EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints
Issue 33: 16 January 2013

TAPESTRY NETWORKS, I NC WWW.TAPESTRYNETWORKS.COM +1 781 290 2270

Strategy, risk appetite and the board

On 30 November 2012, members of the European Audit Committee Leadership Network (EACLN) met in Madrid for their 18th stand-alone meeting. In one session, members discussed the role of the board in strategy development, how strategy and risk oversight are intertwined and the emerging concept of risk appetite. 1 This document summarizes the key points that members raised in the discussion, along with background information and perspectives that members shared before the meeting. 2 For further information about the
network, see About this document, on page 10. For a list of participants, see Appendix 1, on page11.

Executive summary Developing and executing strategy is essential for a companys success and survival, and all boards engage in the strategy development process in some way. Three themes emerged from the discussion: Board engagement with strategy varies from company to company (Page 2) Though every board takes an interest in strategy, the manner of engagement varies. Some boards review strategies that are chiefly developed by management, while others are directly involved in strategy development. Whether the board has a two-tier structure may influence the level of engagement, but other factors, such as the attitude of the CEO, play an important role as well. Members highlighted two elements of effective oversight: conducting one- or two-day strategy sessions devoted to strategic issues, and using outsiders such as consultants, economists and shareholders to inform the discussion. Company crises and strategic risks are key topics of discussion (Page 3) Company crises drive increased board engagement on strategy. Members described their involvement when their companies were experiencing major lawsuits, allegations of significant accounting fraud, imminent takeover and general management failure. Some crises may prompt the establishment of a strategy committee, though members were divided on the merits of such a committee. Other topics of interest for the board in the area of strategy include company competitors, disruptive technologies, political risks and other long-term strategic considerations. As boards grapple with risk oversight, they are exploring the concept of risk appetite (Page 5) The intimate link between strategy and risk has sparked interest in the concept of risk appetite, which expresses the level of risk a company is willing to accept as it pursues its objectives. The concept is being elaborated and applied mainly in the financial services sector, where risk appetite statements are becoming more common. Despite the inherent difficulties of applying the concept to non-financial risks, some companies in other sectors are beginning to explore its usefulness in helping them decide whether to reduce, avoid or accept the risks identified by enterprise risk management (ERM) systems. EACLN members noted that their boards are in the very early stages of using the concept, though it is often applied implicitly.
1

ViewPoints, 16 January 2013. 2 ViewPoints reflects the networks use of a modified version of the Chatham House Rule whereby names of members and guests and their company

In another session members discussed cybersecurity. See European Audit Committee Leadership Network, Cybersecurity and the board,

affiliations are a matter of public record, but comments made before and during meetings are not attributed to individuals or corporations. Member and guest quotes appear in italics.

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

For a list of discussion questions on strategy and risk for audit committees, see Appendix 2, on page 12.

Board engagement with strategy varies from company to company Today more than ever, an effective strategy is essential not only for a companys success and performance, but ultimately even for its survival. Given the accelerating pace of change in global markets, a strategic stroke of brilliance can lead to astounding success, while a strategic misstep can have severe consequences. Thus, there is no shortage of experts offering their views on the importance of strategy and how to develop a successful one. For boards, influencing and approving strategy is a key responsibility. Reflecting on the pace of change and the rising uncertainty in global markets, an EACLN member said, I believe boards have to push

management on strategy Boards have a very important responsibility to ensure the proper transformation of companies in light of changes taking place in the marketplace.
Levels and modes of engagement The manner in which boards engage with strategy varies. Based on global surveys of boards and the discussion in Madrid, as well as discussions among members of Tapestrys other networks, 3 two basic approaches can be identified: Management develops the strategy, and the board reviews it. Thirty-seven percent of European respondents to a 2011 McKinsey Quarterly survey say their boards simply review and approve managements proposed strategies. 4 One EACLN member described how strategy development is exclusively managements prerogative: Strategy is developed by management. It is submitted to the board for discussion. Another member noted that intervention by the board is difficult and rare at his company: Strategy is the responsibility of management As a supervisory board, if management is

