Rebuilding Trust Through Better Risk Monitoring

A recent op-ed article in the Financial Times by noted author and professor, Frank Portnoy, raises the question about the need to hold corporate managers personally accountable for gross negligence when they do not monitor risks. Mr. Portnoy proposes having senior executives at major banks certify that they are actively monitoring the risks taken in areas such as trading desks that have resulted in recent losses due to rogue trading activities. He summarizes his view in the following way.

Current rules permit directors and officers to avoid personal liability for gross negligence. That is a wise rule for most business decisions: courts are generally not skilled at assessing business judgment. But risk is different. Why should a bank manager who is grossly negligent in supervising risk avoid liability?

Shareholders might never be able to understand the risks of modern banks, and current regulatory approaches will not give them much confidence. But if they knew that senior managers had agreed to be personally liable for gross negligence in monitoring risk, they might trust the banks more. Without trust, it is hard to see how banks can recover.

Mr. Portnoy is correct to promote the notion of greater accountability for monitoring risk. However, attaching personal liability to executives may not necessarily be the best method. It would be very difficult to define what is an adequate level of risk monitoring since it really differs for every institution. That is why the industry is so heavily regulated. However, Mr. Portnoy is certainly on point in the fact that stronger risk monitoring is needed to rebuild trust in banks.

Another Example of the Value of Risk Management

It seems that some financial institutions have not fully learned the lessons from past rogue trading incidents such as the ones that occurred at Societe Generale and Barings. Officials at UBS announced today that they are facing massive losses at the hands of a lone trader. Here's what BBC reported this morning.

Police in London have arrested a 31-year-old man in connection with allegations of unauthorised trading which has cost Swiss banking group UBS an estimated $2bn (£1.3bn). Kweku Adoboli, believed to work in the European equities division, was detained in the early hours of Thursday and remains in custody. UBS shares fell 8% after it announced it was investigating rogue trades. ZKB trading analyst Claude Zehnder said the news would damage confidence in UBS. "They obviously have a problem with risk management."

This is yet another example of the value of having a strong risk and control program. While it is difficult to control external events, companies can certainly implement proper internal controls to protect from massive losses such as this one.

Increasing Your Risk Awareness

Companies of all sizes are searching for direction as they seek growth during these tumultuous economic times. Some companies are looking for better ways to deploy capital while others are simply fighting for survival. It is during times such as these that many do not take the time to seek perspective on the risks that they face. However, the strongest companies realize that having a solid understanding of their unique risks is vital to their continued success. These companies also realize that the risks they face are ever-changing - both internally and externally.

The first step to developing a better understanding of risk is to conduct an Enterprise Risk Assessment based on the company's strategic objectives. This risk assessment will serve as the baseline for measuring risk responses going forward and also as the foundation for a broader Enterprise Risk Management ("ERM") program. As a company implements their ERM program, it is critical that a culture of risk awareness rather than risk aversion is promoted. A "risk aware" culture embraces risk as the flip side to the reward they seek.

However, simply identifying, measuring and mitigating risks is only part of achieving "risk awareness". An effective way to gain this perspective is to examine how the business is evolving in relation to its overall strategic direction through the Risk Awareness Cycle (see figure below). At any given time, a product, service or an entire company is in one of four stages of evolution - Order, Complexity, Chaos or Simplicity. Within each of these stages, risks take different forms. In addition, to continue as a viable enterprise, movement from one stage to the other is essential. Without movement, an enterprise will lose forward momentum and ultimately fail.

To learn more about how you can increase your company's risk awareness, visit www.WheelhouseAdvisors.com.

SEC Launches Office of the Whistleblower

Just more than a year after the Dodd Frank Wall Street Reform and Consumer Protection Act was signed into law, the Securities & Exchange Commission ("SEC") has established a new office to handle one of the major provisions of the act.  The Office of the Whistleblower was publicly launched last week.

