Calculated Risk
Calculated Risk
Foreword
The events of the last two years put risk-related issues squarely on corporate boards front burner, and the flame remains on high. Board members are proactively rethinking their approach to risk, asking: How does risk inform our corporate strategy? Have we lost sight of the fact that risk is the fuel for reward? Has our risk appetite become too conservative? Has the pendulum swung too far? Mastering the complexities of risk as companies get back to growth is a crucial issue for boards in this post-crisis period. In this timely and astute report, the Korn/Ferry Institute sets out some of the principal opportunities for developing a board that is deliberate and discerning on risk issues. Its recommendations, including debating the boundaries of oversight, guarding against group-think, getting a real understanding of risk culture, and managing board renewal, should resonate with boards and, indeed, executive leadership teams in the United States, United Kingdom, and continental Europe. Korn/Ferry, in my view, has made a valuable addition to the debate.
Executive summary
As part of its ongoing research, the Korn/Ferry Institute undertook this study to understand how risk oversight in the boardroom is evolving in the post-crisis economy. We interviewed twenty-six chairmen, chief executives, and board directors from companies in the United States, Europe, and the United Kingdom to gauge their attitude and approach to risk. Our findings suggest that because of the increasing complexity of risk, the threat and reality of new regulation, heightened public interest, and the Internet-enabled speed at which issues can turn into crises, boards are fundamentally reassessing this aspect of their work. They are demanding additional resources, improved data, and sharpening boundaries around oversight. They are looking more critically at themselves, asking how they can best support the business, in part, by challenging it on risk issues. They are seeking to exploit their knowledge and understanding of risk to enhance strategic debate and decision-making and gain commercial advantage. We identified seven key tenets: A boards risk purview needs to suit the companys scale, strategy, and regulatory situation. Precise boundaries between oversight and decision-making should be explicitly agreed upon and articulated. Final accountability for risk oversight rests with the whole board, even for those with risk committees. Some will require committees because of the complexity of the businesss risk profile; it is up to the board to determine and create the appropriate structure. Risk reports need reassessment. Board members require more granular information, including less refined data. They also want more leading indicators, as well as opportunities for far-ranging discussions with relevant executives. Organisational risk culture is a pressing issue. Leading boards are considering ways to measure, and influence, how thoroughly their risk appetite is saturating the company. Chairmen lead the charge against group-think on risk issues. Risk oversight is dangerously hampered by stifled opinions, so an open, trusting environment is mandatory. Board renewal is an asset to risk oversight. Bringing on new directors weeds out habitual assumptions and renews imagination on risk issues. New directors should be recruited with risk in mind. Boards, on balance, should have industry experience, strong risk instincts, strategic minds, and diversity in all its manifestations.
Acknowledgements
The Korn/Ferry Institute would like to thank all those who participated in the preparation of this report. Some preferred to remain anonymous but many are recognised below. Marcus Agius
Group Chairman Barclays plc.
Conrad Albert
General Counsel ProSiebenSat.1
Philip K. Asherman
President and Chief Executive Ofcer CB&I
Daniel Bernard
Chairman Kingsher
Peter Brabeck-Letmathe
Chairman Nestl S.A.
Gary Burnison
Chief Executive Ofcer Korn/Ferry International
Philippe Camus
Co-Managing Partner Lagardre SCA
David Challen
Chairman of the Audit Committee Smiths Group and Anglo-American
Trevor Fetter
President and Chief Executive Ofcer Tenet Healthcare Corporation
Inge K. Hansen
Independent Advisor and Board Member Hydro
Rick Haythornthwaite
Chairman Network Rail
Steve Holliday
Chief Executive Ofcer National Grid
Joseph Jimenez
Chief Executive Ofcer Novartis
Introduction
Risk shouldnt be a dirty word. Risking capital or assets in search of financial reward is the denition of business. As one chairman succinctly states, If you are risk averse, you dont go anywhere. The profit of tomorrow comes from the risk you take today. But in the wake of the global financial crisisattributable in part to excessive, ungoverned, and misunderstood risk-taking in the financial sectorsome outside the business sphere have come to view risk as a dangerous pathogen. Politicians, regulators, and pundits are among those who want to vaccinate businesses against risk. As the fiduciary representatives of shareholders, boards have always kept risk oversight on the agenda. But today, risk is constantly and persistently on the minds and in the conversations of the board, says Peter Brabeck-Letmathe, chairman of Swiss food company Nestl. Why? Certainly, the 2007-08 financial crisis revealed the difficulty many institutions had in identifying, understanding, and calibrating business risk. Globalisation presents ever-changing risk facets. The ability of news to go viral on the Internet has pushed reputational risk onto a new level. As the economies in Western nations begin to stir, there looms the tremendous risk of missed opportunity as well. Risk oversight, therefore, is how boards put the appropriate risk appetite in place and ensure it is informing decision-making on a multitude of issues. Once policies, systems, controls, and governance are in place, the challenge becomes to understand the nature of an organisations risk culture and its implications. Policy makers and regulators are sure to pursue their own agenda of more rules and disclosures in the years to come. But those involved in governance know that wont solve much, and may exacerbate the existing problems; witness how little regulation did to blunt the onslaught of the financial crisis, or, indeed, the corporate woes of BP and Toyota. As one interviewee says, There has been a fundamental belief, which was mistaken, that with enough disclosure you could eliminate all risk. It is enlightened companies that are bringing the needed improvements to risk management, including at the board level. Already, directors say, they are debating the range of their oversight and whether a risk committee is advantageous. They are re-assessing their needs in terms of data and company culture information. Chairmen are focusing on fostering candid risk debates, viewing board renewal as a powerful tool against group-think. Risk is also informing whom companies recruit onto their boards, and the balance of directors they seek. All
Acknowledgements (continued)
Stefan Krause
Member of the Management Board and Group Executive Committee Deutsche Bank AG
ivind Lund
Chairman of the Board of Directors Yara International ASA
Steve Marshall
Chairman Balfour Beatty plc.
