Preparing for the Unknowable

The ongoing crisis in worldwide credit markets points, in part, to a colossal failure in risk assessment at a stunning number of companies. The questions on the minds of directors today are, “How can any board adequately anticipate and prepare for the unknown? What is the board’s responsibility when such failure occurs? What is the role of the auditor? And does risk management belong to the full board or in a committee all its own?”

It will be a long time before “we understand what went wrong and specifically what the board risks are going forward,” said Neil Goldenberg, partner-incharge of Internal Audit & Risk Management at Eisner, a New Yorkbased accounting and audit firm that hosted a Directorship Roundtable on “Developments in the Oversight of Risk Management.” Goldenberg further added, “What we see when there are failures like this is that there’s a lack of communication and a lack of formality. Directors need to make sure that there is a professionalized risk-management structure in place.”

One topic that elicited many viewpoints was whether boards should consider setting up separate risk-management committees. Of the 12 largest financial companies, only two—Goldman Sachs and JP Morgan—had dedicated risk committees before the crisis emerged. Was it cause or effect that these titans have so far escaped the magnitude of the billion- dollar-plus writedowns of their competitors?

John Biggs, the former chairman and CEO of TIAA-CREF who recently stepped down from the JPMorgan Chase board, noted that when he began serving on that board in 2003, there was some overlap in committee responsibilities. What the risk committee did was provide a more careful examination of the larger enterprise variety risk issues. “The audit committee would look at the credit risk, but the risk committee took a more wide-angle view of the different kinds of credit and operational risks, which was a big deal at the time because we had just settled with the State of New York on Enron,” Biggs said. One precaution that appears to have served JPMorgan well is a stipulation that any product with a highprofit margin be brought before the risk committee automatically.

Taking the contra side of the argument, David Meachin, chairman and CEO of Cross Border Enterprises, a New Yorkbased investment bank, believes that the responsibility for risk management rests with the full board rather than in a committee. “Risk management needs to be factored into every manager’s job internally and the board as a whole must take into consideration the knowns, the unknowns, and unknowables,” he said.

Risk should no more sit in a committee by itself than diversity, strategy or innovation, said Allan Grafman, president of All Media Ventures and a director at Majesco Entertainment. “Risk management should be instilled throughout the entire company.”

Some directors and legislators believe the regulatory agencies need to do a better job of oversight to ensure the lending markets are run in a safe and sound manner. Questions have also arisen about the banks’ relations with credit rating agencies— Moody’s Investors Service, Standard & Poor’s, and Fitch Ratings—for not properly evaluating the risks of bonds backed by the mortgages given to subprime borrowers. Was this an instance of not questioning what seemed too good to be true? That’s one opinion. “The frank answer is we don’t know. There are many theories that we can speak of…or whether, like WorldCom, it is another issue of fraud,” said Nawal Roy, former Moody’s vice president and member of the Professional Risk Managers’ International Institute. “It’s too premature to say.”

Blame to Share

Unlike accounting and GAAP-related risks which had been commonplace, the credit crisis arose out of operational issues and a sudden change in the credit cycle. “I’m happy for the ratings agencies because for the first time in a long time, this has less to do with accounting and more to do with the value of these instruments,” said Bruce Rosen, Eisner partner-in-charge of assurance services. “What you’re going to find is that pieces of risk were spread out in such a manner that valuations are coming into question.”

“This has nothing to do with accounting,” agreed Meachin. “I do not understand how a board in 2007 could watch [former Merrill Lynch CEO] Stan O’Neal move from $1 billion to $40 billion [in exposure] and not ask about the shift in balance. In my view, the job of boards is to ask the common-sense questions.”