Now Is Not The Time to Reduce Investment in Risk Management

As we head into the second half of 2011, the economic recovery here in the US and abroad is taking hold much more slowly than most expected. Given the modest recovery, some executives may be looking to slash expenses to boost profitability and achieve their near-term goals. However, while tempting, cutting staff and investment in the wrong areas may prove to be a company’s undoing. For financial services companies, this is particularly true in the area of risk management because they are still mending their practices in the wake of the recent financial crisis.

According to the Financial Times, US regulators are keenly aware of what may be on the minds of bank executives and are issuing warnings to avoid cutting risk management budgets. According to Michael Alix, a senior vice-president at the Federal Reserve Bank of New York who heads the risk-management function within the regulator’s financial-institutions supervision group, the regulators are paying close attention to any plans to lower investment in risk management programs. “We haven’t seen it yet, but we’re vigilant,” says Alix.

Sacrificing the progress made in strengthening risk management programs at this precarious stage of recovery is certainly short-sighted and could lead to even greater problems for companies looking to weather the next storm.

The Auditors Are Coming!

Last week, the Public Company Accounting Oversight Board ("PCAOB") released proposed standards for auditors to examine and utilize risk assessments in their upcoming audits of major corporations.  These standards could prove to be significant in the evolving audit approaches for internal control over financial reporting (i.e. Sarbanes-Oxley Section 404).  Mark Olson, PCAOB Chairman commented on the purpose of these new standards,

“An appropriate assessment of risk is the foundation of a high quality audit. Today’s proposals are intended to strengthen that foundation, which should result in improvements throughout the audit.”

In performing their assessment of risk, auditors are guided first to examine the company's own assessment of risk.  For those companies that do not have a solid framework and/or understanding of their risks, this new standard could be problematic.   The standard states,

The auditor should obtain an understanding of management's process for:

a. Identifying risks relevant to financial reporting objectives, including risks of material misstatement due to fraud ("fraud risks"), b. Assessing the likelihood and significance of misstatements resulting from those risks, and c. Deciding about actions to address those risks.

Factors that should be evaluated in determining which risks are significant risks include:

a. Whether the risk is a fraud risk; Note: A fraud risk is a significant risk. b. Whether the risk is related to recent significant economic, accounting, or other developments; c. The complexity of transactions; d. Whether the risk involves significant transactions with related parties; e. The degree of complexity or judgment in the recognition or measurement of financial information related to the risk, especially those measurements involving a wide range of measurement uncertainty; and f. Whether the risk involves significant transactions that are outside the normal course of business for the company, or that otherwise appear to be unusual due to their size or nature.

If your company is looking to strengthen its risk assessment process or build a new risk assessment framework to prepare for the new proposed standard, then click here to contact us and learn more about how our firm can help your company Navigate Successfully™.