going in totally the wrong direction, then we can interject. But I havent seen that happen in 20 years.
The board is directly involved in developing the strategy. The McKinsey survey found that 45% of boards in Europe develop strategy with management, 5 and some EACLN members also described greater board involvement. One member noted, The board questions and tests boundaries in a strategy development session. It is appropriate to question and participate and moderate the plan. Members of another audit committee network said that interaction between management and the board on the topic of strategy is happening earlier in the process than before, particularly when transformative strategies are under development. 6 Members considered the question of whether the two-tier board structure (a supervisory, non-executive board and a management board) common in much of mainland Europe influences how the board engages in strategy development. One member said, A dual-structure board is a natural impediment for the

supervisory board to get involved with strategy. Our company had a very large division that we believed we

See, for example, Midwest Audit Committee Network, The Boards Role in Strategy Oversight, VantagePoint, 5 November 2012; West Audit Committee Network, The Boards Role in Strategy Oversight, VantagePoint, 22 October 2012; and Lead Director Network, Engaging with Strategy after the Financial Crisis, ViewPoints, 1 August 2011. 4 Chinta Bhagat, Martin Hirt, and Conor Kehoe, Governance since the Economic Crisis: McKinsey Global Survey Results, McKinsey Quarterly, July 2011, page 3. 5 Ibid. 6 West Audit Committee Network, The Boards Role in Strategy Oversight, page 9.
3

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

should divest for the long term so that we could invest in another sector. The supervisory board oversaw the divestment process who to sell to, and at what price. But this was very contentious.
However, another member believed other factors were far more important: I see no difference between

unitary or dual boards on the question of strategy. The difference is the CEOs willingness for the board to be involved and whether or not the CEO sees added value from the board. Ive served on unitary boards where the CEO did not want to talk about strategy with the board.
Elements of effective board oversight EACLN members and members of other networks have identified a number of measures for ensuring effective oversight of strategy. 7 At the meeting in Madrid, EACLN members focused on two approaches in particular: Strategy days. Members described one- to two-day board meetings devoted to strategy, which may be held off-site. Members underscored that these sessions should be real discussions between the board and management: It should not be management telling you what they want to do. It should be a real

dialogue about where the company is going. We insist on a minimum of charts 25% of the time is management giving the story, and the rest should be discussion between management and the board.
Outside experts. Members mentioned bringing in various types of outside experts, often as part of the strategy day, to help them understand key issues. One member said, We bring economists to strategy

sessions, particularly when thinking about geographic expansion what are the fundamental growth trends? Shareholder input is also welcome, and we work with independent share advisers and brokers. We survey the top 10 to 20 shareholders on strategy. Another member said, From time to time, we invite investment analysts to provide an overview of the sector, and weve had academics and consultants.
One member mentioned wanting to hear the views of consultants hired by the company: Companies

use consultants, but management is reluctant to share everything that the consultant prepared. How does the board get access to the consultants conclusions, even if management doesnt agree?
Members touched on the usefulness of executive sessions with the CEO, during which the agenda for the strategy day may be drawn up, and they also described frequent reviews of the strategy: The strategy is reviewed and revised every six months to respond to rapid changes in our industry. Members in other networks noted that board composition can be a factor in effective oversight. The right mix of perspectives from both within and outside the companys industry is helpful, as is knowledge in particular areas such as technology and international markets. 8 Company crises and strategic risks are key topics of discussion While strategy discussions can cover a range of issues, certain matters of strategic import are especially likely to attract attention from the board. Regardless of how involved a board might be in strategy under ordinary circumstances, the emergence of a crisis at the company galvanizes the board into greater involvement.
7