To aid in the submission of whistleblower tips, the new office has created a website that provides details on how whistleblowers should provide information and what whistleblowers should expect. According to the website the SEC, "... is authorized by Congress to provide monetary awards to eligible individuals who come forward with high-quality original information that leads to a Commission enforcement action in which over $1,000,000 in sanctions is ordered. The range for awards is between 10% and 30% of the money collected."

Potential whistleblowers are encouraged to report their issue through a company's internal compliance program before contacting the SEC.  In fact, according to the final rules, the SEC will consider increasing the overall award amount if the whistleblower utilizes the internal compliance channels.  The following is an excerpt from the SEC's whistleblower rule book.

Participation in internal compliance systems. The Commission will assess whether, and the extent to which, the whistleblower and any legal representative of the whistleblower participated in internal compliance systems. In considering this factor, the Commission may take into account, among other things:
(i) Whether, and the extent to which, a whistleblower reported the possible securities violations through internal whistleblower, legal or compliance procedures before, or at the same time as, reporting them to the Commission; and
(ii) Whether, and the extent to which, a whistleblower assisted any internal investigation or inquiry concerning the reported securities violations.

Companies should use this opportunity to communicate the importance of reporting issues through internal channels before reporting to the SEC.  For those companies that do not have a well constructed compliance program, now is the time to build one.

Perilous Times Require Strong ERM Programs

Each day as we read the news across the globe, it is apparent that the business environment continues to be laden with a myriad of risks. Without advance preparation, companies looking to advance their strategies will find themselves at the mercy of some unforeseen event that will threaten their success or perhaps their very survival. In times like these, it is critical to have a strong enterprise risk management ("ERM") program that is woven into the fabric of a company's strategy as well as its day-to-day business operations.

However, implementing an effective ERM program today is no easy task. Faced with an uncertain regulatory and economic outlook, many companies struggle to create a cost-effective, focused program that will provide the necessary insight to anticipate the most critical risks.  While each company and industry may be unique, there are a few common steps that can be taken that will lead to a more effective ERM program.

1. Start with the strategic plan - focus ERM efforts on where the company is going, not where it has already been

2. Create a simple framework and process that is easily understood - too many companies try to make ERM more complicated than it needs to be

3. Demonstrate importance of the program with a C-level champion - whether it is a new Chief Risk Officer, the CFO or even the CEO, a key leader must lead the charge

4. Tie risk management objectives and metrics to existing performance metrics - business goals require incentives and risk management objectives are no different

5. Invest in cost-effective enabling technologies - a wide range of risk management technology solutions exist today and choosing the wrong solution can result in cost overruns and poor results

By taking these steps, you will certainly be headed in the right direction on your ERM journey. However, the ultimate success factor is maintaining a long-term commitment to ERM as a valued business discipline. To learn more about creating a successful ERM program, visit www.WheelhouseAdvisors.com.

ERM Adds Strategic Value

As enterprise risk management ("ERM") becomes a more widely accepted practice, many companies are realizing the value of including a risk viewpoint in their strategic planning exercises. In the past, many executives viewed risk management purely as a loss avoidance exercise.  However, now that ERM is providing a broader view of risks and allowing companies to become more resilient, companies are more willing to incorporate the employment of calculated risks into their strategy formation.  A recent study by the Economist Intelligence Unit provides the following insight into this changing view of ERM.

One important indication that a shift might be occurring, however, is that 75% of executives think that risk considerations are playing an increasingly important role in strategy at their organisations. This suggests that rather than playing a preventative role—avoiding financial losses, for example—risk management could be moving towards an enabling role that contributes more fully to corporate strategy.

To navigate risks for both the shorter and the longer term, many firms are beefing up their risk management systems. ABB, for one, is increasingly moving away from a decentralized risk management model and putting in place a more group-wide strategy. “We’ve put in place a centralized enterprise risk management program over the last 12 months, and viewing holistically all the risks we face in the organisation,” confirms Mr Hall. “What we realized in the financial crisis, particularly from a financial point of view, is that the best way to manage risk is centrally.”

Martin ten Brink, a director at Shell, a British oil giant, says his company intends to refine some aspects of its enterprise risk management system in the coming year, particularly the pricing of risk. Furthermore, he says, Shell is improving the way it gauges risk velocity. The firm is targeting “a better understanding of the speed with which a risk can materialize and impact business performance.”

