The risk management of

everything
MICHAEL POWER

MICHAEL POWER THE BACKGROUND him/ herself. In short the primary risk, that the
is PD Leake Professor of financial statements are materially misstated, has
Accounting and a Director of
come to be thought of also in terms of a secondary

I
the ESRC Center for the recently decided that there was no longer
Analysis of Risk and
risk, the risk of financial and reputational losses to
space to store 20 years worth of
Regulation (CARR) at the auditors themselves.
Accountancy and Accountancy Age. Prior
London School of
to disposal I reviewed all the back issues for Recent professional preoccupations with
Economics. practice management, quality control and client
([email protected]).
articles of particular note worth saving. In the
course of this process, a number of things were selection processes are a further reflection of this.
striking. First, articles on financial reporting were Changes in the regulatory environment for the
conspicuous in the 1980s, and in the 1990s it was accountancy profession, the emergence of the
auditing which seemed to be the main object of corporate governance codes, new areas of work
discussion. Second, risk and risk management driven by new legislation, and the liability
begin to receive regular exposure only from about environment, all make the focus on secondary risk
the mid-1990s onwards. In particular, the late management very understandable and rational at
1990s reveal an increasing commentary on the level of the individual firm or practitioner. At
practice management and risks to professional the macro or systemic level there is more cause for
partnerships. concern. The accountancy profession as a whole,
This review was not a formal content which has historically been granted a monopoly
analysis and the observations are impressionistic. over work regarded as essential to the risk
However, the recent accent on risk management management of the corporate economy, namely
by accountancy practices provides the point of auditing, may be becoming preoccupied with
departure for this lecture. risks to itself. However, this is much more than an
The audit risk model, as an idea if not a accountancy-centered story of the problems
concrete practice, can be traced back to the 1980s. created by the liability law, as some would argue.
In time this developed as business risk auditing It is systematic, cross-functional and concerns
(BRA) with different firms offering proprietorial many other agents and agencies in society.
variations on the same theme. Of particular Indeed, society is facing a major challenge,
interest in this methodological development is the whereby those agencies traditionally charged with
manner in which "audit risk," originally handling (pooling, collectivizing, reporting)
conceived in terms of the risks of client business primary risks on behalf of others, such as
(sub-analyzed into control risk and inherent risk) professions, insurers and government, are
and the risks of the audit process (sub-analyzed as
sampling and non-sampling risk), came to be This article was originally published in Balance Sheet, Vol. 12
understood to include the risks to the auditor No. 5, pp. 19-28, ISSN 0965-7967.