For further elaboration on other networks discussions, see Midwest Audit Committee Network, The Boards Role in Strategy Oversight, pp 3-4 and West Audit Committee Network, The Boards Role in Strategy Oversight, pp 811. 8 Midwest Audit Committee Network, The Boards Role in Strategy Oversight, page 7; Lead Director Network, Engaging with Strategy after the Financial Crisis, page 6. Strategy, risk appetite and the board 3

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints
Crisis and response

Members gave several examples of the kinds of crises that can trigger board engagement and lead to major changes at the company and on the board: Major lawsuits. I joined the board of a company that was on the edge of bankruptcy because of a

lawsuit. We had to downsize to generate cash. We needed to concentrate resources, so we went through a culling process [to divest some businesses].
Accounting fraud. At my company, we suffered a crisis as a result of accounting fraud. The

supervisory board took over the company.

Imminent takeover. Another company had acquired 29% of our company, just short of the 30% that

would trigger a takeover. A group of independent directors who represented 50% of the shareholders, led by the lead director, met with this company to understand what they wanted.
General management failure. An unsuccessful strategy led to the removal of the CEO, CFO and

board. I joined the new board. We had to start over. We created a technology committee because we wanted insight on the board about where the company was going and how it was going to get there a reality check on the strategy.
Establishing a strategy committee to focus on a crisis Some EACLN members noted that a serious crisis may prompt the board to establish a special strategy committee, which can devote expanded time and effort to strategic issues. EACLN members were divided, however, on the merits of a strategy committee. One member was skeptical: I have a problem with

strategy committees. Strategy has to involve the whole board, like on an acquisition. It is very difficult when only a small part of the board is very involved, while the rest are just listening. Another member disagreed: In defense of strategy committees, they are useful when you have to make an intervention, do a deep dive, spend a lot of time.
Summing up, a member reflected, If youre a member [of the strategy committee], you like it, but if youre

not, then you dont. The strategy committee can review all of the plans of all the business units. The role is to be sure that something credible is presented to the board. The first presentation to the strategy committee by management requires lots of changes and choices. But I understand that theres a risk that some board members not on the strategy committee may not feel involved enough.
Strategic issues that draw the boards attention Members mentioned a number of issues that they believe boards should address during strategy days or other sessions on strategy: Strategic assumptions. One member explained, We discuss the environment and test assumptions.

In todays environment, the strategy cant be static. In every board meeting, the first item on the agenda is a discussion of changes in the environment.
Competitors. We cover what the competition is doing. You cant understand strategy without

transparency regarding the strategy of competitors. We do a deep dive into the competition.

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

Disruptive technologies. New technologies can bring sudden, dramatic changes in the marketplace, forcing strategic transformations. Acquisitions. An acquisition, actual or potential, entails a host of important considerations. A member said, During an acquisition, we ask if we want to retain the management. Is there risk that they will

leave? Or is there a risk of not integrating the two companies tightly enough?
Political risk. A member provided an example: In my sector, we have to deal with many governments

that are not democratic, so we define the risks associated with investments in these countries, though the only way to deal with these risks is to diversify.
The long term. Strategically, growth plans have to be clearer. We have very capable management,

who are well liked by investors. The share price has rocketed. But Im uncomfortable with our strategy for long-term growth.
The risk element evident in many of these areas of concern reflects the fact that board oversight of strategy tends to shift its focus as economic and business conditions change: as a recent piece in Reporting magazine notes, Ever since the financial crisis took hold in 2008, company boards across the world have had to pay acute attention to both immediate and strategic risks. 9 Boards have become more concerned about the excessive risks their companies might be taking given higher levels of economic and market uncertainty, and this concern has fueled an interest in risk management. A member noted, The world has become more