Wheelhouse Advisors is uniquely qualified to help companies build ERM programs that can be a source of strategic value. To learn more, visit www.WheelhouseAdvisors.com.

Demand for ERM Continues to Grow

More companies are beginning to realize the value of Enterprise Risk Management ("ERM") as a discipline that can propel a business forward rather than hold it back. In the recent past, many ERM programs focused primarily on revisiting problems from the past or examining all risks regardless of size. While these types of exercises can keep people busy, they rarely benefit a company that is trying to navigate forward to achieve successful outcomes. However, according to recent comments by a risk expert at the Risk and Insurance Management Society, ERM is evolving into a highly valued business practice. Here is what she had to say in an interview conducted by propertycasualty360.com.

Today, a growing perception that ERM “is a business discipline that can advance an organization’s [big-picture] objectives” is driving higher adoption rates across all types of organizations, says Carol Fox, director of strategic and enterprise-risk practice with the Risk and Insurance Management Society.

While there is also a perception that risk managers are having difficulty getting invited to a seat at the C-suite table, Fox believes that most corporate leaders, with only rare pockets of resistance, are eager for expert input about the strategic risks the organization faces.

“With all the external pressures—whether it’s Dodd-Frank, shareholders or the disclosures required now by the SEC for public companies—there is plenty of demand, visibility and support at the board level and at senior-management level” for ERM, she says.

As more board members and senior executives become acquainted with the usefulness of a well-designed ERM program, the discipline will become a "must have" for companies looking to compete in the new economy.

When Assessing Risk, Don't Forget the People

The Conference Board released a report today about the need for stronger integration of human capital risks into a company's overall enterprise risk management program.  Too often, these risks are left to the human resources department to manage alone with little understanding of the potential impact to a company's entire operation.  After surveying 161 leading companies worldwide, here is what the researchers discovered.

At most companies, human capital accounts for at least half of operating costs and can have a significant impact on business results. However, the study finds that human capital risk (HCR) — which can range from unionization/labor relations to offshoring and outsourcing to staffing in a pandemic — tends to be siloed in human resources departments, away from the companywide assessment and mitigation processes of enterprise risk management (ERM). This arrangement prevents information about HCR from having a role in the comprehensive, aggregate view of risks, root causes, interactions, and impacts through which leaders set priorities and determine overall strategy.

Out of eleven risk categories, executives ranked HCR as having the fourth highest impact on business results, ahead of financial, reputational, supply chain, and IT risks. This high ranking is evidence that HCR should be taken seriously as an enterprise risk.  However, less than one-third (31 percent) of companies believe they effectively assess human capital risk, and 24 percent believe they do an ineffective job.

During an economic crisis such as the one we have experienced, many companies lose sight of what really drives a business - people.  Understanding the risks associated with the primary business driver is certainly a no-brainer.

Now Is Not The Time to Reduce Investment in Risk Management

As we head into the second half of 2011, the economic recovery here in the US and abroad is taking hold much more slowly than most expected. Given the modest recovery, some executives may be looking to slash expenses to boost profitability and achieve their near-term goals. However, while tempting, cutting staff and investment in the wrong areas may prove to be a company’s undoing. For financial services companies, this is particularly true in the area of risk management because they are still mending their practices in the wake of the recent financial crisis.

According to the Financial Times, US regulators are keenly aware of what may be on the minds of bank executives and are issuing warnings to avoid cutting risk management budgets. According to Michael Alix, a senior vice-president at the Federal Reserve Bank of New York who heads the risk-management function within the regulator’s financial-institutions supervision group, the regulators are paying close attention to any plans to lower investment in risk management programs. “We haven’t seen it yet, but we’re vigilant,” says Alix.

Sacrificing the progress made in strengthening risk management programs at this precarious stage of recovery is certainly short-sighted and could lead to even greater problems for companies looking to weather the next storm.