58 T H E RISK MANAGEMENT OF EVERYTHING VOLUME 5 NUMBER 3 2004

focusing increasingly on their own risks with a view to the basis for enterprise-wide risk management thinking, for
avoiding responsibility, blame andfinancialpenalty. risk-based regulation, and for accountability and governance.
This is the problem underlying the idea of "the risk In short, internal control is now an unshakeable part of the
management of everything," namely that there is an ongoing moral economy of organizations in which specific
shift in society in the balance between primary and secondary responsibilities for different categories of risk are allocated.
risk management, with a marked growth in the latter. This transformation in the status and scope of internal
There is no doubt that risk talk and ideas of risk control is a project of turning organizations "inside out" and
management have become more prominent in recent years. of making their risk-based internal control systems a public
Specifically, since 1995, the year that Barings bank collapsed and potential disclosable matter as never before. This process
and Shell experienced reputational damage with the disposal has been under construction for some time. In the USA, the
of Brent Spar in the North Sea, there has been a literature and COSO framework in the early 1990s provided a conceptual
conference explosion in the risk management area. New framework for internal control and is now being remodeled as
journals have been created and old journals have been an enterprise risk management template. The Sarbanes-Oxley
renamed to include the word "risk." Numerous texts book Act section 404 takes the public focus on internal control to
have been written on risk management, particularly on new the next level. Directors of the Securities and Exchange
objects of concern such as "operational risk" and "reputational Commission (SEC) registrant companies will be required to
risk." Regulatory changes, notably the Basel 2 proposals for evaluate the effectiveness of internal controls relating to
banks, have provided a further stimulus to the risk financial reporting, and auditors are required to certify the
management industry and in many organizations senior risk process by which directors arrive at this evaluation and to
positions, like chief risk officers, have been created. In the UK provide an opinion on effectiveness itself. At a seminar in
public sector, central government has undertaken a major risk Spring 2004, it was reported that the SEC expects 20 percent
management initiative and risk is becoming a basis for of the s404 audit opinions to be qualified in some way.
challenging the quality of public services. Reporting on internal control effectiveness has always
Over this period the quantitative expansion of risk been problematic, and has been discussed in the UK
management has been accompanied by very important throughout the 1990s since the original corporate governance
qualitative changes, notably the alignment of risk code was created. While auditors have privately developed a
management with good governance agendas. In addition, basis for assessing internal controls, to determine the extent of
there has been much talk of the strategic benefits to substantive tests, and have been active in reporting on control
organizations resulting from more explicit risk management. issues to management, the public reporting of internal control
This lecture strikes a more critical tone and argues that effectiveness has proved problematic. Effectiveness is itself
the rise of risk management has been characterized by an elusive and auditors remain hesitant about giving public
increasing accent on risk management for defensive and opinions in this and other areas because of liability concerns.
secondary risk management purposes, and that this shift in The historical tendency is for auditors to give opinions on
focus may in fact pose very serious risks to society. management processes, so the advent of s404 reporting will be
The argument begins in the very heartland of challenging and will mark a new phase in the public life of
accountants and auditors: internal control. private control.
The rise of internal control systems and their
THE RISE OF INTERNAL CONTROL increasingly public role can be explained by a number of
factors. First, organizations have come to recognize the self-
Six years ago in 1998 I gave the first PD Leake lecture insurance aspects of good internal controls as a basis for
on the theme of "The audit implosion: regulating risk from reducing and rationalizing insurance. Second, internal control
the inside" which anticipated the growing importance of systems have become central to regulatory strategies, such as
internal auditors and organizational internal control systems. Basel 2, concerned to work with the grain of organizations'
Since then, the Turnbull report has become a blueprint for own systems. Third, the rise of internal control is
thinking in the UK, expanding its influence well beyond the symptomatic of an institutionalized mode of responding to
intended private sector audience to become a generic crisis and failure by extending the formalization of reporting
conceptual framework for internal control and risk and control functions. Sarbanes-Oxley is a classic example of
management. In addition, internal control has been elevated this as a response to Enron and other high profile failures.
from its lowly and private organizational position to become More generally, we observe that a whole spectrum of difficult

