companies. It's not that companies don't
00:04:53
think about risks, but it's always been financial risk, credit risk that people have worried
00:04:57
about. I'm in an accounting department. Let me tell you, finance and accounting people
00:05:01
are not experts at any kind of risk outside financial risks. So putting it there, which is the requirement of the
00:05:07
New York Stock Exchange listing is the board audit committee will have board oversight over risk. It's just not
00:05:14
right. It and especially as you pointed out, as you expand the number of risks we're facing or at least recognize them
00:05:19
even if we've had them in the past, this notion that it should be the board audit committee cuz they've always done
00:05:25
risk is not right. They've always done financial risks. They just do not have
00:05:28
the expertise outside there. What people generally have looked at is there some association between some
00:05:38
overall risk management index or score and things like firm variability in stock price.
00:05:45
We're really trying to say, okay, what are the mechanisms here? Right, if I'm a
00:05:48
manager just saying, okay, I should have better risk management really is not going to help you much. What I want to
00:05:53
know is how do I organize my firm? And the reason we start at the board is the whole notion that the tone is always set
00:05:58
at the top. Forget about worrying about how I do individual risk management. You
00:06:03
know, the first thing you got to do is get the whole company on board. And it's got to start with the board of
00:06:08
directors. And that's very different than what other people have done because
00:06:11
until you could say, well, what's the mechanism I have to put in place to make sure that we put risk management
00:06:18
as a strategic issue in the firm, there's no point. There there are requirements in the
00:06:25
United States and other countries where there's actually board performance evaluation. Very few people actually
00:06:30
realize this, but you're supposed to evaluate the performance of your own board.
00:06:34
And part of it is actually putting responsibility for risk management practices and board oversight into the
00:06:40
performance evaluation on this. And what we actually did find in our results that
00:06:44
companies that actually one, they do performance evaluations of their boards, and two, they incorporate risk
00:06:51
management responsibilities in the evaluation, actually were the ones who put in better risk management practices.
00:06:57
So again, incentives and accountability are key. Not just looking at the managers in your firm, but also looking
00:07:03
at the board, you know, and lining getting their incentives aligned with risk management.
00:07:12
Well, part of what we're looking at is when you look at what's the objective of
00:07:16
risk management in your company, how does it that impact which practices you're going to put in and what the
00:07:21
implications are? Because one simple way to think about risk management is all we're trying to do is avoid risks or at
00:07:27
least mitigate them if they happen. That's only looking at the downside of risk. But if you really believe that
00:07:33
there's a risk-return tradeoff, which is the only way to make higher returns is
00:07:37
to get to have take on more risk. You can also use risk management to increase the value of the firm. Let's
00:07:42
take on the right risks. Let's figure out where I have multiple risks in the
00:07:45
firm, how they interact with each other such that I don't take one that has a
00:07:49
big impact on somewhere else. So when you take companies that really see it risk management as a value-enhancing
00:07:55
objective as opposed to just a cost minimization or avoid a problem, how does that impact the practices you
00:08:02
actually put in and which ones are more effective? And ultimately how does that impact firm performance? And some of our
00:08:07
initial results suggest that it makes a huge difference. The firms that that have looked at this as a value-enhancing
00:08:14
objective as opposed to just minimize a cost or avoid the downside, are really the ones those are the only firms really
00:08:21
that are seeing any kind of real financial gain as opposed to just minimizing costs from enterprise risk
00:08:27
management practices.