00:00:05
Fundamentally what we're looking at is
00:00:06
whether board oversight of risk
00:00:08
management actually makes any difference
00:00:10
at all. I mean, there's been big push
00:00:11
for risk management given the financial
00:00:13
crisis and many other things including
00:00:15
the economy now.
00:00:17
And so
00:00:18
uh institutional investor companies uh
00:00:21
regulators have been pushing boards to
00:00:22
do more board oversight of risk
00:00:24
management. The question is is it real
00:00:26
or is it just window dressing? Do you
00:00:28
just see companies putting this in
00:00:30
because this is what everybody wants? So
00:00:32
what we're looking at, does it really
00:00:33
make a difference how board does risk
00:00:35
oversight? Does it have an impact on the
00:00:37
risk management practices of the
00:00:38
companies? And ultimately does it pay
00:00:39
off? Do firms have lower risks when they
00:00:42
have more board oversight and higher
00:00:44
stock returns?
00:00:49
Well, one important thing is it really
00:00:51
matters
00:00:52
who is responsible on the board for risk
00:00:54
management. There's a lot of controversy
00:00:56
right now in terms of should it be the
00:00:57
board as a whole? Should you have a
00:00:59
committee like the audit committee
00:01:00
responsible for this? Should you set up
00:01:02
a separate risk management committee?
00:01:04
And various uh regulators groups have
00:01:07
taken different stances on this. If
00:01:08
you're a member of the New York Stock
00:01:10
Exchange, your audit committee is
00:01:12
required to do board risk oversight.
00:01:15
The Australian Stock Exchange is
00:01:16
completely different. They say the
00:01:18
entire board should be responsible for
00:01:20
board oversight. And the financial
00:01:22
institutions, a lot of them are required
00:01:23
to have a separate risk committee. So
00:01:25
one big issue was, okay, does it really
00:01:27
matter where you put this? And it turns
00:01:29
out it matters a lot. You better have
00:01:31
the entire board responsible instead of
00:01:33
delegating this to something like an
00:01:35
audit or a risk committee. And something
00:01:37
really interesting was even if you have
00:01:39
a separate risk committee, seemed to
00:01:40
have zero impact overall in terms of
00:01:43
what the company does in terms of risk
00:01:45
management practices and performance. So
00:01:47
there is an instance where it does look
00:01:49
like it may be window dressing.
00:01:51
Boards are putting this in, they're
00:01:52
setting up separate risk committees to
00:01:53
look like you know, we're paying a lot
00:01:55
of attention to enterprise risk
00:01:57
management, but in truth it really does
00:01:58
not look like it makes all that much
00:02:00
difference if you do that as opposed to
00:02:01
using existing board structures.
00:02:08
I guess some of it was just pure
00:02:09
descriptive statistics cuz we did this
00:02:11
this was a survey of companies that we
00:02:12
did in conjunction with Aon, the big
00:02:14
insurance broker.
00:02:16
And one of one of the interesting things
00:02:18
was how informal
00:02:20
a lot of the discussions between the
00:02:21
board and the top management are in
00:02:23
terms of risk management. You would
00:02:24
think these days companies would make
00:02:26
these much more formal and tame in terms
00:02:28
of things like risk appetite. How much
00:02:30
risk are we really willing to take on?
00:02:32
Cuz the idea of risk management is not
00:02:33
get rid of risk. Do it within your risk
00:02:36
appetite. And risk tolerance, how much
00:02:38
variability am I willing to take on
00:02:40
this? And you just look at the survey
00:02:41
responses. These are people admitting
00:02:43
that well, if we do it, it's very
00:02:46
informal. And we found this very
00:02:48
surprising given the atmosphere now that
00:02:49
you would think boards would much more
00:02:51
formal in trying to figure out what is
00:02:53
the risk appetite we want to go after
00:02:55
and what kind of tolerances, how much
00:02:56
variability are we willing to accept
00:02:58
once we've done this. But it's very very
00:03:00
informal.
00:03:05
Again, one of the big things is who is
00:03:07
going to be responsible. You really have
00:03:08
to set in your charter having the whole
00:03:10
board responsible. Now you may decide
00:03:12
that certain types of risks are handled
00:03:13
by different committees. So obviously
00:03:15
financial risks are generally audit
00:03:17
committee. But you might have other risk
00:03:19
go to other committees where the
00:03:20
expertise is, but overall the board has
00:03:22
to be responsible. This is not something
00:03:24
you can delegate.
00:03:25
The other thing is you have to have much
00:03:27
better communication between the board
00:03:29
and your senior management. Because what
00:03:30
we found out is if the only time that
00:03:32
you actually talk to senior management
00:03:34
about risk practices is during the
00:03:36
annual or quarterly board meetings, it's
00:03:39
very detrimental. You really have to
00:03:40
have these discussions outside the board
00:03:42
meetings and an ongoing review of what
00:03:45
is our risk appetite and what is our
00:03:46
risk tolerance.
00:03:51
You need to hire risk expert. Somebody
00:03:54
who's an expertise. Once you've
00:03:55
identified here are our key risks,
00:03:57
you need to have somebody on the board.
00:03:59
And this is part of the problem with
00:04:00
delegating it to a committee.
00:04:02
Right, the audit committee, which is
00:04:03
generally the committee that's
00:04:04
responsible, their expertise at
00:04:06
financial risks. Credit risk, market
00:04:09
risks, you know, we're going to use
00:04:10
derivatives or not use derivatives.