VOLUME 5 NUMBER 3 2004 THE JOURNAL OF RISK FINANCE 5 9

primary risk issues get translated into problems of Risk communication
organizational control systems. These organizational
translations of risk are to be seen in the cases of BSE and farm The significance of risk communication has been
argued for many years, but has only relatively recently begun
management systems; the Shipman murders and registration
to surface in public policy. A critical community, including
and monitoring systems for doctors in the UK; earthquakes
academics, has argued for many years that in matters of public
and building regulation controls; terrorism and the
interest, particularly health and safety, risk acceptance
organization of security services. decisions cannot simply be left to scientific experts. The
Societies have no option but to organize in the face of distributional issues involved in public risk management
risk, and this extends the reach of internal control into every demand greater democracy in the decision process and many
aspect of organization life. Given the significance of areas of risk knowledge are themselves so uncertain that
organizations for individuals (we work in them, buy goods and scientists cannot claim any unique authority. Indeed,
services from them, send our children to school in them), the scientists began to find themselves on the back foot, arguing
rise of internal control is part of the risk management of both that they are the risk experts, but admitting that many
everything. However, the rise of internal control as an areas of relevant scientific knowledge are essentially
conjectural.
unquestionable principle should also give cause for some
concern. Such systems may project ideas of controllability In this setting, where public perceptions of risk may also
which are unjustified and which may generate expectations be varied, it has come to be accepted that the legitimacy of
public risk management policy demands a degree of
gaps of a new kind. Will auditor reporting on such systems in
communication and involvement with the public and with
fact improve public trust in organizations, or will it represent a
stakeholder organizations.
form of risk management which looks increasingly defensive
Extending this line of argument, it can be claimed that
and uninformative, the managerial equivalent of political spin? risk communication practices are in part concerned with
The challenge for policy makers is to understand how managing the reputation of government, a reputation which
the logic of secondary or reputational risk management is can be said to be "at risk" where there is a gulf between public
beginning to percolate and pervade internal control and risk expectations of performance and service delivery, and
management agendas. This is as true for the state as it is for perceptions of that performance. The idea of an "expectation
business. gap" is of course well known to accountants, but is not unique
to the problems of auditors. Such gaps can be managed with
THE STATE AS RISK MANAGER strategies to change the performance dimension of the gap.
Alternatively, or in addition, an attempt can be made to
Modern states, with welfare and social insurance change the expectations dimension of the gap, i.e. to
systems, have always been concerned with the management of "educate" and enfranchise relevant publics via risk
social risk. However, such states have only recently begun to communication and participative schemes.
think of themselves explicitly in terms of risk management An important feature of risk management and this
ideas. In the UK, this change has been largely brought about accent on risk communication in the domain of public policy
by a number of crises, notably BSE and the handling of the is the management of reputational or political risk to
foot and mouth crisis in the public health domain, and project government. Another way of putting this is to suggest that,
and systems failures, such as in the UK passport office. In while government and its agencies, such as the Department of
recent years state sector organizations have begun to import Health, certainly focus great efforts on first order risks to the
public associated with, say, mobile phone radiation and food
and implement risk management ideas and blueprints from
quality, there are also more conspicuous strategies to manage
the private sector. There is an observable "Tumbull effect" in
reputation by avoiding the potential for blame.
schools, universities, hospitals and charities, and financial and
One potentially important aspect of risk
project risk management has become an important feature of
communication concerns the very concept of "risk" itself
private-public partnerships.
which, though subject to different definitions, implies the ex
Two areas where the state as risk manager is most ante possibility that things can go wrong or not turn out as
evident are the emphasis on risk communication and the expected. This is relevant to the second public policy theme in
development of explicitly risk-based regulatory systems. risk management - risk-based regulation.

60 THE RISK MANAGEMENT OF EVERYTHING VOLUME 5 NUMBER 3 2004

 Risk-based regulation strategy is adopted for reputation management purposes, ex
post it will remain difficult to control public responses because
It is now well known that there has been a profound crises are distributional and impact on some people more than
shift in ideas about regulation in the last 20 years or so. others. Despite this, reputation management has emerged as
Regulatory systems increasingly seek to work with the grain of an ambition to control such public responses.
organizational control practices, enlisting them in the
regulatory process and preferring to establish broad REPUTATIONAL RISK
frameworks rather than detailed rules. The Company Law
review in the UK has this ambition. This approach has the Today, most business people, when asked about the risk
merit of being efficient and cost-effective and gives regulatory which worries them most, will often mention reputation. Yet
processes a legitimacy that an older command and control the idea and practice of reputation management is itself very
style may have lacked. Organizational internal control systems young, created in the wake of Shell's experience of attempting
are an essential feature of this style of regulation, its mirror to dispose of Brent Spar in the North Sea in 1995. In an
image at the organization level. orchestrated campaign against the company, stations were
States have created a number of distinct agencies to boycotted, particularly in Germany, and there was resulting
regulate specific functional areas. In the UK the Financial economic loss. In response the company undertook a
Services Authority (FSA), The Food Standards Agency, the sweeping internal review. Sea-based disposal of the old unit
Health and Safety Executive, and the Healthcare Commission was calculated to be the least environmental harmful option,
are examples, and there are many others. Indeed, the growth but Shell had failed to communicate this to the public and to
of such agencies, particularly in the wake of the privatization relevant interest groups.
of many utilities, is said to characterize the UK "regulatory An example closer to the home of accountants concerns
state." the demise of the firm Andersen. The lesson seems to be that
Some of these agencies have recently become more the actions of a few employees can bring down an entire
explicit about having a risk-based approach to regulation. The organization via a "multiplier" effect - markets can interpret
principle is that an ongoing risk assessment of regulated the actions of the few as a signal about the culture of the
entities will enable resources to be directed to areas where they whole. The event certainly galvanized reputation management
are most relevant and where risks are deemed to be higher. thinking within the accountancy profession. Specifically, the
Organizations with risk management and control systems client acceptance and retention decision, assessment of the
regarded as effective, i.e. those whose process of self-control "tone at the top" of clients, and the risk management of
are good, can be regarded as low risk and subject to a accountancy firms themselves have all received considerable
moderated regime of inspection and enquiry. The operating attention in recent years.
philosophy of the UK FSA clearly reflects this. Risk-based From an accounting point of view, reputational risk
regulation also provides the basis for a common language turns the concept of materiality upside down. Traditionally,
between regulator and regulated, even to the extent that the but not exclusively, thought of in terms of financial
two become more similar in their formal structure magnitude, reputation means that even apparently small
("isomorphism"). events or losses, such as a minor regulatory fine, can have
Some regulators are making increasingly explicit claims larger repercussions. Much depends on how and whether
that risk-based regulation means that regulation is not an certain events are amplified or not by wider social processes,
insurance process, that things can go wrong and that such not least the media and legal systems. And these amplification
agencies cannot be a priori responsible for every possible processes are not normally under the control of most
failure. Being public about this meaning of risk is a kind of organizations. This means that reputation risk reflects a new
reputation management strategy, an effort to displace an sense of vulnerability, a dread factor for senior managers as
apparent public expectation of zero-failure, exacerbated by well as politicians, and has created new demands to make
political discourses of zero-tolerance. reputation "manageable."
Here the politics of risk becomes complicated. On the While organizations can do much themselves to
one hand events like the demise of Equitable Life might be mitigate these secondary or reputational risks, they remain
regarded as tolerable from a statistical or systemic point of hostage to the institutional environment in which they
view, but is experienced by large numbers of people as operate. Effort is being expended on external stakeholder and
catastrophic. So whatever ex ante risk-based communicative relationship management, including the development of