Michael B. McCallister
Chairman of the Board Chief Executive Ofcer Humana Inc.
Harald Norvik
Chairman Telenor ASA
Eivind K. Reiten
Chairman of the Board Norske Skog
Xavier de Sarrau
Chairman of the Board and Chairman of the Audit Committee, Lagardre Group Board Member and Chairman of the Audit Committee, JC Decaux Board Member, Bernardaud
David Sidwell
Member of Board of Directors and Chair of Risk Committee UBS AG Member of Board Federal National Mortgage Association
John Stewart
Chairman Legal & General
John P. Surma
Chairman and Chief Executive Ofcer United States Steel Corporation
Ian Tyler
Chief Executive Ofcer Balfour Beatty plc
Michael H. Thaman
Chairman and Chief Executive Ofcer Owens Corning
these steps towards enhanced oversight add value to the business in two clear ways: by identifying downside risks to be mitigated and by prompting the organisation to leverage upside-opportunity risk. Risk is both necessary and goodup to a point. The continual challenge is to identify the tipping point between opportunity and peril, and set the risk appetite dial accordingly. That job has never been more critical for boards of directors.
In my view, the board has got to be able to access anybody in the company and have any information they want if they really are to monitor and oversee the companys risk.
Philip K. Asherman
President and Chief Executive Ofcer, CB&I
The dangers of an intrusive board are twofold. Firstly, it seeds confusion in the business as to who really makes the decisions. Secondly, if the board becomes a de facto decision-maker, it can no longer full its primary purpose: to provide an objective oversight.
David Sidwell
Member of Board of Directors and Chair of the Risk Committee, UBS AG Member of the Board of Directors, Federal National Mortgage Association
* Throughout this report, Sarraus comments reect his personal thoughts, not those of Lagardre, JC Decaux or Bernardaud.
confusion and disruption. As is pointed out by David Sidwell, chairman of the risk committee at Switzerland-based financial services firm UBS, I dont think it is either desirable, or credible, for boards to try to replicate what a management team can do. Finally, as de Sarrau warns, the board could find itself seen by courts as shadow executive directors, with all the personal and professional liabilities that entails.
Implications
Boards should continue to lobby governments and regulatory institutions for concrete, legal definitions of risk oversight. In the absence of such a definition, boards need to engage their executive leadership (and legal) teams in defining where the boundaries exist in their organisation: just how engaged or intrusive can the board be? Just how much information can it expect or demand from management? Is it permissible for board directors to arrive at the company unannounced and carry out deep-dives and spot-checks? Getting this right from the start, in terms of spirit as well as policy and process, will help to avoid executive push-back, uncertainty, and confusion. Boards also should consider whether their enhanced risk oversight role remains consistent and compatible with their oversight of, say, strategy. If they are acting as a challenge and support to the executive on risk, are they a similar source of counsel on strategy? If not, why not?
We had the debate on a separate risk committee and said no. Risk must be the responsibility of the whole board, prepared by the audit committee. There is a danger in multiplying committees and losing focus.
