ERM Growing as an Accepted Practice

This year, the US Securities and Exchange Commission instituted new disclosure rules requiring public companies to inform their shareholders about the role of the board of directors in overseeing risk management. A major US law firm recently reviewed annual proxy statements of S&P 500 corporations to determine the extent and nature of risk management across various industries. One of the more interesting findings in the review was the number of companies who are employing Enterprise Risk Management programs to help manage their risks. Here is what they reported.

In the wake of the financial crisis, many companies have implemented more comprehensive and integrated risk management programs, and boards of directors have expanded their risk oversight to encompass not just the legal and financial risks that audit committees have traditionally overseen, but also the full panoply of risks that a company may face.  Enterprise risk management (ERM) is the current buzzword applied to a top-down holistic approach to risk management.  It addresses all of an enterprise’s risks—including operational, financial, strategic, compliance and reputational risks—under one umbrella, in contrast to the more traditional “silo” approach in which each operating function or division tackled risk independently.  ERM is not focused simply on risk reduction.  Rather, it encompasses an assessment of both upside and downside risks and, thus, helps inform the strategic planning process.  Indeed, to make informed decisions about the company’s strategic direction, the board must have a full understanding of all of the major risks involved.

Fifty-four percent of surveyed companies expressly used the term “enterprise risk management.” Sample disclosures are set forth below:

American Express Company:  “The Company relies on its comprehensive enterprise risk management process (ERM) to aggregate, monitor, measure and manage risks.  The ERM approach is designed to enable the Board of Directors to establish a mutual understanding with management of the effectiveness of the Company’s risk management practices and capabilities, to review the Company’s risk exposure and to elevate certain key risks for discussion at the Board level.  The Company’s ERM program is overseen by its Chief Risk Officer who is an executive officer of the Company and a member of the Company’s most senior management.”

Express Scripts, Inc.:  “In order to assist the board of directors in overseeing our risk management, we use enterprise risk management (“ERM”), a company-wide initiative that involves the board of directors, management and other personnel in an integrated effort to identify, assess and manage risks that may affect our ability to execute on our corporate strategy and fulfill our business objectives.  These activities entail the identification, prioritization and assessment of a broad range of risks (e.g., financial, operational, business, reputational, governance and managerial), and the formulation of plans to manage these risks or mitigate their effects.”

With more than half of the companies relying on ERM, the review shows that ERM is growing as an accepted practice beyond just financial services companies. If your company is looking to implement or simply improve your ERM program, Wheelhouse Advisors can help. Visit www.WheelhouseAdvisors.com to learn more.

SEC Borrows a Page from the ERM Playbook

In an acknowledgement of the need for improvement in their risk management practices, the U.S. Securities & Exchange Commission ("SEC") has created a new division for risk and strategy.  The SEC is following a similar path that many corporations are taking by creating an enterprise risk management program that will integrate silos of risk practices across the agency.  Here is what was reported by the Associated Press yesterday.

The Securities and Exchange Commission has merged several offices and functions to create a division of risk, strategy and financial innovation.  The new division will be headed by Henry T.C. Hu, a professor of banking and finance law at the University of Texas, the agency announced Wednesday. The division combines the SEC's Office of Economic Analysis, Office of Risk Assessment and other functions. It will assume those areas as well as strategic and long-term analysis, identification of new trends in financial markets, and risk to the financial system.

This is certainly a step in the right direction for an agency that is battling to regain its reputation for sound oversight and enforcement.  In addition, the goal of linking their risk assessment to long-term, strategic analysis will prove to be useful by proactively addressing problem areas before they become massive like the Madoff Ponzi debacle.

An Office of One - Revisited

For those who have been keeping up with The ERM Current™ this month, you might recall the blog from October 9 titled "An Office of One".   It details the Security and Exchange Commission's approach to risk management and the impact of cutting the office of risk management back to one person.  Well, in reading some earlier thoughts from former SEC Chairman Harvey Pitt, it seems that the vision for Enterprise Risk Management at the SEC was much broader and simply suffered under the current administration of Chairman Christopher Cox.   As Mr. Pitt explained in a Compliance Week article earlier this year, 

My years in government have taught me that government seems far more adept at examining the past than anticipating the future. When I became chairman of the SEC in 2001, for example, the agency had never—not once in its nearly seven decades—ever conducted a top-down management review of efficiency and processes. While the result of the review I commissioned recommended the creation of a risk-management group within the SEC, this recommendation has taken years to implement, and even then with a paucity of resources that makes the effort almost worse than never having undertaken it.

Mr. Pitt deserves credit for his vision.  If only he had been around longer to have seen it fully implemented, we may have been experiencing different and much less severe consequences today.

An Office of One

Earlier this week, Lynn Turner provided extensive testimony to the US House Committee on Oversight and Government Reform on the many ills of our current corporate and regulatory governance regime.  He had many great points, but one that stood out was his commentary on the demise of the Securities and Exchange Commission ("SEC").  The following is an excerpt from Mr. Turner's testimony.

"Regulation also failed to keep pace. At the Securities and Exchange Commission (“SEC”), the Office of Risk Management had been reduced to an office of one by February of this year. From 2005, the number of SEC enforcement division personnel was cut by 146 from 1338 to 1192 in 2007. In 2004, the SEC reduced the capital requirements for the largest Wall Street investment banks."

As he points out, the SEC mirrored what many companies were doing themselves - cutting back in areas that were meant to prevent future catastrophe.  During good times, few concern themselves with growing risks or possible downturns.  However, the SEC took "putting your head in the sand" to a new level by reducing their office of risk management to one person.

Mr. Turner offered the following recommendations to Congress and the SEC.

"The SEC also needs to take actions to shore up confidence in the agency which I believe has been seriously eroded as a result of the current crisis. For example, the Office of Risk Management should be adequately staffed to allow the agency on a proactive basis to identify risks in the market place such as those created by excessive leverage, or new financial instruments that carry significant system risks such as credit derivatives. Once identified, a plan for promptly and appropriately addressing regulatory and public policy issues should be formulated and an action plan established on a proactive basis before, not after, the train wreck has occurred."

Several years ago, the US Army ditched their slogan "An Army of One" for obvious reasons.  I think the SEC may need to do the same.  Your thoughts?

Click here to read more of Lynn Turner's testimony to Congress.