VOLUME 5 NUMBER 3 2004 THE JOURNAL OF RISK FINANCE 61

strategic partnerships. From this point of view, the current Of course, it can be argued that the distinction between
interest in corporate social responsibility (CSR) can be argued primary and secondary risk is artificial for organizations whose
to be a defensive strategy; CSR is simply subsumed within assets are largely intangible and reputational. The primary risk
reputation risk management. is identical to the secondary risk. So the rise of reputational
If everything can potentially threaten reputation, then risk management is simply a product of the emergence of the
reputation risk demands the management of everything. "new economy" and the need to manage intangibles. And for
brand rich organizations, it is completely rational to manage
EXPLAINING THE RISK MANAGEMENT OF reputation. Nevertheless, secondary risk management remains
EVERYTHING an issue for individual organizational actors for whom the
costs of blame are perceived as high. The risk management of
To summarize the argument so far, there has been an everything involves everyone becoming a risk manager.
explosion of risk management practices since the mid-1990s We should be very concerned about a society and its
across a wide variety of organizational contexts. Internal constitutive organizations (professional bodies, corporations,
control has emerged from being a private matter to being at universities and hospitals, etc.) when they expend increasing
the heart of organizational governance; internal control and resources on defending themselves. The consequences of an
risk management have become increasingly co-defined; the obsession with secondary risk manage-ment are potentially
UK state has begun to think explicitly of its risk management very serious.
role and risk-based regulatory organizations are more
prominent; categories such as "reputation" have emerged to THE RISKS OF RISK MANAGEMENT
characterize a newly visible kind of threat to organizations. In
short, risk management seems to be everywhere. Claims for the benefits of risk management are
numerous. In financial services organizations, risk
management has enabled a new focus on asset and earnings
Why has this happened?
quality. In the corporate sector more generally, risk
The common sense answer is that the rise of risk management has become perceived as integral to business
management is simply an efficient response to the fact that the strategy and to value creation. Risk management has been
world has become more risky and dangerous. The sociologist shifted from a back-office, transaction-veto defensive role into
Ulrich Beck, author of Risk Society, is often attributed with a fundamental part of the business model. Risk officers and
this view (a little unfairly). However, it is more accurate to say chief risk officers have been created as champions of risk
that while the world of developed economies is now much management, seeking to embed the risk management gospel
safer from natural dangers, it has generated a number of man- within a broader organizational culture. In the public sector,
risk management is becoming part of the way organizations
made risks as side effects of progress. Many societies are more
challenge themselves in the absence of market mechanisms.
conscious that these issues demand organizational control,
And in all these settings it is widely accepted that the managed
intervention and management. Expectations have increased
taking of risks is essential to progress and the creation of value
because, as Beck rightly argues, processes of individualization
- with the exception of extreme enthusiasts for the
in modem societies have also increased, creating more
precautionary principle.
demanding contexts in which all organizations now operate.
Notwithstanding these claims, for which there is
These social environments are sometimes described in terms
considerable support, time may show that risk management is
of "compensation" or "blame" cultures, but they are also
more like the latest management fad than a timeless panacea.
environments which simply demand more decisions in more
And there is a darker side to these developments than is often
areas of life.
apparent.
Accordingly, risk management and the wider
"Turnbullization" of UK organizational life is primarily a Legalization and hyper-internal control
defensive response to a more activist and demanding
organizational environment of consumers and stakeholders. The accountancy trade press regularly reports
The risk management of everything may well reflect increased practitioner concerns about the costs of compliance with
attention to primary risks to health, financial and physical, but corporate governance initiatives. The Sarbanes-Oxley
it is also characterized to a very large extent by secondary risk legislation seems to have taken these concerns to a new a level,
management of reputation. but compliance with International Accounting Standards, the