Collaboration is Key for GRC Success

An interesting study on the current state of Governance, Risk Management & Compliance ("GRC") programs has just been released and the results are quite revealing. Entitled "The Role of Governance, Risk Management & Compliance in Organizations", the study was conducted independently by the Ponemon Institute for EMC.  The study covered four primary domains - IT GRC, Operations GRC, Finance GRC and Legal GRC - and surveyed 190 GRC practitioners across the United States.

One of the primary findings was the fact that organizations are still limited by their ability to collaborate and communicate risk information across the enterprise. Part of the problem lies in the lack of a comprehensive strategy to improve collaboration. Beyond the lack of a strategy, organizations are also limited by their technological support of GRC programs. Here's what the Ponemon Institute surmised.

We believe this study reveals the importance of an enterprise-wide strategy and increased collaboration among domains to meeting eGRC objectives. Currently, only 20 percent have an enterprise-wide strategy and collaboration among GRC areas is far from perfect. Only 28 percent of respondents say their organizations enjoy frequent collaboration or cooperation among GRC areas. However, the good news is that only 12 percent say GRC areas operate in silos in their organizations.

In order to address the barriers related to collaboration, it has been recommended that organizations make it a priority to encourage people from the various lines of business to talk together and establish “risk ambassadors”. The need to gain visibility and control through effective cross-enterprise eGRC collaboration is important to reducing gaps in how risk is assessed and managed.

Finally, according to respondents, managing risk is and will continue to be the biggest eGRC focus for their organizations. This is understandable because organizations are finding that the cost of complying with the plethora of regulations can be daunting. Taking a risk-based approach toward compliance requirements enables them to focus their resources on the most at-risk areas of their business and achieve real value from their eGRC activities.

Building the right processes, involving the right people and utilizing the right technology are all key to achieving the sort of value that GRC programs should provide. Wheelhouse Advisors is uniquely qualified to bring these key elements together for your organization. Email us at NavigateSuccessfully@WheelhouseAdvisors.com to learn more.

Waves of Reform Impacting ERM Efforts

As Enterprise Risk Management ("ERM") has evolved as a discipline over the last decade, it has been largely shaped by waves of reform efforts resulting from corporate fraud in the early 2000's to economic catastrophes and widespread corruption in the latter half of the decade. According to a recent article by Mary Driscoll in Business Finance Magazine (a partner publication of The ERM Current), a new wave of ERM change and focus is at hand. Through several sources, Mary offers her view of the most recent wave and the one on the horizon.

The third wave, which is proving just as significant, came in early 2010 in the form of SEC Rule 33-9089, which "mandates disclosure of risk oversight and risk reporting lines, risk assessment by business unit, and assessment of the risk associated with compensation plans," explains Paul Walker, Associate Professor of Commerce at the University of Virginia and a leading academic in the field.

"Furthermore, the recent Dodd-Frank Wall Street Reform and Consumer Protection Act has raised the risk bar by mandating risk committees and risk experts on those committees. Add to this the fiduciary duty pressure on boards and the potential risk-related lawsuits, and you end up with risk getting attention at every level of the organization," adds Walker.

Now consider this twist. According to an article by Deloitte Financial Advisory Services LLP's Toby Bishop, "The Dodd-Frank Act has created a large financial incentive for whistle-blowing in companies across all industries." An area of particular concern relates to violations of the Foreign Corrupt Practices Act, and that could mean higher potential liabilities for companies moving aggressively into emerging markets where local officials expect to trade access for cash.

What has your company done to prepare for the potential impacts of these waves?  If you would like to learn more about practical, cost-effective solutions, let us know by emailing us at NavigateSuccessfully@WheelhouseAdvisors.com.

The Path to ERM Success

The path to success in implementing an Enterprise Risk Management (”ERM”) program can be found in greater integration and better technology - that’s according to a recent survey presented at the 2011 Risk and Insurance Management Society (”RIMS”) Conference in Vancouver, British Columbia. Entitled “Excellence in Risk Management VIII”, this is an annual independent survey of executives conducted for RIMS by Marsh. The most common focus area noted in the survey is a desire to strengthen enterprise or strategic risk management approaches. While more than half of the survey respondents indicated this desire, a majority saw the primary barrier to achieving this goal was a lack of understanding of the risk landscape across numerous silos of information.

