Risk revisions lead to more board oversight

Risking capital or assets in search of financial reward is the definition of business, but governments and regulators have come to view risk as a pathogen and potential danger in the wake of the financial crisis. In this environment, the continual challenge for directors is still to identify the tipping point between opportunity and peril.

According to a recent report, Calculated Risk? from recruitment business Korn/Ferry, boards are now beginning to challenge their own views on risk management to see if they have become too risk-averse in the wake of the financial crisis. However, this revision must be accompanied by greater oversight and engagement at the board level.

The survey - which features the views of directors from organisations in the UK, Europe and the US - suggests that some companies wrongly believe that risks to the business have largely been eliminated if they have been identified and disclosed. It is also clear that not all executives fully understand the term “board oversight”.

“There is a lack of clarity as to what board oversight really means,” says Xavier de Sarrau, chairman of French multi-national media conglomerate Lagardère and a contributor to the report. “Board oversight is a grey area. It is up to the individual board to interpret the degree and extent of their oversight.”

The line between governance and management is a difficult one to maintain. David Sidwell, member of the board of directors at UBS, warns that there are potential dangers in taking an approach to risk oversight that is too active and intrusive.

“The dangers of an intrusive board are twofold,” says Sidwell. “Firstly, it seeds confusion in the business as to who really makes the decisions. Secondly, if the board becomes a de facto decision maker, it can no longer fulfil its primary purpose: to provide an objective oversight.”

Risk committees

Sidwell suggests that some boards might benefit from having a separate risk committee, largely because executives cannot deal with all aspects of risk management themselves. According to Sidwell, boards should decide upon a risk oversight structure appropriate to the complexity, risk appetite and regulatory requirements of the business. Businesses with highly complex risk profiles may also need to work on risk at the committee level for practical reasons, but the whole board must ultimately be both engaged in and accountable for risk management.

“I do not think it is reasonable to expect a full board to devote the time necessary to understand all the complex risks a company faces today,” he says.

However, other directors interviewed by Korn/Ferry disagree and prefer to retain responsibility at the full-board level. According to those who fall into this group, risk is too important to be devolved.