62 THE RISK MANAGEMENT OF EVERYTHING VOLUME 5 NUMBER 3 2004

proposed review of the Tumbull guidance, recent FSA this matter, ask the question: what assumptions about human
proposals for reporting on corporate governance and the nature underlie the Sarbanes-Oxley act?
impending regulation of the Operating and Financial Review At worst, risk management based internal control
(OFR), not to mention Basel 2 for the banking sector, add to threatens to imprison organizational thinking. The fearful
the weight of opinion about the corporate regulatory concern with reputational risk leads to a loss of materiality as
overload. categories of control become more fine-grained. Indeed, as
There are genuine economic risks of the internal control professional service firms and professions more generally
and risk management explosion. Getting the cost to benefit apply these ideas to themselves, they become potentially
ratio wrong of such initiatives means that they will be far from inward-looking and pre-occupied with secondary risk.
economically efficient, even if they satisfy political demands The role of professional judgment in society as a whole,
for action. While such a regulatory evaluation is important, not just that of accountants, is threatened by these effects. An
some effects of risk management are not only hard to quantify, implicit contract exists between society and expert
but require in the first instance adequate conceptualization. occupations. In return for monopoly rights over areas of work,
The growth of risk management out of internal control risky but necessary judgments are made for the greater good.
involves an intensified focus on process, and on auditable These are judgments which could be made reasonably at one
trails of documentation. This creates a certain internally time, but might in retrospect turn out to be wrong. Today,
legalized organizational environment. Legalization does not this sense of reasonable judgment is subject to increasing
mean the law literally but the process by which a distinctive pressure from a legalized environment, referred to variously as
style of rule making pervades organizational life. From this the "consumer movement," the "human rights culture" and
point of view, the formal difference between laws, voluntary the "compensation culture." While such external pressures
codes and in-house procedures matter very little; what matters play a role in assuring the quality of professional services, by
is their effects. Indeed, it can be argued that many providing a point of challenge and potential sanction, there is
organizations, and perhaps accounting firms too, internally also a growing sense that the defensive investments they
amplify imagined legal risks with internal processes which trigger are out of control.
systematically build in forms of caution, and which create Take the recent money laundering regulations in the
incentives for responsibility avoidance via formal modes of UK. The press anticipates a wave of "defensive" reporting to
compliance. There is a vicious circle linking the multiplication the National Criminal Intelligence Service (NCIS) by
of rules to rule-like actor mentalities. Risk management accountants and lawyers, managing their own risks in relation
systems "hard-wire" defensiveness in organiza-tions but this is to the legislation. In the university sector, student references
not to be identified simply with risk aversity. Systems may have become more anodyne and less informative over the
well affect risk appetite, but it is only necessary to say that they years (more like audit reports?). As a consequence, such
enable responsibility avoidance, whereby agents allocate more references have become devalued and employers recruit
non-productive time to managing the secondary risk of "employment risk management" consultants to do searches.
adverse outcomes. So a risk industry feeds on the consequences of secondary risk
If the 1980s was the decade of intensifying external management.
accountability for organizations, the 1990s and the corporate If we look at the regulations which pervade
governance revolution added pressures for greater internal organizational life, they are all individually reasonable. But
accountability, facilitated by an internal control system which they all demand systems of internal control to demonstrate
is also a responsibility allocation system. Risk management is visible compliance, and their collective effect is to force
largely an extension of this trend. A form of hyper-internal opinion formation underground or to make it only visible in
control amplifies the time and attention spent on secondary coded form accompanied by complex disclaimers.
risk management by organizational actors and professional Individual teachers, accountants, lawyers or doctors
agents in a climate of heightened expectation. Typically, as the cannot be blamed for this state of affairs. Far from it; it is
process becomes more finely grained, individuals are completely rational to invest in secondary risk management
increasingly concerned with the risks of being seen not to strategies to avoid blame for downside outcomes. The
comply with the system, as well as with managing first order problem is systematic and therefore much more serious. A
risk in a visible way. However, they are increasingly distracted "morally thin" environment is being created which, despite
from first order risk issues and get socialized into a certain way much talk of the "opportunity" inherent in the new risk
of thinking about the organization. If one has any doubts on management and the Sarbanes-Oxley requirements, is