risky the risks you could take with peace of mind 10 years ago, you need to think twice about today because of the evolution of technology, the instability of markets and other factors.
As boards grapple with risk oversight, they are exploring the concept of risk appetite The renewed focus on risk management is helping companies mitigate risk, but as board directors contemplate the links between strategy and risk, they have raised another concern: is the focus on risk management restraining companies too much? Given the possibility of a prolonged era of low growth, companies may need to avoid being too risk averse, even as uncertainty also forces them to scale back on certain types of risks. It may be problematic to manage risk without a dialogue between management and the board about how much risk to take, which risks the company should take and which risks it should avoid. What is risk appetite? At the EACLN meeting in November 2010, a member brought up the concept of risk appetite as an important element linking risk management and strategy, and since the financial crisis, this concept has emerged as a topic of debate for boards. 10 A great deal of discussion is taking place in the financial services sector, and the issue was recently addressed by Tapestrys Bank Governance Leadership Network (BGLN). 11

Ernst & Young, Risk and the Board, Reporting, no. 4 (November 2012), page 33. European Audit Committee Leadership Network, Leading Risk Management Practices, ViewPoints, 3 December 2010, pp 910. 11 See Bank Governance Leadership Network, Seeking Progress on Risk Appetite Frameworks: Bridging Divides on Understanding, Implementation, and Impact, ViewPoints, 19 October 2012.
9 10

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

However, the topic is sparking interest in other sectors as well, producing more general analyses of how the concept should be applied. 12 As EACLN members noted, the basic idea of risk appetite is intuitive and simple, and this is reflected in the similarity of the definitions proposed by experts and commentators. A representative example comes from the Committee of Sponsoring Organizations of the Treadway Commission (COSO): Risk appetite is the amount of risk, on a broad level, an organization is willing to accept in pursuit of value. 13 EACLN members generally described their high-level understanding of risk appetite in similar terms, and they highlighted its integral connection with strategy. The concept of risk appetite underscores the point that taking risks is necessary in business: risks are not something a company just tries to mitigate to the greatest extent possible. A member noted, I have a deep conviction that no risk means no reward. A company has to take risk not just to grow, but to survive. Another member remarked that risk aversion is actually dangerous in dynamic sectors such as information technology: In the technology space, larger

companies tend to become risk averse. We need paranoia about a start-up company blindsiding us.
How is risk appetite defined and implemented? Whats new in the current debate about risk appetite is the formalization and systematic implementation of the concept. The high-level definition of risk appetite anchors a more detailed elaboration, often called a risk appetite framework, which includes specific elements that are used to implement risk appetite across the organization. For example, both COSO and Ernst & Young discuss the concept of risk tolerance as one of those elements. As the Ernst & Young report notes, More operational than risk appetite, risk tolerance expresses the specific maximum risk that an organization is willing to take regarding each relevant risk (sub-) category, often in quantitative terms. 14 The risk tolerance for staff turnover, for example, could be that it must not exceed 15% per year. COSO and other organizations emphasize the value of a risk appetite statement that articulates the companys risk appetite in such a way that personnel understand how to incorporate it in decision making. 15 When asked about best practices for communicating risk appetite, a subject matter expert at Ernst & Young suggested focusing on certain key challenges: developing a common language for what risk appetite means, clearly articulating the reason that risk appetite is important and embedding risk appetite in policies and procedures, which are a form of communication. The subject matter expert at Ernst & Young, the BGLN participants and other experts all emphasize a critical overarching factor in implementing risk appetite effectively: a supportive risk culture. In order for a companys risk appetite to have real impact on how the company actually approaches risk, basic values, norms and beliefs have to support rather than undermine the elements articulated in the risk appetite framework.