As a result, 55% of the respondents expect to integrate risk management deeper into and across operations and 54% of respondents expect to perform day-to-day risk management activities more efficiently. To meet these expectations, organizations will need to improve the way they gather and report risk data through more cost-effective technology. The survey report supports this notion through the following observation. “It’s worth noting to risk managers that their counterparts in the C-suite were the most likely to view technology upgrades as a focus area. This should help pave the way for technology that can ease the time spent on mundane tasks and open the door to developing the deeper integration of risk management with other departments.”

Source: Risk & Insurance Management Society, Excellence in Risk Management VIII

How to Strengthen Your IT Risk Management Program

An essential component of any Enterprise Risk Management (ERM) program today is IT risk management. With ever-increasing threats to privacy and information security, companies are looking to strengthen their risk governance processes in many ways.

A recent survey by Carnegie Mellon University’s CyLab highlights ten key steps to building a stronger ERM program with a focus on IT Risk. The CyLab 2010 survey is based on results received from 66 respondents at the board or senior executive level from Fortune 1000 companies. Twenty-seven percent of the respondents were board chairmen; 3 percent were outside directors; 47 percent were inside directors; and 50 percent were senior executives but not a board member. Forty-five percent of the participants were from critical infrastructure companies.

The survey revealed that governance of enterprise security is lacking in most corporations, with gaps in critical areas. If boards and senior management take the following ten actions, they can significantly improve their organizations’ security posture and reduce risk:

1. Establish a board risk committee separate from the audit committee and assign it responsibility for enterprise risks, including IT risks. Recruit directors with risk and IT governance expertise.

2. Ensure that privacy and security roles within the organization are separated and responsibilities are appropriately assigned. The CIO, CISO/CSO, and CPO should report independently to senior management.

3. Evaluate the existing organizational structure and establish a cross-organizational team that is required to meet at least monthly to coordinate and communicate on privacy and security issues. This team should include senior management from human resources, public relations, legal, and procurement, as well as the CFO, the CIO, CISO/CSO (or CRO), the CPO, and business line executives.

4. Review existing top-level policies to create a culture of security and respect for privacy. Organizations can enhance their reputation by valuing cyber security and the protection of privacy and viewing these as corporate social responsibilities.

5. Review the components of the organization’s security program and ensure that it comports with best practices and standards and includes incident response, disaster recovery, and breach response plans.

6. Establish privacy and security requirements for vendors based on key aspects of the organization’s security program, including annual audits or security reviews.

7. Conduct an annual audit of the organization’s enterprise security program, to be reviewed by the audit committee.

8. Conduct an annual review of the enterprise security program and the effectiveness of controls, to be reviewed by the board risk committee, and ensure that identified gaps or weaknesses are addressed.

9. Require regular reports from senior management on privacy and security risks and review annual budgets for IT risk management.

10. Conduct annual privacy compliance audits and review incident response and security breach notification plans.

These steps should be integrated into a holistic enterprise risk management approach to provide an effective and seamless program that is fully embraced at all levels within the organization. Doing so will not only raise a company’s risk mindfulness level, but also secure positive returns for key investors and stakeholders for years to come.

Understanding the 2011 Top Global Risks

Earlier this year, the World Economic Forum established a Risk Response Network ("RRN") to facilitate dialogue among global leaders about the most important risks impacting our environment and economy. Kevin Steinberg, Chief Operating Officer, World Economic Forum USA, and Head of the Risk Response Network provided the following thoughts on the goals of the RRN. "Throughout the extreme shocks of recent years, both public and private sector leaders have been struggling to avoid collapse and keep the economy afloat. The World Economic Forum is launching the Risk Response Network: an umbrella of projects and initiatives all designed to help global leaders better understand, prepare for and respond to risk.”