VOLUME 5 NUMBER 3 2004 THE JOURNAL OF RISK FINANCE 63

profoundly damaging to professional cultures. Whatever and the FSA proposes a new form of auditor reporting for the
critique might be mounted about those cultures, such as their combined code.
historical lack of accountability, it remains true that all In the current environment, it is only too easy to predict
individuals in society need, at crucial times and without what may happen. Reports by auditors and others will default
hesitation, to trust professional judgment, whether that of a to a standardized form with defensive, uninformative
tax adviser or a doctor. That need is frustrated when those wording. Liability is often regarded as the main culprit for
same professionals, including politicians, appear to be this, but this is doubtful. A change in liability law for auditors
preoccupied to a great extent with their own risk. The risk might have an effect over the long term, but the secondary risk
management of everything, and the rise of hyper-internal management practices of many individuals and organizations
control, is a symptom of a profound crisis in our trust in are now part of their operating culture. A change in the law
informed but necessarily imperfect judgment. would provide but a small dent in this. Furthermore, excessive
lobbying for law reform may also damage reputation.
CONCLUSIONS AND RECOMMENDATIONS The challenge is daunting, because it is not rational for
any individual, organization or professional institute to
It has been suggested that a certain kind of secondary or initiate changes on its own. But this in effect is what will need
reputational risk management increasingly pervades to happen, with political support. The challenge of the risk
organizational life at all levels of society. A growing activism management of everything is to roll back the culture of
and individualism in the environments of organizations, secondary risk management before it consumes organizational
amplified by political pressures, has resulted in an life. This effort will need to be conducted at two levels: risk
intensification of internal control practices. From this broad management practice and political discourse.
point of view, despite the positive talk, the new wave of risk At the level of risk management practice, the need is for
management can be regarded as a defensive reaction to an an "intelligent" risk management which is not control
increasingly demanding environment. Professionals will argue obsessed and which has a second order capacity to observe and
that that the law, an aggressive media and an over-responsive challenge the effects of the internal control system itself. Some
political system are at the center of this story. Certainly, the organizations will say they already have this intelligence. It is a
capacity to challenge the, often very ideal, organizational
free press and media, core institutions of liberal democracies,
models and assumptions inherent in risk management
are not without reputational issues of their own in early 2004,
standards and the systems whose design they inform. It is also
but they remain a powerful conduit for secondary risks to
a capacity to avoid being swept away by regulatory programs -
organizations.
very difficult given the wave of recent initiatives in the
The risk management of everything is not simply to be corporate world. In addition, there is a need to nurture
discussed at the level of the effects of organizational internal no-blame internal organizational environments.
controls, although this is where the current discussion has laid
There is nothing very original about these suggestions,
most emphasis. It is also to do with problems of political
but they would require all organizations to develop operating
culture, and the failure to develop a politics of uncertainty in
philosophies of experimentation rather than compliance.
which failure can be openly spoken of both ex ante as possible From this point of view scenario analysis has the value to
and ex post as not always blameworthy. stimulate the imagination of possible alternatives to the
Assuming the above analysis strikes some chords in the present, rather than as a method of prediction.
world of practice, what might be done about it? As far as At a more systemic or political level a new politics of risk
accountancy is concerned, we stand on threshold of some is required. An older politics of risk sought to challenge expert
critical developments. Expectations seem to high, maybe too judgment, particularly that of scientists, by increasing public
high, that the new OFR will provide a disclosure vehicle participation in risk management processes. A new politics is
capable of satisfying analysts demands for information about required which restores trust in expertise and which re-enlists
strategy and risk, and social demands for information relevant honest professional judgment in the public domain. The
to wider corporate responsibility. In addition, the creation of safe havens for judgment does not mean making
requirements of Sarbanes-Oxley section 404 will begin to bite professionals non-accountable. Rather, it is to have public
for some companies, although this is likely to become diffused recognition of the essential dependence of society on that
as a standard for non-SEC registrant entities as well, rather in judgment even when failure is possible. A more differentiated
the way of ISO 9000. The Turnbull report will be reviewed public concept of failure would restore to the very center of its

