BUSINESS LEADERS FACE many seriousquestions. How does a chief executive officer best pilot anorganization? When does it make sense to have a separate chairman andCEO? What is the best balance in the relationship between a CEO and aboard? In each case, the frustrating but correct answer is: “Itdepends.”
That also emerges as the right answer as to how aboard should manage risk. Directors attending a roundtable entitled”Risk Management and the Boardroom” found that no single committeestructure should be universally adopted. At some companies, it makessense for the risk function to report to the audit committee. Othercompanies find they need a committee other than the audit committeedevoted to risk. And at least one, the giant municipal bond insurerMBIA, spreads the risk management function over three committees. Oneis the credit risk committee, because the insurer takes such hugepositions in financial markets, said board member Debra Perry. “I thinkthere is a great deal of benefit that comes from spreading the wealth,so to speak, in risk oversight,” Perry said. At yet other companies,the entire board manages the risk function directly.
Each company and each industry also face different”baskets” of risk. It may make sense in one industry to identify andmanage currency risks; but in another setting, that may not benecessary. Some companies may face regulatory or compliance risks,while for others the greater risk is technological change.
A final piece of the riddle is that different risks need to be manageddifferently. It may be adequate for management to make an annualpresentation to the board on a particular risk; but for other basketsof risk, boards may find that they need much more elaborate “riskmitigation” systems that catalog risks and rank them on a quadrant ofprobability and potential impact. “I think there is a tremendous senseof consensus about this whole area,” said Tom Plaskett, chairman ofNovell and a director at RadioShack and Alcon Labs. “First, it’scomplicated and second, one size doesn’t fit all.”
The roundtable, held at the Union League Club inNew York, was sponsored by Eisner LLP, a New York-based accounting andauditing firm, and Thomson Financial, which provides services to seniormanagement and boards.
Risk management is high on the minds of boardmembers these days partly because of intensified regulatory andfinancial market scrutiny, but also because of self-inflicted woundssuch as those suffered at Enron and WorldCom and, most recently, atcompanies that backdated stock options. The legal climate also hasaggravated the ever-present risk of suits. Natural disasters likeHurricane Katrina and the threat of terrorism round out the picture ofan increasingly hazardous business world.
Directors these days are expected to grasp theessentials. “Probably not more than 10 years ago, the requirement forbeing a director was primarily knowing somebody in management or asignificant shareholder,” said Eisner’s Neil Goldenberg. “But today,you are required to really understand the regulatory environment andthe risks and rewards.”
Here are other key issues debated at theroundtable:
How much information is enough and how much is too much? Before ameeting, management typically presents large “board books” to eachdirector that are filled with huge amounts of information. Somedirectors said managements overwhelm them, either intentionally orsimply because they haven’t thought through the types of informationthat are really essential. “A lot of companies have taken the viewthat, ‘We’re going to give the directors everything,’” said DavidMeachin, a director of Lyondell Chemical, which has annual revenues of$20 billion. “But do we really need all this stuff? Shouldn’tmanagement be highlighting for us the things we should be looking at?”
Despite the flood of information— or perhapsbecause of it—many directors are still not getting what they need. “Inour discussions with a lot of boards, the lack of relevant or timely oruseful information still is a critical barrier to effective boards andalso carries a lot of significant risk,” said Greg Radner, ThomsonFinancial’s senior vice president.
One area where information has exploded is theflow of financial data to audit committees, said Eisner’s Goldenberg.Reports that used to be two pages long are now 20 to 30 pages long.”It’s become much more voluminous,” he said, “because you have not justU.S. accounting, but you have international accounting, you have theSecurities and Exchange Commission, and you have the Public CompanyAccounting Oversight Board. These are all moving targets and, quitefrankly, the situation is just going to get worse because they’rerevisiting a lot of concepts that have been out there for a long time.”Ultimately, directors at the roundtable agreed that they need to workwith management to achieve the right balance in the flow of informationthey receive.
How can a culture of trust be established? If the climate created bySarbanes-Oxley and new stock exchange rules results in mistrust betweenmanagement and a board, that obviously is hugely negative. Boards andmanagers can take many small steps to create a framework of meetingsand exchanges that create trust. One is having CFOs meet with auditcommittees or governance executives meet with governancecommittees—without the CEO being present. Creating strongerrelationships between a board and an entire top management team, notjust the CEO, is one way to build trust and an open flow ofinformation.
“There should be no surprises— in eitherdirection,” said Susan Ness, CEO of Greenstone Media and a board memberat Adelphia Communications. “Management should make sure that directorsare not surprised by something they learn about the company in thepress or after the fact; and directors should make sure that any issuesand concerns are shared with management so that they are not taken bysurprise.”
How can directors understand the broader competitive environment thattheir companies face? Blythe McGarvie, who sits on Pepsi BottlingGroup’s board as well as those of Accenture and St. Paul Travelers,argued that directors should not merely rely on reports frommanagement. “I read the analyst reports that give an overview of anindustry almost as frequently as I read about my own companies, becausethat’s where I learn a lot,” McGarvie said. “If you’re not doing that,you need to start doing it so you know what the risks are out there.”
How can directors be smarter about risks without discouragingmanagement from taking smart, money-making risks? Said Meachin ofLyondell Chemical: “My biggest concern about Corporate America at themoment is that we’re going to end up with the most pristine, wonderfulability to regulate and govern ourselves. But the Chinese are going tohave all the customers.”
There should be no mistaking the fact thatmanagement is in charge of running the company, said Jim Cederna, adirector at Mine Safety Appliances, based in Pittsburgh. “I know in ourboard’s case,” Cederna explained, “we look very closely at the annualsurvey that we do, which is also given to the management about how isthe board performing its oversight duties without stepping into themanagement’s role? That’s a very thin line to walk.”
However boards seek to manage risk, they can restassured that more people are going to be watching. Pat McGurn, seniorvice president at Institutional Shareholder Services, said ISS isinterested in adding risk management to its checklist of 65 governanceitems it watches. “We’ve been trying to work with a number of differentgroups— legal, auditing and otherwise— to come up with a framework foranalyzing how companies work to mitigate risk especially in theboardroom, with the idea of potentially adding it to the metrics thatwe use for examining governance,” McGurn said. If ISS does add a riskmanagement indicator, it will loom as a more important issue than ever.