See, for example, Larry Rittenberg and Frank Martens, Understanding and Communicating Risk Appetite (Committee of Sponsoring Organizations of the Treadway Commission, 2012); Ernst & Young, Risk Appetite: The Strategic Balancing Act (London: Ernst & Young Global Limited, 2010); and Richard Anderson, Risk Appetite and Tolerance: Guidance Paper (London: Institute of Risk Management, 2011). 13 Larry Rittenberg and Frank Martens, Understanding and Communicating Risk Appetite, page 1. 14 Ernst & Young, Risk Appetite: The Strategic Balancing Act, page 3. 15 Larry Rittenberg and Frank Martens, Understanding and Communicating Risk Appetite, page 6.
12

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

Why is risk appetite useful? An EACLN member commented on the concept of risk appetite: It has to come down to this: how is it

helpful to the company? How is it guiding the decisions that the company makes? If its useful, it is impacting day-to-day operations. By developing a risk appetite framework, experts argue, companies can
approach the risks they take in a more systematic and rational manner that is fully integrated across the enterprise. A risk appetite framework thus belongs at the core of ERM, guiding management and personnel throughout the organization regarding what risks are accepted, what risks are mitigated and what risks are best avoided.
Examples of risk appetite statements
Risk appetite statements are likely to include both high-level statements of the overall risk appetite and more detailed assertions, quantitative and qualitative, of risk appetite objectives and risk tolerances. COSO provides the following example of a high-level statement from a healthcare organization: The Organization operates within a low overall risk range. The Organizations lowest risk appetite relates to safety and compliance objectives, including employee health and safety, with a marginally higher risk appetite towards its strategic, reporting, and operations objectives. This means that reducing to reasonably practicable levels the risks originating from various medical systems, products, equipment, and our work environment, and meeting our legal obligations will take priority over other business objectives. 16 COSO and the subject matter expert at Ernst & Young provided the following examples of morespecific risk appetite assertions that could appear in a risk appetite statement: Earnings will be within 10% of the budget for four years out of five. All business written will make 10% per annum in compound return on a risk-adjusted basis. We will have sufficient liquid assets for three months of expected claims. We will maintain a credit rating of AA or better. The risk tolerance is near zero for procuring products that do not meet the organizations quality and sourcing requirements.

The Ernst & Young report stresses that good risk management does not imply avoiding all risks at all cost. It does imply making informed and coherent choices regarding the risks the company wants to take in pursuit of its objectives and regarding the measures to manage and mitigate those risks. 17 In an ERM system that lacks a well-articulated risk appetite framework, a business unit that reports no risks requires no action. In an ERM system that includes a risk appetite framework, such a unit presents opportunities for the company to be more aggressive. An ERM system illuminates the net risk a company faces, but the board
16 17

Ibid., page 8. Ernst & Young, Risk Appetite: The Strategic Balancing Act, page 1. 7

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

needs an understanding of the companys risk appetite in order to weigh in on whether this risk is too high or too low. By incorporating risk appetite, the ERM system becomes a tool of strategy. How is risk appetite applied outside the financial services sector? Despite the general appeal of the concept of risk appetite, EACLN members had concerns about how practical it would be to apply it outside of the financial services sector. Financial services companies have more experience working with risk as a source of reward as well as threat. One member explained why risk appetite may not be as applicable outside of financial services: In financial services, risk appetite is well

defined and well understood. In non-financial services, risk management is done well, but there isnt much focus on risk appetite. Another member added, In financial services companies, risk is the product. You price risk. In non-financial companies, you mitigate risk. It may require effort for non-financial companies
to begin thinking of risk as something that can be desirable.
Risk appetite and shareholders
Another potential benefit of a risk appetite framework is that it can help a company communicate more explicitly to shareholders and potential shareholders the kind of company the leadership seeks to create. EACLN members generally did not highlight this benefit, but a few members did suggest that communicating to shareholders about risk appetite is important. One member said, We have to communicate. For shareholders, its very important to make a judgment about the sustainability of development in terms of risk. They need information on how the company is managing the risks associated with development. Another member mentioned the communication of certain types of risk appetite: In areas like tax, its important that companies disclose where on the spectrum of aggressiveness they are. There are a half-dozen areas like that. Financial services institutions are taking the lead in discussing risk appetite more explicitly in their annual reports. In its 2011 annual report, for example, Zurich Insurance Group (formerly Zurich Financial Services Group) describes its risk governance document, including the kinds of information it contains, how it is implemented and updated, and the general risk-taking philosophy it reflects. 18