64 THE RISK MANAGEMENT OF EVERYTHING VOLUME 5 NUMBER 3 2004

legal and conceptual framework the idea of reasonable Wales, for their financial support. The views expressed are my
judgment which might in retrospect prove to be mistaken. own and do not necessarily reflect those of the ICAEW. This
Outright rogues would need to be dealt with, but lecture is also available as a downloadable pdf file from the
only in the context of wider public acceptance that risk ICAEW's Center for Business Performance Web site where it
means ex post failures are possible, as some regulatory was originally published. For details of this briefing and other
bodies are trying to communicate. In short, a politics of related publications visit www.icaew.co.uk/cbp. Printed
uncertainty would create a public understanding of the copies are also available, if you would like a copy please phone
terms on which professional opinions of all kinds are the Centre for Business Performance (020 7920 8634). The
offered, an understanding grounded in a political culture briefing is free of charge. An expanded version of the
which tolerates uncertainty rather than the depressing arguments in this lecture is to found in Power M. (2004), The
ubiquity of disclaimer paragraphs. In this world, technical Risk Management of Everything: Rethinking the Politics of
reform of liability law might take place, but it would have Uncertainty, Demos, London. Available from
to be part of a larger shift in political consensus, a shift in www.demos.co.uk
which professional institutes, and corporate and political
leaders would need to play a part. ABOUT THE AUTHOR
These suggestions may seem very idealistic, and they are
no doubt underdeveloped and incomplete. But the stakes are Michael Power is PD Leake Professor of Accounting
high. The possible consequence of the risk management of and a Director of the ESRC Center for the Analysis of Risk
everything may be nothing less than the retreat of socially and Regulation (CARR) at the London School of Economics,
valuable intelligence from the public domain. In this lecture I where he has worked since 1987. He is a fellow of the Institute
have tried to suggest that the problem is reflected in, but is of Chartered Accountants in England and Wales (ICAEW)
much wider than, the position in which auditors presently and an associate member of the UK Chartered Institute of
find themselves. Indeed, society is in a bizarre predicament. Taxation. He has held visiting fellowships at the Institute for
Never before has there been such a need for considered expert Advanced Study, Berlin and All Souls College, Oxford. His
opinion in so many fields of social and economic life. And yet research interests focus mainly on the changing relationship
are we not designing institutions and risk management between financial accounting, auditing and risk management
practices whose effect is to frustrate that need? He is author of The Audit Explosion (Demos, 1994) and The
Audit Society: Rituals of Verification (Oxford University Press,
ACKNOWLEDGMENT 1999), which has been translated into Italian and Japanese,
and is currently being translated into French. His most recent
I am grateful to the Trustees of the PD Leake Trust and publication is The Risk Management of Everything: Rethinking
to the Institute of Chartered Accountants in England and the Politics of Uncertainty (Demos, 2004).

VOLUME 5 NUMBER 3 2004 THE JOURNAL OF RISK FINANCE 65