Daniel Bernard
Chairman, Kingsher
A number of other interviewees (including David Challen, chairman of the audit committee of London-based mining company Anglo American; Phillipe Camus, co-managing partner of Lagardre, and Trevor Fetter, president and CEO of American healthcare company Tenet Health) prefer, instead, to retain responsibility at the full-board level. For this group, risk is too important to be devolved. I dont know how we could delegate that responsibility, says Michael H. Thaman, chairman and CEO of American construction materials company Owens Corning, because I know we cant delegate that accountability. ivind Lund, chairman of Norwegian chemical company Yara, concurs, saying, Risk is too important to be the responsibility of a board committee. There is concern about creating confusion or inefficiency, particularly if there is also an audit and/or finance committee. By vesting responsibility in a specific committee, there is a rump of board directors who may disengage from this critical aspect of governance. You have to be very careful that the board doesnt think someone else is thinking about risk, warns one chairman. The board, as a whole, should always be alert and conscious about the companys risk profile and appetite. So while acknowledging that some companies are better served by a risk committee, the whole board must be engaged.
Implications
Boards should always begin by asking how they define risk. They should also consider how they can exercise their oversight of financial and non-financial risk in the most efficient and productive manner. These debates and discussions may well then inform (or prompt) what committee or sub-committee structure best serves these objectives. Whatever the chosen risk definitions and structures, there are clear advantages to weaving risk formally into the terms of reference of all board committees. It enables risk to be identified and analysed from varied perspectives. Importantly, it keeps risk on the radar and in the minds of every board director. Boards also may require additional administrative and advisory resources at the full-board (or committee) level to apply their experience and expertise most effectively. Boards may wish to debate whether they should create a specific secretariat (staffed by individuals from within, and external to, the company) to provide this resource, or whether it is more desirable to draw this informally from the organisation.
Risk metrics are important to a boards oversight of risk. But beware of people who bring you simple solutions to complex problems.
Michael H. Thaman
Chairman and Chief Executive Ofcer, Owens Corning
Board risk data is often insufciently predictive. There are just not enough lead indicators.
John Stewart
Chairman, Legal & General
Implications
Boards must ask if theyre getting the right data to begin with, and in a form where they can unpick the risk assumptions of the business. Non-financial data is important to the risk debate and should be included in the information presented to boards. Boards should challenge the executive to develop more predictive forms of risk data with lead, as well as lag, indicators so that they can devote more time to risk horizon-scanning and scenario-planning. Boards should, where appropriate, complement their risk data review with expert external perspectives, particularly around geo-political issues.
I followed Enron very closely and they had all the principles and every system in place, but they failed because they didnt have the culture.
Inge K.Hansen
Independent Advisor and Board Member, Hydro
Conrad Albert, general counsel of German media company ProSiebenSat.1, puts it succinctly: The best processes are worthless if the people behind them dont have an awareness of risk. Inge K. Hansen, chairman of Norwegian aluminium and energy supplier Hydro, agrees. You dont get a better system by adding more controls. Instead you should focus on the values and cultures within the company. Thats the most important thing. How then does a board assess whether employees actions and behaviours reflect the desired risk culture? Opinions are divided. Michael B. McCallister, chairman of the board of the American health benefits company Humana, believes boards should be realistic about the extent to which they can influence risk culture. There is no way that the board can have oversight of ethical behaviours within the business, other than by watching, he says. Any big company, no matter what business it operates in, or what its culture is, is going to have people fall out of its ethical expectations. To a great extent, others agree. The only way to monitor the risk culture, in their view, is to visit corporate offices and, in the words of one interviewee, sniff the wind. Some suggest other indicators, such as human resources information and employee surveys, would reveal systemic cultural behavioural risks. For the moment, few boards appear to analyse such data as part of their risk oversight role, but one that does is Legal & General. According to its chairman, John Stewart, his board believes that retention and turnover statistics, and the extent to which the company is seen as a career destination of choice, are useful business culture indicators. Directors also can lead by example, says David Sidwell of UBS. It starts by your choice of people on your board. Do they share the values that youre trying to embed in the organisation? Boards and executives should recruit fellow directors who embody the values and risk culture of the company.
The real evolution and value will come when risk nds its way into day-to-day behaviour and culture. It will become one of the things that people pay attention to. It will become part of what people do implicitly.
Michael B. McCallister
Chairman of the Board, Chief Executive Ofcer, Humana Inc.
Implications
Boards should consider what cultural data exists in their organisation to complement the hard numbers and risk models. These could range from employee performance data (retention rates, misconduct meetings) to health and safety indicators. Boards should also make better use of digital listeningtuning into what people are saying about the company in blogs, comments, wikis, chat rooms, etc.to pick up emerging issues among their workforce. Boards should be particularly alert to poor management style and behaviour in the organisation, as these will tend to be replicated at the front line. Boards should push for the integration of risk sensitivity and consciousness into performance management as a means of embedding risk cultures into the organisation. Should the board choose to get out into the business to sniff the wind and check the cultural health of the organisation, it first needs the consent and cooperation of the executive.
The chairman has a fundamental role in creating the right board culture and environment that, in turn, allows constructive criticism and challenge.
