SEC’s new rules = half the risk management story

The US Securities and Exchange Commission (SEC) recently approved “new rules to enhance the information provided to shareholders so they are better able to evaluate the leadership of public companies.” Their focus is on corporate governance, compensation, and risk. While the SEC has made progress creating transparency for governance and compensation, they are still struggling to properly reveal a company’s risk management profile.

The SEC is striving to make corporate leaders act in an ethical, accountable manner. They are effective at legislating corporate transparency, disclosure, and exposing conflicts of interest. However, regulating a company to disclose how it manages risk is trickier. Highly effective risk management identifies and manages risks that can prevent an organization from achieving its key objectives. Therefore disclosing your key risks will also disclose your strategic secrets. Publishing your detailed corporate objectives would be tantamount to competitive suicide, hence the SEC’s challenge.

The SEC’s approach as a result remains limited to revealing the board's role in the risk oversight of the company. It’s an arm’s length view of the company’s risk profile. Understanding the Board’s role in risk oversight is a long way from understanding how much risk a company is adopting or how it is addressing its risks. The SEC is now distinguishing between good ethics, and sound strategic risk management. The former is appropriately disclosable, the latter is not.

The SEC is only one oversight body who is trying to increase risk management in companies. For example, Standard and Poor’s is beginning to apply high level risk management analysis to the companies it covers. But ultimately, risk management is about ensuring corporate performance, and maintaining stakeholder confidence in your company. Don’t rely on third parties to manage public expectations about your company’s risk management program. Use your website and other corporate communications to instill confidence that you are effectively managing risk.

[Rich]
richard.m.wilson@ca.pwc.com

Risk Appetite - more than just a concept

I recently met with a senior management team to establish a risk appetite statement.  It was the first time they had been through this type of exercise.  I drafted a proposed statement in advance that in 2 sentences described how much risk the company should typically take on in any transaction.  Once confirmed by management, this simple statement could be communicated to everyone in the company as another way of to heighten consistency of risk taking.

For example your a risk appetite statement for a bank could state that every transaction in the bank must follow standard procedures governed by internal controls to ensure the risk is minimized and to protect shareholder value.  Whereas a more risk-oriented company might state that to ensure aggressive growth in new markets risk-informed decisions will guide decision making to maximize return to shareholders.

At the beginning of our meeting the exercise was met with some skepticism - it felt too academic for some.  But when I asked each participant to state what the company's risk appetite on a scale of 1-5 (1 being highly risk adverse and 5 being risk accepting), their answers ranged from 1 to 4.  A 2 hour discussion followed where a great deal of consensus was created around how the company considers and manages risk.  in the end the skeptics became the greatest supporters of the process as it aligned a myriad of opposing opinions about the company's approach to risk.

In short, if management isn't aligned on how much risk to adopt and how to manage it, then the same will follow for front line management as well.  As one participant stated, "If we aren't in agreement about managing risk can you imagine how confused our employees will be?"

The simple act of drafting a risk appetite statement can be very effective in aligning everyone in the company to manage risk in a consistent manner.  Later it can tactically translate into specific risk tolerances for each area of risk.  It's simple and very effective.

[Rich]
richard.m.wilson@ca.pwc.com