Members also pointed to the fact that quantifying and comparing risk appetite is inherently more difficult for non-financial companies. A member said, It is difficult to define because it is so situational. How much risk appetite should there be in tax planning? Some risks you can quantify better than others. Members mentioned a number of risks that are difficult to quantify: When we talk about risk appetite, we talk about

political implications, tax implications, whether we are moving fast enough and onshore versus offshore cash. One member who serves on the boards of both financial and non-financial services firms said of nonfinancial services companies, We have the bare bones of a risk appetite statement.
How does the board oversee risk appetite? Risk is usually an important concern of boards. On many boards, the audit committee has responsibility for overseeing risk management or at least making sure there is oversight. As one member put it, We are the

guardian of the overall process for risk oversight: we ensure that every major risk is discussed by every major committee. Are boards and audit committees tackling risk appetite as part of this risk oversight process?
18

Zurich Financial Services Group, Annual Report 2011: Tomorrow Is Insured (Zurich: Zurich Financial Services Group, 2011), page 104. 8

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

In its 2010 report on risk appetite, Ernst & Young noted, Defining risk appetite is very much a task for the board and top management, as it is intimately linked to defining the overall strategy of a company. 19 Yet the report also noted that several surveys of board members revealed a lack of understanding of their companies risk appetite and risk tolerances. 20 A few EACLN members suggested that this is still sometimes the case. When asked about how risk appetite is addressed, a member said, I hope you realize that for some companies, this question is totally premature.

At one of my companies, weve never had that question at the board level. When I say we should talk about risk more, the chair says we are in control of it he doesnt want to discuss it in the board.
Most EACLN members, however, reported that their boards weigh in on strategic decisions in a way that requires them to apply an understanding of the companys risk appetite. A member said, Regarding

groupwide enterprise risk, we have a heat map, and management points out that this risk will happen with this probability and this much will be lost. The board says whether its comfortable. Another member said, We have joint strategy and audit committee meetings to discuss the financial model and capital allocation, and the consequences for the balance sheet and share price. In some cases, risk appetite may be addressed
more implicitly, with the board reviewing the companys major strategic decisions without necessarily using the vocabulary of risk appetite. One member emphasized the importance of ongoing engagement: Risk appetite is something that should

come back to the board on a regular basis. We should be sure the risk appetite of management is aligned with the board. If the company has an eight-month strike, you need to discuss risk appetite afterwards. Circumstances change. Other members also noted that risk appetite can wax and wane: Our risk appetite after [several expensive acquisitions] was much lower than before we made the acquisitions. Risk appetite depends on the situation.
Members reflected on the types of risks board members analyze and weigh against their risk appetite. Not all risks must come to the board, but some always do: There are clearly set limits regarding where people have

discretion and where its mandatory that it goes to the board. Mandatory items include any acquisitions, spin-offs, large investment programs. Other members mentioned decisions to enter new countries.
As several EACLN members pointed out, however, there may be risks for which there is no appetite, and the question of how much risk to take does not apply. Members highlighted risks involving such issues as reputation and corruption as being the kind of risks for which boards have zero tolerance. Conclusion Despite boards universal interest in company strategy, they tackle the topic in different ways. Some boards mainly react to managements initiatives, while others participate directly in strategy development. Many EACLN members report using strategy sessions to focus on strategic issues, and they often bring in outside experts for added insight. Members identified several strategic risks, which led to a discussion of risk appetite, an emerging tool for thinking about risk in terms of opportunity as well as threat. Though the concept is more readily applied in the financial services sector, companies in other sectors are beginning to explore the value of incorporating risk appetite more systematically in their discussions about strategy and risk.
19 20