John Stewart
Chairman, Legal & General
The chairman also has to highlight strategic risk issues for the CEO, and yet steer talk clear of operational risk concerns that are managements purview. For one interviewee, the independence of the person leading risk discussions is an important check against the power of the executive directors. If the company has a particularly strong CEO, he says, the board often begins to defer to the CEO on risk matters, and that must be avoided.
Implications
Boards, led by the chairman, may need to invest time, energy, and resources into building a collaborative culture. This might include considering how much time to allocate to free-ranging risk debate and how to create the right environment to permit such uninhibited discussion. The relationship between the chairman or lead director and the CEO is also critical to fostering (or inhibiting) constructive exchange between the board and the executive. Boards should not be reluctant to intervene if the relationship sours. External perspectives and expertise are valuable to broadening and deepening the debate and in stimulating thinking. Boards may wish to consider whether such perspectives would enhance and enrich their exercise of risk oversight and help challenge some of the fundamental risk assumptions of their business. Boards should consider whether they have sufficient metrics to analyse the quality of directors interaction, the value of risk discussions, and overall effectiveness during periodic board reviews.
Rotation of board directors, with a limit of tenure of perhaps six years, would be a way of allowing people to gain experience, whilst giving organisations the option of removing those who are under-performing. This would also create greater uidity in the market for board directors.
Xavier de Sarrau
Chairman of the Board, Lagardre Chairman of the Audit Committee, JC Decaux Board Member, Bernardaud
10
the notion of term limits gained some traction as a tool for replacing directors who are no longer an asset to the board. Instead, the pressure is increasing to use individual performance reviews to produce behavioural changes, encourage resignations, or enable outright dismissals. In a typical board review, directors comment on one another covering two areas: First, does their attitude and behaviour promote effective board dialogue and exchange? Second, to what extent have they succeeded with delegated tasks or on a committee? A number of other companies extend this process by asking their executive leadership teams to comment on directors effectiveness as well. Whatever the means, many of the interviewees say the ends of renewal are invaluable. The longer things go on, the more complacent the board gets with risk, says Elvind Reiten, chairman of the board of the Norwegian paper company Norske Skog. Like all teams, boards have a life span.
Implications
Boards should consider an ongoing system of board renewal, whether through term limits or some other mechanism, to keep pace with the change in risk. They should keep in mind, as well, the implications for succession planning and resourcing.
The mix and experience of the board is crucial. If you surround yourself with people who look like you, you are unlikely to do the shareholders any favours.
Philip K. Asherman
President and Chief Executive Ofcer, CB&I
11
Risk oversight also demands intellectual horsepower. Directors must be able to review data, but not get lost in the spreadsheet. They must assess what information is there, but also what is missing. They must be able to balance historical data with leading indicators. Finally, the overall board needs a wide range of experience. Certainly the finance expert will have his or her eye on the money. But who might spot the devastating risk to reputation? Or the risk of a major missed opportunity? If the directors are from a diverse range of backgrounds, our odds of catching a risk are increased, says John Surma, chairman and CEO of United States Steel Corporation.
Implications
Board diversity is an issue with important consequences for the balance and bite of risk discussions. We believe boards should consider seriously whether they have the balance of women, ethnic minorities, and representation of overseas markets where the company is operating. Expectations should be conveyed to prospective directors. One interviewee suggests that a public company director should spend 10 to 20 percent of his or her time focused on board work. If board members are required to bring relevant senior executive experience and devote more time, will they expect higher remuneration?
Conclusion
The risk-smart board will always be a work-in-progress. The limits and boundaries of its oversight role will continually adapt and respond to the changes in economic and business cycles, and to the shifting relationship between the board and the executive. Board risk data and intelligence undoubtedly will improve as boards demand more predictive reports and lead indicators of internal and external business risk. Boards will also use more innovative ways to map, track, and understand an organisations risk culture and align it with the boards risk appetite. Finally, boards will seek a balance of directors with risk experience and risk wisdom. They also may look to refresh that talent on a more regular basis. The risk-smart board will continue searching for ways to see deeper and more clearly. We may need to work with mathematicians and physicists to model the future and scenario-plan around it, suggests John Stewart, chairman of Legal and General. We have to think how we identify the risks we havent thought about. For the risk-smart board is, by nature, never satisfiedand might worry if it was.
12
Key contacts
Paul Turner Chairman, Industrial Practice, EMEA London Korn/Ferry International +44 20 7024 9318 Stephen P. Mader Vice Chairman Boston Korn/Ferry International +1 617 790 5700
Asia Pacific
Auckland Bangalore Beijing Brisbane Guangzhou Hong Kong Jakarta Kuala Lumpur Melbourne Mumbai New Delhi Seoul Shanghai Singapore Sydney Taipei Tokyo Wellington