Across the pond

with David Anderson

David Anderson is President of the Anderson Governance Group

Unique position
This serves to align the perspectives of the board and the management team on core risk judgements. A board governing risk thus works with management to align their judgements on an acceptable appetite for risk and, given the corporate strategy, adopt a set of trade-offs that are most likely to yield an appropriate return. So where do boards typically go wrong? While directors know that governing and managing risk imposes a cost, they may behave as if the costs are marginal. As such they put the onus on management to deliver relatively high returns, yet only accept relatively low margins of risk. This encourages management to restrict communication to the board, under-reporting risks. In an effort to understand risk and reduce their liability, directors blur the governance/ management line in board meetings, spending too much time on the details of risk management. In an area as nebulous and complex as risk, some directors focus valuable time on areas of personal interest or concern. Boards are more likely to provide their unique governance value and help management reach a risk-optimised outcome when directors: focus on risk governance; consider strategy and risk simultaneously; set the risk appetite for the organisation from an owner perspective; encourage a culture of innovation, which praises creative failure within certain financial bounds; reward strategic and executional excellence and associated risk awareness. The mathematics and procedures of risk management are well-understood. The culture and behaviours that support good risk governance are not so well-understood, nor so readily articulated. Improving the quality of human judgement and decision-making within boards is our best bet for governing risk intelligently and profitably.

Boards need to get much better at risk governance.

ntense pressure for tighter controls and a sharper focus on risk from investors and regulators continues to build on both sides of the Atlantic. Consequently, boards are spending more time on risk management. Is this response producing more effective boards? Should boards be managing or governing risk? The UK Corporate Governance Code emphasises the boards responsibility for determining the nature and extent of the significant risks it is willing to take in achieving its strategic objectives. Wisely, provisions for proper risk oversight are shared across the principles of leadership, accountability and remuneration, acknowledging the multi-faceted nature of risk management. Boards have been inclined to interpret existing codes and guidance on risk management to mean that they themselves ought to engage in the finer details of risk management. Certainly, correcting the wildly lax risk management that characterised much of the last decade and preventing massive loss are necessary goals. To aid boards in achieving those goals, some nuance may help: it is management who needs to improve risk

management; boards need to get much better at risk governance. This distinction may be harder to draw when half the board is made up of executive directors, but it is that factor which makes the distinction vital. The unique value of a board is realised when it serves a governance function distinct from managements function. To govern means to oversee managements efforts. By delving into risk management without a clear understanding of this distinction, boards are prone to diving deeply into managements territory and forfeiting their unique ability to add value. Boards that can carve out a unique role for themselves tend to govern risk more effectively. They are in a better position to help management optimise the costs and benefits of risk (including the costs of mitigation efforts), which are associated with corporate strategy. These boards also oversee risk management efforts, engaging in robust dialogue on testing risk assumptions and scenarios and the correlation between the two (a major blind spot exacerbating the recent financial crisis), and the variance assigned to risk outcomes.

About the author

David Anderson MBA PhD ICD.D is the President of the Anderson Governance Group based in Toronto. He can be reached at david.anderson@taggra.com and +1 (416) 815 1212.
w w w . c h a r t e r e d s e c r e t a r y. n e t

19