Ernst & Young, Risk Appetite: The Strategic Balancing Act, page 2. Ibid., page 5. 9

Strategy, risk appetite and the board

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints
About this document

The European Audit Committee Leadership Network is a group of audit committee chairs drawn from leading European companies committed to improving the performance of audit committees and enhancing trust in financial markets. The network is organized and led by Tapestry Networks with the support of Ernst & Young as part of its continuing commitment to board effectiveness and good governance. ViewPoints is produced by Tapestry Networks to stimulate timely, substantive board discussions about the choices confronting audit committee members, management and their advisers as they endeavor to fulfill their respective responsibilities to the investing public. The ultimate value of ViewPoints lies in its power to help all constituencies develop their own informed points of view on these important issues. Those who receive ViewPoints are encouraged to share it with others in their own networks. The more board members, management and advisers who become systematically engaged in this dialogue, the more value will be created for all.
The perspectives presented in this document are the sole responsibility of Tapestry Networks and do not necessarily reflect the views of network members or participants, their affiliated organizations, or Ernst & Young. Please consult your counselors for specific advice. Ernst & Young refers to all members of the global Ernst & Young organization, each of which is a separate legal entity. This material is prepared and copyrighted by Tapestry Networks with all rights reserved. It may be reproduced and redistributed, but only in its entirety, including all copyright and trademark legends. Tapestry Networks and the associated logos are trademarks of Tapestry Networks, Inc. and Ernst & Young and the associated logos are trademarks of EYGN Ltd.

Strategy, risk appetite and the board

10

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

Appendix 1: Participants The members of the network participating in the meeting sit on the boards of nearly 40 large-, mid- and small-capitalization public companies. The following network members participated in all or part of the meeting: Mr Aldo Cardoso, Audit Committee Chair, GDF SUEZ Mr ngel Durndez, Audit Committee Chair, Repsol Mr Lou Hughes, Audit Committee Chair, ABB Mr Daniel Lebgue, Audit Committee Chair, Technip Mr Pierre Rodocanachi, Audit Committee Member, Vivendi Mr Nick Rose, Audit Committee Chair, BAE Systems and BT Ms Guylaine Saucier, Audit Committee Chair, Areva Mr Tom de Swaan, Audit Committee Chair, GlaxoSmithKline* and Royal Ahold Mr Jack Tai, Audit Committee Chair, Royal Philips Electronics Dr Bernd Voss, Audit Committee Chair, Continental AG Mr Steve West, Audit Committee Chair, Cisco Systems** Mr Lars Westerberg, Audit Committee Chair, Volvo

The following Ernst & Young partners participated in the session: Mr Christian Mouillon, Global Vice Chair, Assurance Mr Mark Otty, Area Managing Partner, EMEIA

* Mr de Swaan stepped down as audit chair of GlaxoSmithKline on 31 December 2012, but remains a member of the audit committee. ** Member of the Audit Committee Leadership Network of North America.

Strategy, risk appetite and the board

11

EUROPEAN AUDIT COMMITTEE LEADERSHIP NETWORK

ViewPoints

Appendix 2: Discussion questions for audit committees ? How does your board engage with management on strategy? What is the right level of engagement? ? What opportunities or problems does the dual-board structure present? The unitary board? ? What best practices can all boards use when overseeing strategy? What kinds of meetings and discussions should the board hold? What third parties should be involved? ? What aspects of strategy development and implementation does the board focus on? What are some red flags that boards should watch for? ? How would you define risk appetite for your company? How would you relate it to your companys strategy? How does management know how much or how little risk the board wants it to take? ? Do your boards discuss risk appetite explicitly? Do they discuss it more implicitly? ? Does your organization elaborate risk appetite into a framework for implementation across the enterprise? Does your company communicate its risk appetite to shareholders?

Strategy, risk appetite and the board

12