With the launch of this new initiative, the World Economic Forum published a report on the most critical global risks that must be addressed in 2011. This report draws upon a risk perception survey of 580 global leaders, 18 risk analysis workshops and 50 risk expert consultations resulting in an assessment of 37 global risks. The resulting analysis is very intriguing and represents a true opportunity to begin addressing risks in a more proactive manner.

Viewing Risk in a Different Way

Several previous blog entries have explored the notion of approaching Risk Management in a new way. Rather than simply focusing on mitigating risk through various methods, companies and individuals alike should strive to seek a greater understanding of risk to improve their decision-making and maximize value to the organization. By doing so, an ever-present view of risk and opportunity will propel an organization from focusing purely on Risk Management to a new state of Risk Mindfulness.

David Spiegelhalter, leading risk expert and professor at Cambridge University, supports this view in a recent video (see below) that is both enlightening and humorous. Through his real-life examples, Professor Spiegelhalter provides a unique view of how we as humans typically view risk. His lessons are particularly relevant as we continue our struggle to emerge from the financial crisis of 2008. As he concludes, "One of the biggest risks is being too cautious."

New Breeding Ground for Risk Topics

Board members of public companies are accustomed to passing along any risk related issues to the Audit Committee and/or Risk Committee. However, many of these directors are discovering risk related issues are not necessarily the specific purview of those groups. One committee in particular is becoming a breeding ground for risk topics - the Compensation Committee. With incentive programs entering the spotlight through greater disclosure about their impact on risk taking and heightened investor scrutiny, a new set of board directors need to be concerned with risk management. Here is what a leading expert had to say recently about the change.

Finally, an important means for compensation committees to address the risks that they now face is to ensure that they and the compensation-setting process are fully integrated into the overall risk-oversight activities of the board and the company. The financial crisis and its legislative and regulatory aftermath have focused considerable attention on the relationship between incentives in compensation programs and the risks that arise for companies, and as a result the compensation committee has become a crucial component of the risk-oversight process. The compensation committee’s attention to risks—through a periodic evaluation of the compensation program and how pay elements could create risks—has now become a regular part of the analytical framework.

How is your Compensation Committee addressing risk? Having the ability to articulate the linkage between incentive programs and a company's risk appetite is critical to proactively addressing investor concerns.  If you or someone else in your company is interested in learning more about bridging this gap, contact us at NavigateSuccessfully@WheelhouseAdvisors.com.

Stepping Back to Move Forward

New survey results on Enterprise Risk Management ("ERM") practices at global financial institutions was released last week by Deloitte.  The survey points to the changing attitudes towards ERM as well as the continued challenges many institutions face as they implement ERM programs.  Here is a summary of the survey results.

The seventh edition of the report, titled "Navigating in a Changed World," surveyed chief risk officers–or their equivalent – from 131 financial institutions from around the world, with aggregate assets of more than $17 trillion and representing a range of financial services sectors including banks, insurers and asset managers.

Among other major findings in the survey:

• While the majority considered their institution to be either extremely or very effective in risk management overall, one-third of survey participants graded themselves below that level.


• Not only is the chief risk officer (CRO) role more prevalent at financial institutions, but he or she is reporting to higher levels in the organization. According to the survey, 86 percent of institutions had a CRO in place, up from 73 percent in 2008, and reports to the board level or to the CEO (or both) at 85 percent of institutions. In addition, they are playing a more strategic role.


• More institutions have adopted enterprise risk management (ERM) programs -- 79 percent of institutions reported having a program or equivalent in place or in progress, an increase from 59 percent in 2008.


• While the value of ERM has increased, so have the challenges of implementing the information and technology infrastructures to support a comprehensive program; the importance of information and technology management in effective risk management has only been emphasized by the events of the global financial crisis.


• The top-rated risk management technology challenge among those surveyed was integrating risk data across the organization, which was rated as an extremely or very significant issue by 74 percent of executives.


• More than 80 percent of institutions experienced significant impacts from regulatory changes in the countries where they operate; at 40 percent of responding institutions, these impacts included the need to maintain higher capital levels and the need to maintain higher liquidity ratios.