00:04:12
They know almost nothing about
00:04:12
cybersecurity.
00:04:14
And that's where you're seeing the big
00:04:15
push that once the board kind of spends
00:04:17
time figuring out where our issues are,
00:04:19
maybe that's when you need expertise
00:04:22
there. That you can't expect to just
00:04:24
take existing board members to know much
00:04:26
about this stuff. If nothing else, get
00:04:28
have them
00:04:29
figure out who is the risk expert
00:04:30
they're going to hire within the firm
00:04:32
and enhance the communications that go
00:04:34
on even if you don't have somebody on
00:04:35
the board specifically who has that
00:04:37
expertise.
00:04:42
I think one of the big issues is
00:04:44
risk is a responsibility of the audit
00:04:46
committee.
00:04:47
And and it's all an issue of that's
00:04:49
where traditionally risk is. We've
00:04:50
always thought of financial risks in the
00:04:51
companies. It's not that companies don't
00:04:53
think about risks,
00:04:55
but it's always been financial risk,
00:04:56
credit risk that people have worried
00:04:57
about.
00:04:58
I'm in an accounting department. Let me
00:05:00
tell you, finance and accounting people
00:05:01
are not experts at any kind of risk
00:05:03
outside financial risks. So putting it
00:05:06
there, which is the requirement of the
00:05:07
New York Stock Exchange listing is the
00:05:09
board audit committee will have board
00:05:12
oversight over risk. It's just not
00:05:14
right. It and especially as you pointed
00:05:16
out, as you expand the number of risks
00:05:17
we're facing or at least recognize them
00:05:19
even if we've had them in the past,
00:05:22
this notion that it should be the board
00:05:23
audit committee cuz they've always done
00:05:25
risk is not right. They've always done
00:05:26
financial risks. They just do not have
00:05:28
the expertise outside there.
00:05:34
What people generally have looked at is
00:05:36
there some association between some
00:05:38
overall risk management index or score
00:05:41
and things like firm variability in
00:05:43
stock price.
00:05:45
We're really trying to say, okay, what
00:05:46
are the mechanisms here? Right, if I'm a
00:05:48
manager just saying, okay, I should have
00:05:49
better risk management really is not
00:05:51
going to help you much. What I want to
00:05:53
know is how do I organize my firm? And
00:05:54
the reason we start at the board is the
00:05:56
whole notion that the tone is always set
00:05:58
at the top. Forget about worrying about
00:06:01
how I do individual risk management. You
00:06:03
know, the first thing you got to do is
00:06:04
get the whole company on board.
00:06:07
And it's got to start with the board of
00:06:08
directors. And that's very different
00:06:10
than what other people have done because
00:06:11
until you could say, well, what's the
00:06:13
mechanism I have to put in place
00:06:15
to make sure that we put risk management
00:06:18
as a strategic issue in the firm,
00:06:19
there's no point.
00:06:24
There there are requirements in the
00:06:25
United States and other countries where
00:06:27
there's actually board performance
00:06:29
evaluation. Very few people actually
00:06:30
realize this, but you're supposed to
00:06:31
evaluate the performance of your own
00:06:33
board.
00:06:34
And part of it is actually putting
00:06:36
responsibility for risk management
00:06:38
practices and board oversight into the
00:06:40
performance evaluation on this. And what
00:06:42
we actually did find in our results that
00:06:44
companies that actually one, they do
00:06:47
performance evaluations of their boards,
00:06:49
and two, they incorporate risk
00:06:51
management responsibilities in the
00:06:52
evaluation, actually were the ones who
00:06:54
put in better risk management practices.
00:06:57
So again, incentives and accountability
00:06:59
are key. Not just looking at the
00:07:00
managers in your firm, but also looking
00:07:03
at the board, you know, and lining
00:07:05
getting their incentives aligned with
00:07:06
risk management.
00:07:12
Well, part of what we're looking at is
00:07:14
when you look at what's the objective of
00:07:16
risk management in your company, how
00:07:18
does it that impact which practices
00:07:19
you're going to put in and what the
00:07:21
implications are? Because one simple way
00:07:23
to think about risk management is all
00:07:25
we're trying to do is avoid risks or at
00:07:27
least mitigate them if they happen.
00:07:29
That's only looking at the downside of
00:07:31
risk. But if you really believe that
00:07:33
there's a risk-return tradeoff, which is
00:07:35
the only way to make higher returns is
00:07:37
to get to have take on more risk.
00:07:40
You can also use risk management to
00:07:41
increase the value of the firm. Let's
00:07:42
take on the right risks. Let's figure
00:07:44
out where I have multiple risks in the
00:07:45
firm, how they interact with each other
00:07:48
such that I don't take one that has a
00:07:49
big impact on somewhere else. So when
00:07:51
you take companies that really see it
00:07:53
risk management as a value-enhancing
00:07:55
objective as opposed to just a cost
00:07:57
minimization or avoid a problem,
00:08:00
how does that impact the practices you
00:08:02
actually put in and which ones are more
00:08:04
effective? And ultimately how does that
00:08:05
impact firm performance? And some of our
00:08:07
initial results suggest that it makes a
00:08:09
huge difference. The firms that that
00:08:11
have looked at this as a value-enhancing
00:08:14
objective as opposed to just minimize a
00:08:17
cost or avoid the downside, are really
00:08:20
the ones those are the only firms really
00:08:21
that are seeing any kind of real
00:08:23
financial gain as opposed to just
00:08:25
minimizing costs from enterprise risk
00:08:27
management practices.