It seems that while ERM is gaining in prominence within these organizations, the primary challenges to a successful ERM implementation remain.  Many companies will find themselves needing to take a step back to streamline ERM processes before trying to tackle the gaps in information and technology.

Incentive Pay & Risk Back in the Spotlight

Yesterday, the Federal Deposit Insurance Corporation (FDIC) approved a proposal to limit excessive risk taking that is tied to incentive programs at large financial institution. The proposed rules are a result of the Dodd-Frank Act of 2010. Here is a summary of the new rules from the FDIC's website.

The Board of Directors of the Federal Deposit Insurance Corporation (FDIC) today approved a joint proposed rulemaking to implement Section 956 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. Section 956 prohibits incentive-based compensation arrangements that encourage inappropriate risk taking by covered financial institutions and are deemed to be excessive, or that may lead to material losses.

Consistent with Dodd-Frank, the proposed rule does not apply to banks with total consolidated assets of less than $1 billion, and contains heightened standards for institutions with $50 billion or more in total consolidated assets. For these larger institutions, the rule requires that at least 50 percent of incentive-based payments be deferred for a minimum of three years for designated executives. Moreover, boards of directors of these larger institutions must identify employees who individually have the ability to expose the institution to substantial risk, and must determine that the incentive compensation for these employees appropriately balances risk and rewards according to enumerated standards.

Chairman Bair said "This proposed rule will help address a key safety and soundness issue which contributed to the recent financial crisis – that poorly designed compensation structures can misalign incentives and induce excessive risk-taking within financial organizations. Importantly, we believe the rule will accomplish its objectives in a way that appropriately reflects the size and complexity of individual institutions. Importantly, this inter-agency proposal will apply across all types of US financial institutions, limiting the opportunity for regulatory arbitrage. Similarly, it will better align US compensation standards with those which have been adopted internationally under the framework approved by the Financial Stability Board in 2009."

Public comment will be accepted for 45 days prior to final approval. In addition, the rules are a joint effort of the Federal Financial Institutions Examination Council (FFIEC), the Securities & Exchange Commission (SEC) and the Federal Housing Finance Agency (FHFA) who each must also approve the rules. These rules are a step in the right direction for those more interested in long-term results, but they will certainly be the subject of intense debate.

CNBC Profiles Internal Audit & Risk Management Practices

Earlier this week, the Institute of Internal Auditors' Richard Chambers was interviewed by CNBC on the evolving nature of risk management practices in light of the recent financial crisis. Mr. Chambers emphasized the need for corporate boards to set the risk appetite and work with management as well as the internal auditors to monitor the level of risks. In addition, he noted that compensation programs still need to be improved such that risk metrics are included in pay determination.  To view the entire interview, click below.

Getting the Most Out of ERM

The Committee of Sponsoring Organizations of the Treadway Commission, or more commonly known as COSO, released a report this month on how companies can derive the most benefit from their Enterprise Risk Management (ERM) programs.  Authored by two professors and risk practitioners from DePaul University, the report provides approaches and action steps for companies to follow as they embark on their ERM journey.  Here is a summary list of key activities to bolster the ongoing implementation of an effective ERM program.

1. A program of continuing ERM education for directors and executives


2. ERM education and training for business-unit management


3. Policies and action plans to embed ERM processes into the organization’s functional units such as procurement, IT,or supply chain units


4. Continuing communications across the organization on risk and risk management processes and expectations


5. Development and communication of a risk management philosophy for the organization


6. Identification of targeted benefits to be achieved by the next step of ERM deployment


7. Development of board and corporate policies and practices for ERM


8. Further discussion and articulation of a risk appetite for the organization and /or significant business units, including quantification


9. Establishment of clear linkage between strategic planning and risk management


10. Integration of risk management processes into an organization’s annual planning and budgeting processes


11. Expansion of the risk assessment process to include assessments of both inherent and residual levels of risk


12. Exploration of  the need for a dedicated Chief Risk Officer or ERM functional unit

Wheelhouse Advisors is fully equipped to help companies with activities such as these.  For more information, please visit www.WheelhouseAdvisors.com.